Topic starter
25/10/2026 11:10 am
TL;DR: Exposure is being missed in AI infrastructure, ICS assets on mobile networks and services on non-standard ports, Censys reports in its 2026 State of the Internet Report. Discovery and ownership need to catch up with how services actually run, or these assets stay outside normal monitoring and remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Censys: “5 Key Takeaways From Censys’ State of the Internet Report”.
By the numbers:
- Between October 2025 and July 2026, the number of hosts exposing AI-related tools grew more than 63%.
Key questions
Q: Why do exposed AI infrastructure components create more risk than the visible application layer?
A: Because the support stack often holds the credentials, connectors and execution paths that let an attacker move beyond the interface.
Q: What breaks when teams assume services only run on default ports?
A: They miss a meaningful share of exposed systems, especially web services, proxies and remote access tools configured on non-standard ports.
Q: How should security teams manage unknown internet-facing assets?
A: Security teams should treat unknown internet-facing assets as governance exceptions, not just missing inventory.
Practitioner guidance
- Expand discovery beyond standard network assumptions Include mobile networks, non-standard ports and external service exposure in routine asset discovery so the programme does not miss systems that live outside corporate address space.
- Inventory AI support systems as governed assets Track workflow orchestration, service connectors and credential stores alongside the AI application itself, because those supporting components often hold the real blast radius.
- Validate exposure on all ports, not just defaults Use scan and detection logic that identifies services by behavior and banner data rather than assuming SSH, HTTP and proxy services will appear only on standard ports.
Bottom line: The report’s central warning is that exposure is being missed in infrastructure layers many programmes still do not inspect closely enough.
Glossary terms: Attack Surface Discovery, Non-Standard Port, Workload Identity, Shadow Infrastructure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:14 pm
Visibility gaps are now a core governance failure, not an inventory nuisance. The report shows that organisations keep underestimating exposures because their tooling starts from assumptions about where assets should live and how they should look. That is a dangerous model when internet-facing infrastructure can shift quickly, hide on unexpected networks, or expose services outside the normal monitoring path. The practical conclusion is that discovery quality has become a first-class control.
A question worth separating out:
Q: How should organisations prioritise forgotten or unchanged systems in exposure management?
A: Treat them as likely ownership and lifecycle failures, not just patching backlog. If a system has stayed exposed for a long time with little version change, it may be abandoned, unmonitored or outside normal remediation workflows. Those conditions deserve priority because they often indicate a wider governance gap rather than a single missing fix.
👉 Read our full editorial: Blind spots in AI, ICS and non-standard ports expose internet risk
This post was modified 7 days ago by NHI Mgmt Group