Beat W. Meier

We measure how many services are publicly reachable while exposing versions with documented vulnerabilities. Individual services are counted, not devices — a server with several open ports therefore appears more than once. The data comes from public scan databases; nothing is scanned by us and no third-party system is accessed. Since September 2026 a service counts towards a sector only when it can be attributed to an operator we have researched by name: that operator's registered network number is intersected with the technical fingerprint. A mere match in a name is no longer enough. How many of the listed operators could be attributed this way is stated beneath each chart. Only totals are published — individual facilities, addresses or organisations are never stored or shown. A large attack surface does not mean a system is exploitable, let alone compromised.