Your TV Is the Weakest Door in the House, a 10-Million-Home Study Finds

The front door has a smart lock and the garden has cameras. The weakest point of a modern family home may be the television. A report published on 28 October by the security company Bitdefender and router maker Netgear, based on about 10.4 million protected home routers between January and September 2026, found that smart TVs produced 22.7% of all vulnerability observations, more than any other device type.

What the data shows

• About 5.4 billion security events and 1.2 billion vulnerability observations were logged, SecurityBrief reports.
• TVs (22.7%), smart plugs (22.4%) and network-attached storage drives (22%) together made up 67.1% of vulnerability observations.
• The average household now has 24 connected devices, up from 22 a year earlier.
• 99.97% of the vulnerabilities were linked to publicly known flaws (CVEs), problems that are already documented.
• 90.1% of detected attack activity was automated scanning; of 466.6 million password-guessing attempts, about 455 million targeted Windows Remote Desktop.

Two caveats. Bitdefender itself notes these are observations, not counts of unique vulnerable products or successful break-ins. And both companies sell home-network protection, so read the conclusions with that in mind.

The update gap

The core problem is time. As Help Net Security notes in its summary of the report, household electronics stay in use for five to ten years, while security support may last only two to four. After updates stop, a TV or storage drive stays online with flaws that will never be fixed. Some free smart-TV apps also bundle software that can turn the set into a residential proxy, relaying strangers' internet traffic through your connection once you accept the terms.

The risk does not stay on one device. "Once inside, criminals can stay hidden and move laterally across the home network," said Chandan Nandakumaraiah, head of product and cybersecurity at Netgear. Regulation is catching up slowly: since 29 April 2024, UK rules under the PSTI regime ban default passwords on connectable products and require makers to state how long they will provide security updates, according to techUK.

A device that no longer gets updates is not smart. It is an open window.

A Sunday-afternoon checklist

• List every connected device and check whether it still receives security updates; replace the ones that do not.
• Turn on automatic firmware updates for the router, TV, cameras and storage drives.
• Remove default passwords and use a unique one per device, kept in a password manager.
• Switch off remote access, port forwarding and UPnP you do not use, and keep admin pages off the public internet.
• On the TV, delete unused apps and review viewing-data and connection-sharing settings.
• If your router allows it, put TVs, plugs and cameras on a separate guest network.

For a large home or a family office, a professional network audit is worth the fee. If you think a device has been compromised, disconnect it and contact the manufacturer or a qualified security specialist.