Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Researchers estimate how many industrial control systems are reachable from the internet by sending protocol-specific probes across public address space, recording which addresses answer in a recognisable way, and classifying the responses with fingerprints. The result is a count of what a given method could identify at a given time. It is not proof that a host is a working control panel, that it is vulnerable or compromised, or that it belongs to the organisation the IP address seems to point to.
That distinction explains most of the confusion around headline numbers. This article covers how the measurements are built, what the most visible published figures actually say, and how to read them without overreaching. It is written for security researchers, asset owners, OT practitioners, journalists and policy readers.
As an Amazon Associate I earn from qualifying purchases.
What an internet scan can and cannot establish
An internet-wide scanner connects to many addresses and ports, speaks enough of an industrial protocol (Modbus, Siemens S7, BACnet, IEC 60870-5-104 and others) to elicit a response, and stores the banner or metadata it receives. A fingerprint then maps that response to a product family or service type. Four things sit between the raw packets and the number a report prints:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Protocol coverage: a scanner only finds what it knows how to ask about. Services on unlisted protocols or non-standard ports are missed.
- Fingerprints: the rules that decide a response means “ICS”. Loose rules inflate counts; strict rules undercount.
- Scan timing: internet services come and go, so any count is a snapshot or a series of snapshots.
- Classification: deciding afterwards which hits are genuine industrial equipment and which are decoys, emulators, or unrelated hosts that happen to answer similarly.
What a scan does not establish: that the responding system controls a physical process, that it is exploitable, that anyone has attacked it, or who is responsible for it.
Services, hosts, devices: the unit decides the number
A single host can expose several industrial services, and a service fingerprint does not always prove which device sits behind it. Published figures therefore mean different things depending on whether they count IP addresses, hosts, services, inferred devices or web interfaces. Two numbers can only be compared when the unit, method and time window match.
#1 Best Overall
A real example shows the problem. Censys’s 2024 State of the Internet report said it observed more than 145,000 exposed ICS services globally. Its 2026 preview reported an average of about 134,000 distinct hosts with ICS services and tooling in early 2026. Read side by side, that looks like a fall of roughly 11,000, but it is not a clean decline: the units differ, and the 2026 preview itself restates the 2024 level as about 129,000 hosts, describing the move to early 2026 as roughly 4% growth. The like-for-like comparison is host count against host count, not service count against host count.
The published figures, with their qualifications
All numbers below come from a single vendor’s own scanning and classification. They are not an independent census, and other scanners will see different totals.
Recommended Free Tools
| Figure | Source and date | Unit | Caveat |
|---|---|---|---|
| More than 145,000 exposed ICS | Censys, 2024 State of the Internet report | Services, global | Not directly comparable with host counts. |
| About 129,000 (2024) and about 134,000 average (early 2026) | Censys, 2026 preview | Distinct hosts running ICS services and tooling | Preview calls the change roughly 4% growth. As of August 27, 2026, Censys had excluded hosts it judged likely not to be real ICS devices, so totals are subject to revision. |
| 764 ICS/OT events from 188 unique source IPs | Censys honeypot article (2026), capture of November 23 to December 1, 2025 | Inbound events at one honeypot | Nine days, one deployment; not a global rate. |
Geography
The 2024 Censys report put about 38% of exposed ICS services in North America, 35% in Europe and 22% in Asia, and stated that the U.S. alone accounts for over one third of global ICS service exposures. That is Censys’s analysis, not a regulator’s statement. The 2026 preview gives approximate shares of 38% North America, 32% Europe and 25% Asia. The first set counts services and the second counts hosts, so small shifts between them (Europe down, Asia up) should be treated as indicative at most.
The same 2024 report found that protocol mix differs by region: Modbus, S7 and IEC 60870-5-104 are more prominent in Europe, while Fox, BACnet, ATG (automatic tank gauge) and C-More are more common in North America. A country’s count therefore partly reflects which protocols a scanner covers well and which equipment types are common there, not just how careful local operators are.
Tracking specific device families over time
Censys’s 2025 study of device categories previously associated with targeting (published as “ICS and Iran: Exposure of Previously Targeted Devices”) measured biweekly from January through June 2025. Its January and June counts:
| Device family | January 2025 | June 2025 | Change |
|---|---|---|---|
| Unitronics Vision | 1,622 | 1,697 | +4.5% |
| Orpak SiteOmat | 158 | 123 | −24.9% |
| Red Lion | 2,453 | 2,639 | +7.3% |
| Tridium Niagara | 39,371 | 43,167 | +9.2% |
Source: Censys, 2025. The author is explicit that these figures count exposure, not vulnerable devices, and notes that internet services are ephemeral, so counts fluctuate. Two endpoints also hide the path between them; the biweekly series is what shows whether a change is a trend or noise.
Historical trend tools
Shodan’s official documentation says Shodan Trends can query historical data back to 2017, runs monthly aggregations, and uses tag:ics as an example query. It also documents country breakdowns and data export. That is a description of what the platform lets you do. It does not validate that the tag captures all industrial systems or that results amount to a census. Censys likewise documents a Critical Infrastructure module offering ICS/OT-specific protocol data, scan data, screenshots and an interactive dashboard for triage and remediation; its protocol list was stated as current on September 15, 2026 and is subject to change. A platform’s available fields tell you what you can query, not how accurate the answers are.
Any trend you draw should name the platform, the query or fingerprint family, the time window, the geography and the unit. Changing any of these can move the line more than real-world exposure does.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why counts get revised
Classification is the weakest link. Censys’s 2026 preview says it later excluded hosts it judged likely not to be genuine ICS devices. Honeypots, emulators and misidentified services can all inflate a total, and a vendor tightening its rules will shift historical comparisons. Treat any figure as “what this method reported on this date”, and check whether the publisher has corrected its methodology since.
Who owns an exposed device?
An IP address identifies a network, not necessarily the organisation responsible for the equipment. Censys’s 2024 report notes that mobile and consumer or business ISP networks make ownership and intended-purpose attribution difficult because useful metadata may be absent. A later Censys piece on the exposure notification gap in ICS devices (September 8, 2026) addresses the same problem for cellular-connected equipment and the difficulty of notifying owners. In practice an address may resolve to a carrier or ISP rather than the water utility, fuel station or building operator behind it. Naming an owner from an IP observation alone, without corroboration, is a mistake.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Exposure, vulnerability and attack are different claims
- Exposed does not mean vulnerable. Reachability says nothing about firmware version, authentication or patch state.
- Inbound traffic does not mean attempted manipulation. In the nine-day honeypot capture (November 23 to December 1, 2025), Censys recorded 764 ICS/OT events from 188 unique source IPs, across S7comm, Modbus, IPMI and BACnet. It cautions that noisy connections do not indicate intent to manipulate or control an industrial process. These are one honeypot’s observations.
- Exposed does not mean a live control panel. Some responders are decoys or misclassified hosts.
Reading an exposure headline: a checklist
- Who produced the number, and which scanner or dataset?
- What is counted: IPs, hosts, services, devices or interfaces?
- What date or interval does it cover, and is it a single snapshot or a series?
- Which protocols and fingerprints are included, and have false positives been excluded?
- Is any geographic split by service, host or something else?
- Does the article claim ownership, vulnerability or compromise that the data cannot support?
What asset owners can do with this data
These are editorial recommendations rather than a complete configuration standard, which the material reviewed here did not provide. Censys’s honeypot write-up says reducing internet exposure remains the most effective mitigation, and its platform documentation positions exposure data as a triage and remediation aid.
- Check scan findings against your own asset inventory; a hit that does not match a known asset is itself a finding.
- Remove unnecessary direct public reachability for PLCs, HMIs and gateways, and make any remote access explicitly managed.
- Include cellular modems in the inventory. A July 2026 Censys article summarising a CISA water-sector advisory says CISA urged owners, operators and integrators to take publicly exposed PLCs and OT off the internet as soon as possible, and flags cellular modems as a possible blind spot. That is Censys’s account; read the original CISA advisory before quoting it or repeating incident details.
If you are a researcher, use existing datasets or scan only systems you own or are authorised to assess. Probing or interacting with other people’s industrial equipment is not a safe or acceptable way to “verify” a count.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
