The Internet's Attack Surface: Evolving at Different Speeds

Post Views: 16

The internet’s attack surface exhibits varying rates of change across different technologies and sectors, according to a recent analysis by Censys.

AI-Related Software Exposure

AI-related software exposed to the public internet experienced a 63% increase over nine months, rising from 164,088 IP addresses in October 2025 to 267,915 by July 2026. The rapid expansion of AI tools is driven by their integration into critical workflows. The analysis identified 44 products contributing to this trend, with n8n, a workflow automation platform, accounting for 113,926 exposed hosts. Of these, 76.1% operate versions vulnerable to high-severity flaws (CVSS score 9.0 or higher). These servers often store credentials for connected services, making them attractive targets.

n8n and OpenClaw

OpenClaw, a self-hosted AI agent, exemplifies the speed of exposure. Its initial release with a control panel in January 2026 led to 85,478 exposed interfaces by April 7, 2026, with two visible within six days of its launch.

Legacy Systems

Legacy systems persist with little evolution. Censys tracked Telerik Report Server, Jenkins, Cleo MFT, and Microsoft SharePoint Server from January 2024 to May 2026. For all four, the oldest version groups remained stable, with changes of less than 1 percentage point. These outdated instances are likely abandoned, as they show no signs of active maintenance.

Industrial Control Systems (ICS)

Industrial control systems (ICS) present unique challenges. Censys identified approximately 134,000 ICS hosts in early 2026, up from 129,000 in 2024. About 70% of these operate on consumer or mobile networks, often behind cellular modems at remote locations. Network registration records frequently link these devices to carriers rather than operators, complicating identification. Verizon’s cellular network alone hosts 10% of exposed ICS hosts and 27.5% of human-machine interfaces, the control panels used by operators. Many ICS systems also run standard IT services like HTTP or SSH, allowing attackers to bypass industrial protocol knowledge entirely.

Threat Infrastructure Distribution

Threat infrastructure distribution varies by attack type. Between October 2025 and June 2026, China hosted 36.5% of host-based threat infrastructure, including command-and-control servers, compared to 16.8% in the U.S. For web-based threats like phishing pages, the U.S. accounted for 45.5% of such infrastructure, while China hosted 20.9%. This divergence underscores regional differences in threat actor activity and infrastructure deployment.

System Update Rates

The rate at which systems update depends on their management. Exposed Jenkins hosts upgraded at 5% to 9% monthly, with no significant shifts during vulnerability disclosures. Cleo MFT hosts, however, remained stagnant at a median 1.9% monthly upgrade rate until two critical flaws were added to CISA’s list of actively exploited vulnerabilities. Following Cl0p ransomware’s claims of targeting the software, 63% of returning Cleo hosts migrated to newer versions by January 2025.