Censys Report Highlights Internet Exposure Blind Spots in AI, ICS and Legacy Software
Summary
Censys’ 2026 report finds growing exposure of AI-related tools, persistent ICS and legacy software exposure, and widespread use of non-standard service ports—visibility gaps that can hinder security programs.
Key points
- Hosts exposing AI-related tools grew more than 63% from October 2025 to July 2026; n8n was the most widely exposed product, with 113,926 hosts.
- Among n8n hosts with parseable versions, 76% reported a version within the affected range of at least one recent critical vulnerability.
- About 70% of globally observed ICS hosts were consistently found on consumer and mobile networks, complicating ownership identification and remediation.
- Most exposed software gradually updated over 2.5 years, but exposure levels for the oldest versions remained relatively stable.
- The United States hosted 45.5% of observed web-based threats, but the report says threat actors prioritize providers based on cost and permissiveness rather than country.
- Non-standard ports hosted 96% of observed SOCKS proxies, 68% of HTTP(S) services, and 34% of SSH services; tools limited to default ports may miss exposed assets.
Article Details
- Publisher
- Censys
- Report Period
- 2026
- Scope
- Internet-wide analysis covering AI exposures, ICS exposures, vulnerability response, threat infrastructure, and the Internet at large.
- Sample Size
- Not disclosed
- Key Statistics
- From October 2025 to July 2026, hosts exposing AI-related tools grew by more than 63%.
- Censys observed 113,926 exposed n8n hosts; among those with a parseable version, 76% reported versions within the affected range of at least one recent critical vulnerability.
- Global ICS exposure grew roughly 4% over two years; roughly 70% of hosts running ICS devices and services were consistently found on consumer and mobile networks.
- The United States hosted 45.5% of observed web-based threats, including phishing and other deceptive pages.
- Non-standard ports were used by 96% of SOCKS proxies, 68% of HTTP(S) services, and 34% of SSH services.
- Recommendations
- Scrutinize administrative infrastructure supporting AI, including platforms that coordinate workflows, connect agents, or store credentials.
- Use security tooling that provides visibility into all Internet ports, not only common or default ports.