EchelonGraph · Threat Intelligence
The State of Internet Exposure 2026
Inaugural Edition · What the whole internet can already see
An evidence-based field report drawn from public data and identified checks of our own — not a survey, not a forecast. We measured the externally-visible attack surface from the same vantage point an adversary uses, across 137 countries, over a baseline window of up to five weeks — three weeks or less for five of the six radars (see the report’s 2026-09-29 window correction).
By the numbers — observed within 29 May – 28 June 2026
2,050
AI services confirmed active & open
of 82,416 discovered
Includes 2 MCP servers whose count was withdrawn on 2026-09-29 →21,299
hosts on CISA-KEV exploited vulns
of 36,416 CVE-exposed
6,607
open, unauthenticated databases
120 countries
2,571
exposed .env files
≈2,600 AWS keys
619
secrets in public Git repos
478 repositories
134
hijackable subdomains
dangling CNAME
340,552
CVEs tracked & enriched
1,621 CISA-KEV
137
countries observed
public data, then identified checks
What's inside — 15 chapters, 140 pages
- Executive Summary
- Methodology & How We Found This
- The AI Attack Surface
- Known-Exploited Vulnerability Exposure
- Exposed Data Stores
- Secret Sprawl
- Subdomain Takeover
- The Vulnerability Landscape
- Trends & Trajectory
- Risk Analysis
- Mitigation & Remediation
- Gaps & What We're Not Seeing
- The CISO Playbook
- Past Mistakes & Lessons
- The Path Forward
How we found this. Every figure starts from public data — Certificate Transparency logs, public internet scan data, public source repositories, and public DNS. Where we judged a public banner not proof on its own, we checked it with identified requests of our own; where we judged it sufficient, we counted it without contacting the host. Those requests carry our identity; none logs in, submits a credential or exploits anything. The exposed-configuration check reads each exposed file up to a size cap, which is how a leaked secret is detected, and redacts it before storage. Of the 6,607 open data stores, 480 were confirmed by a check of our own; the other 6,127 — Redis, Memcached, Cassandra, MongoDB and InfluxDB — were counted from public internet-scan records, and we did not contact them. The report’s 2026-09-27 method correction and its 2026-09-29 data-store and takeover-check corrections say what each check sent. The report’s 2026-09-29 table, what each radar sent, is the authority on how we found, checked, contacted, read or identified anything: where a chapter of the report says more or less, the table is right, and the report’s dated notes add detail to it. Findings are aggregated and host-redacted under a responsible-disclosure posture. Several of these figures — the AI-service, CISA-KEV-host and open-database counts and the country count — are derived wholly or partly from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. This is an observational field report, not a penetration test, and the absence of a finding is not evidence of safety. Want to see your own exposure? Run the free Surface Scanner →