Nearly 268,000 internet-facing artificial intelligence (AI) systems have been identified worldwide, marking a 63 per cent increase over nine months and highlighting the growing security challenges associated with expanding AI adoption. The findings were published by cybersecurity intelligence firm Censys in its fifth annual State of the Internet Report, released on Monday. The report also identified approximately 134,000 internet-exposed hosts running industrial control systems (ICS), raising concerns about the security of connected infrastructure used to monitor and manage industrial processes. According to Censys, the expansion of AI technologies is creating additional infrastructure that organisations need to identify, monitor and secure. The exposed systems include more than consumer-facing chatbots, extending to platforms that connect AI tools with corporate data, applications and user accounts. These technologies can introduce additional security considerations when their services are accessible through the public internet. Among the most commonly identified exposed AI technologies was n8n, a workflow automation platform, with nearly 114,000 internet-facing hosts. OpenClaw, a personal AI assistant, followed with approximately 54,000 exposed hosts. Geographically, the United States recorded the largest number of exposed AI systems at 62,687, followed by China with 42,511 and Germany with 31,222. Together, these three countries accounted for slightly more than half of the global total identified in the report. The findings illustrate how the increasing use of AI tools is expanding the range of internet-facing services that organisations must account for in their cybersecurity strategies.
The report also highlighted the continued exposure of industrial control systems, which are used across industrial environments to monitor equipment, manage processes and support operational activities. Censys identified approximately 134,000 internet-exposed hosts running ICS technologies worldwide. Around 70 per cent of these hosts were found on consumer and mobile networks, creating additional challenges for researchers and organisations attempting to identify system owners and address potential security exposures. The distribution of exposed industrial systems varied across regions, with North America accounting for approximately 38 per cent of the global total, followed by Europe at 32 per cent and Asia at 25 per cent. These findings point to the challenges of securing operational technology as industrial environments become increasingly connected to wider networks. Systems originally deployed to support industrial operations may now have network connections that increase their visibility beyond their intended environments. However, Censys’s identification of internet-exposed hosts does not mean that all these systems have been compromised or that attackers can automatically exploit them. Internet exposure indicates that a system is accessible from the public internet, but the actual security risk depends on factors such as configuration, authentication controls, software vulnerabilities and the protections in place. The findings nevertheless underline the importance of identifying connected industrial assets and ensuring that they are appropriately protected against unauthorised access.
Censys also examined the geographic distribution of infrastructure associated with malicious cyber activity, identifying differences between host-level infrastructure and web-based threats. China accounted for 36.6 per cent of the malicious host-level infrastructure observed by the company, including command-and-control servers and remote access tools. The United States represented 16.8 per cent of this infrastructure. The distribution was different for web-based threats, including phishing operations and deceptive websites. The United States accounted for 45.5 per cent of the observed web-based threat infrastructure, while China represented 20.9 per cent. Censys noted that these figures describe the locations of observed infrastructure and should not be interpreted as identifying the nationality or physical origin of the individuals operating it. The report further examined software maintenance practices across four enterprise products: Progress Telerik Report Server, Jenkins, Cleo MFT and Microsoft SharePoint Server. While organisations increasingly adopted newer software versions during the study period, the oldest versions remained largely unchanged. This suggests that software maintenance progress is uneven, with some organisations continuing to operate older deployments even when updated versions are available. Such conditions can create challenges for security teams responsible for tracking software assets, assessing outdated deployments and ensuring that systems receive necessary maintenance. The findings indicate that monitoring software versions and identifying older installations remain important parts of managing an organisation’s internet-facing infrastructure.
Zakir Durumeric, co-founder and CEO of Censys, said the internet is constantly changing and that understanding these changes is essential to modern cybersecurity. He noted that emerging technologies such as AI introduce additional layers of infrastructure, making the identification and continuous monitoring of internet-facing systems important for organisations seeking to adopt AI while managing potential risks. The report was compiled by the Censys Advanced Research Collective using historical and real-time information from the company’s Internet Map, which continuously monitors publicly accessible internet infrastructure. By examining exposed AI services, industrial control systems, malicious infrastructure and enterprise software versions, the research provides an overview of changes across the global internet environment. The findings also demonstrate that organisations face security considerations across both newly adopted technologies and established systems that remain connected to public networks. As AI applications become more integrated with business data and services, organisations need to maintain visibility into the systems supporting those operations and understand which services are accessible externally. Similarly, industrial organisations need to identify exposed operational technology assets and review their network configurations. Maintaining software updates, tracking older deployments and continuously monitoring internet-facing infrastructure are among the measures highlighted by the report as important for managing exposure. Censys’s findings ultimately point to the need for organisations to keep pace with expanding digital infrastructure while ensuring that connected systems remain visible, maintained and appropriately secured.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
