Censys 2026 State of the Internet Report Finds Exposed AI Infrastructure Grew 63% in Nine Months

Rapid AI adoption, persistent ICS exposures, and evolving threat infrastructure underscore the need for Internet-wide visibility and context to defend against emerging and longstanding risks.

ANN ARBOR, Mich., Oct. 14, 2026 /PRNewswire/ -- Censys, the authority for Internet intelligence and insights, today released its fifth annual State of the Internet Report, the definitive industry report on the changing Internet, revealing that exposed AI infrastructure grew 63% in nine months. The report also identified roughly 134,000 Internet-exposed hosts running industrial control systems (ICS), with approximately 70% found on consumer and mobile networks, complicating efforts to identify their owners and address exposure.

The findings reveal a vast and volatile Internet, where AI infrastructure is expanding rapidly, industrial exposures persist, and software maintenance progresses unevenly. Distinct geographic patterns in threat infrastructure further illustrate how different parts of the Internet support different types of attacker activity.

Key Findings from the State of the Internet Report

For this year's report, the Censys Advanced Research Collective (ARC) analyzed historical and real-time data from the Censys Internet Map, which continuously monitors global Internet infrastructure, to track how the Internet is changing. Key findings include:

• AI global infrastructure is exploding: Internet-facing AI tools grew 63% in nine months, reaching nearly 268,000 systems. This includes not just chatbots, but also the behind-the-scenes tools that connect AI to data, applications, and user accounts.
• n8n is the most widely exposed AI product: n8n, a workflow automation platform, is by far the most commonly exposed at nearly 114,000 hosts, followed by OpenClaw (~54,000), a personal AI agent assistant. The U.S. (62,687), China (42,511) and Germany (31,222) account for just over half of all exposed AI infrastructure.
• North America continues to lead in ICS exposures: As of 2026, roughly 38% of the exposed global ICS landscape is in North America, followed by Europe (32%) and Asia (25%). Roughly 70% of hosts running ICS devices and services globally are consistently found exposed on consumer and mobile networks.
• China and the U.S. host a plurality of observed threat infrastructure: China is home to 36.6% of malicious host-level infrastructure like C2s and remote access tooling in contrast to the U.S.'s 16.8%. The U.S., conversely, hosts 45.5% of web-based threats like phishing and other deceptive pages, while China hosts only 20.9% of web-based threats observed by Censys.
• Organizations are patching, but the oldest software versions linger: Across all four products studied, Progress Telerik Report Server, Jenkins, Cleo MFT, and Microsoft SharePoint Server, organizations adopted newer software versions. However, the oldest versions remained largely unchanged throughout the study. 

"The Internet is constantly changing, and understanding how it changes is critical to modern cybersecurity," said Zakir Durumeric, Co-Founder and CEO of Censys. "New technologies such as AI introduce new layers of infrastructure. Identifying and continuously monitoring Internet-facing systems is essential to realizing AI's value without introducing unmanaged risk."

Availability

The Censys 2026 State of the Internet Report is available for download now. The Censys ARC research team will host a webinar, including a live Q&A, on the 2026 State of the Internet Report, Wednesday, October 14, 2026 at 11:00 AM ET. Visit the registration page to register for the event. 

About Censys
Censys is the authority for Internet intelligence and insights. Delivering the most complete, accurate, and up-to-date global map of Internet infrastructure, Censys provides industry-leading solutions for security operations, exposure management, threat hunting, and proactive incident response. Global governments, Fortune 500 companies, and security providers around the world trust Censys to uncover risks faster, respond more effectively, and prevent breaches before they happen.

Learn more at censys.com. 

SOURCE Censys