It's official, homelabbers are the most likely to be targeted by hackers - How-To Geek

A new security report from Bitdefender and Netgear has identified network-attached storage (NAS) devices as the most vulnerable type of connected home equipment. The 2026 IoT Security Landscape Report analyzed roughly 10.4 million protected home networks between January and September 2026 and discovered a massive 5.4 billion security events.

The study found that NAS devices accounted for 22% of all recorded vulnerability observations across connected home devices. That figure represents approximately 261.6 million observations involving NAS devices alone. Only smart TVs (22.7%) and smart plugs (22.4%) performed worse in the report.

Automated bots scan public IP addresses constantly

Hackers do not need to know who you are or that you have a homelab to target your devices. Automated bots constantly scan public IP addresses looking for open ports or vulnerable services. The Bitdefender report recorded approximately 4.85 billion port-scanning events, which accounted for 90% of the detected attack-category activity.

The researchers also observed around 466 million brute-force attempts. These automated scans are a grim reminder that even a standard home network is not immune to cybersecurity threats. A scan does not mean someone has gained access, but the constant monitoring of public IP addresses makes homelabbers a frequent target.

Every self-hosted service is a potential entry point

One of the benefits of homelabbing is the ability to self-host services like Plex, Jellyfin, Nextcloud, and Home Assistant. However, every service added is another potential entry point for attackers, especially if it is accessible from outside the home network. Port forwarding is often the culprit, but features like UPnP can also open ports automatically without the user realizing it.

Keeping track of which services are exposed, properly secured, and fully updated can become a nightmare for users with a dozen or more services running. The report suggests that keeping the home server off the public internet whenever possible is the best way to reduce risk.

Old hardware often lacks critical security patches

A common practice among homelabbers is to give old hardware a second life. An aging PC can become a home server, and an old router can find a new purpose. Unfortunately, this same love for repurposing hardware can come back to bite users. Older devices may no longer receive firmware updates or security patches, leaving known vulnerabilities wide open for attackers.

The Bitdefender report found that 99.97% of vulnerability observations involved publicly documented CVEs. This means these were not mysterious, one-off situations but vulnerabilities the world already knew about. Outdated operating systems, Docker containers, and hypervisors can all introduce vulnerabilities that need to be addressed through vigilant maintenance.

Users can stay safe with proper maintenance

The report does not suggest that users need to abandon their homelabs. However, it is a reminder to take the security of the network seriously. Users should keep up with updates, remove unnecessary port forwarding, use strong passwords, and consider separating vulnerable devices onto their own VLAN. A little maintenance goes a long way toward keeping the network safe.