AI is becoming embedded in how businesses operate. But does your security strategy reflect the internet your business actually depends on? As organizations adopt new tools and connections, and attackers adapt their operations, leaders need to understand what they’re adding, what they’re overlooking, and how attackers could take advantage.
Read more Elon Musk says he’s had AI ‘psychosis’ half a dozen times in the last year
Censys’ 2026 State of the Internet Report offers evidence to help leaders answer those questions. Censys continuously maps the global internet, observing the infrastructure and services accessible online and tracking how they change. The report draws on years of data observation to reveal how AI adoption is expanding what businesses need to secure and why modern defense requires current Internet context. The bright side: Businesses are making measurable improvements in security fundamentals to build a strong foundation for secure AI adoption.
As AI adoption expands, so does your list of things to secure
AI adoption reaches deeper into business operations than its most visible applications suggest. Beyond widely known chat agents like ChatGPT and Claude, less visible tools sit at the orchestration layer to connect AI to business systems, data, and credentials.
Censys found that the number of hosts exposing AI-related tools grew more than 63% in a tracked nine-month period. The most widely exposed was n8n, a workflow automation and AI orchestration platform, with 113,926 exposed hosts. Among those whose software version could be identified, 76% fell within the affected range of at least one recent critical vulnerability.
Internet exposure alone does not establish that a system is insecure. But these tools’ access to credentials and connected services can magnify the consequences of a compromise, allowing it to reach beyond the AI platform into other business systems. To support safe AI adoption, leaders should ensure their security teams can monitor in real time which AI tools and supporting systems are accessible from the internet.
Effective defense starts with evidence, not assumptions
Businesses need an accurate picture of their infrastructure. That includes the external systems their AI tools, employees, and applications connect to. Knowing what’s running and understanding those connections helps security teams identify risk and investigate suspicious activity. Assumptions about where services should appear or what looks benign can leave important parts of that environment overlooked.
The report shows how easily expectations diverge from reality: 68% of HTTP(S) services run outside their default ports. For SOCKS proxies, which relay network traffic, checking only the default port would reveal just 4% of the observed population. These configurations are not inherently malicious, but they demonstrate why conventional checks can produce an incomplete picture.
Leaders should ensure their teams have a real-time view of the internet infrastructure their business operates and connects to, including what is running and how it changes. That understanding supports both risk management and operational defense by allowing security teams to identify overlooked systems and obtain the context to distinguish legitimate activity from threats.
Modern attacks demand a more current internet view
Businesses are adopting AI — and so are attackers. As adversaries move faster, security teams need current visibility into the infrastructure supporting attacker operations, including threats hosted alongside legitimate business services.
Threat actors choose providers for practical reasons, including cost, functionality, and permissiveness. Censys found that the United States hosts 45.5% of the web-based threats observed in the report. A familiar location or provider does not establish that infrastructure is benign: Fraudulent toll-payment pages appeared on providers including Amazon and Linode, while Fake CAPTCHA attacks often used hijacked small-business websites. Censys also observed small changes to deceptive domain names that can evade overly specific detection rules.
To keep pace, leaders should ensure their security teams have current context from internal systems and across the Internet to recognize threats within familiar surroundings, investigate related activity, and respond effectively.
Realizing AI’s potential starts with security fundamentals
There is encouraging news for leaders working to strengthen security: Censys found signs of improving cyber hygiene through software maintenance, which offers a strong foundation to build on as businesses adopt AI.
Across four enterprise software products studied over roughly 2.5 years, newer versions gained ground in all four. SharePoint Server stood out: In a typical month, about 26% of repeatedly observed hosts moved to a newer build. Jenkins also showed steady upgrades, with 5-9% of returning hosts upgrading each month, largely independent of major vulnerability announcements. These patterns show how regular maintenance can move software populations forward without waiting for a security crisis.
Secure AI adoption depends on extending proven practices to new infrastructure. Leaders should build on this progress by making security hygiene part of AI adoption from the outset, helping protect their investment and giving the business a stronger foundation to innovate securely.
Explore the Censys 2026 State of the Internet Report and see what the findings mean for your security priorities.
This sponsored post was supplied by Censys.
About the Author
