Censys Finds 70% of Internet-Exposed ICS Hosts Use Consumer or Mobile Networks
Summary
Censys reports about 134,000 Internet-exposed ICS hosts in early 2026, with roughly 70% on consumer or mobile networks. Carrier registration data can make it difficult to identify and notify the organizations responsible for exposed devices.
Key points
- Censys observed an average of about 134,000 Internet-exposed hosts running ICS services or tooling in early 2026, up roughly 4% from about 129,000 in 2024.
- Approximately 70% of exposed ICS hosts were on consumer and mobile networks, where registration data may identify a telecom provider rather than the organization operating the device.
- The notification gap can prevent researchers from alerting the utility or manufacturer responsible for securing an exposed controller.
- CISA warned that threat actors targeted Internet-exposed PLCs, changing passwords and IP addresses; reported consequences included boil-water notices and extended manual operation.
- A joint FBI/EPA announcement identified Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers as targeted and reported incidents across at least seven states.
- North America accounted for more than 38% of global ICS exposure; the United States represented 32%, with over 40,000 exposed hosts.
- Europe’s share declined from 36.5% in 2024 to 32% in early 2026. Censys said the data does not establish why exposure fell.
Article Details
- Publisher
- Censys
- Report Period
- Early 2026; comparisons with 2024
- Scope
- Global Internet-exposed ICS hosts, geographic and network-type exposure trends, and the exposure notification gap.
- Sample Size
- Approximately 134,000 distinct Internet-exposed ICS hosts observed globally in early 2026.
- Key Statistics
- Approximately 70% of roughly 134,000 Internet-exposed ICS hosts were on consumer and mobile networks.
- Censys observed an average of 134,000 distinct Internet-exposed ICS hosts in early 2026, up roughly 4% from about 129,000 in 2024.
- North America accounted for more than 38% of global ICS exposures.
- The United States accounted for 32% of global ICS exposure, with more than 40,000 exposed hosts; Turkey ranked second with fewer than 10,000.
- Europe's share of global ICS exposure fell from 36.5% in 2024 to 32% in early 2026; France, Italy, and Belgium together accounted for approximately 85% of the decline.
- Recommendations
- Include operator-installed cellular modems in asset documentation and routine attack surface scans.
- Identify and notify the organization responsible for an exposed device so it can be remediated before exploitation.
Vendors
Allen-BradleyA joint FBI/EPA public service announcement issued the same day identified Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series controllers as targeted equipment and reported incidents across at least sevenRockwell AutomationA joint FBI/EPA public service announcement issued the same day identified Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series controllers as targeted equipment and reported incidents across at least seven
Products
Countries
BelgiumEurope fell from 36.5% of the global total in 2024 to 32% in early 2026, with France, Italy, and Belgium together accounting for approximately 85% of that decline.FranceEurope fell from 36.5% of the global total in 2024 to 32% in early 2026, with France, Italy, and Belgium together accounting for approximately 85% of that decline.ItalyEurope fell from 36.5% of the global total in 2024 to 32% in early 2026, with France, Italy, and Belgium together accounting for approximately 85% of that decline.TurkeyTurkey ranks second globally with fewer than 10,000 exposed hosts.United StatesThe United States Has Roughly as Many ICS Exposures as All of Europe
Industries
Industrial control systemsWhen industrial control systems (ICS) are connected through mobile networks, registration data often points to the telecommunications provider rather than the organization operating the equipment.Water and wastewaterRecent attacks against water and wastewater systems demonstrate why this gap matters.