Censys 2026 State of the Internet Report Finds Exposed AI Infrastructure Grew 63% in Nine Months

Censys reported that internet-facing AI infrastructure grew 63% in nine months to nearly 268,000 systems, while roughly 134,000 internet-exposed hosts were running industrial control systems; about 70% of the ICS hosts were found on consumer and mobile networks. Its 2026 report also found that China hosted 36.6% of observed malicious host-level infrastructure and the U.S. hosted 45.5% of observed web-based threats. The findings highlight expanding internet exposure and uneven software patching, rather than a company earnings or market-moving event.

Analysis

Exposure counts are not evidence of compromise or a measure of loss, and the report is vendor-sponsored. The investable signal is a widening asset-inventory and remediation burden: AI workflow agents can connect to data and accounts, so unmanaged credentials and permissions may matter more than the number of exposed endpoints. ICS exposure on consumer/mobile networks also points to an ownership and attribution problem, which can slow remediation and favor managed discovery and telecom-level controls over one-off security tooling.

For MSFT and PRGS, the report’s mention of SharePoint Server and Telerik Report Server is a scoped watch item—not evidence of a new flaw, broad customer impact, or material consolidated earnings risk. Persistent old versions could increase support, patching, and customer-trust pressure if tied to specific vulnerabilities; quantify only after product-level exposure, affected-version, and customer data are available. PRGS may have greater product-level sensitivity, but its revenue exposure is not established here.

Near term, the announcement alone is too weak for a directional trade. Over 1–3 months, look for independent vulnerability disclosures, patch urgency, and evidence of increased security budgets or bookings. Over 6–18 months, more formal controls around AI integrations and connected industrial systems could support exposure-management demand, but fragmented ownership may constrain conversion. Contrarian point: rapid growth in visible AI infrastructure may exaggerate risk if systems are authenticated, monitored, or honeypots; exposed-host totals do not establish exploitable risk. Falsify the demand thesis if independent scans show falling exploitable exposure and security vendors do not cite pipeline or bookings improvement.

Key Decisions for Investors

• No immediate trade from this press release. Treat cybersecurity exposure-management vendors as a watchlist theme, not a near-term earnings catalyst, until independent data or company commentary confirms budget conversion.
• Keep MSFT and PRGS on a product-specific alert: verify affected software versions, internet reachability, vulnerability/advisory status, and remediation rates before changing estimates or positioning. Do not infer company-wide exposure from the report’s product mentions.
• Reassess in 1–3 months if new advisories, exploit activity, or procurement evidence emerges; a credible rise in paid exposure-management demand would strengthen the sector thesis, while falling exploitable exposure or unchanged bookings would weaken it.