Automated Reconnaissance Surge Hits 36,000 Scans/Second

Attackers are conducting an estimated 36,000 automated cyber reconnaissance scans per second, up 16.7 % year-over-year, according to a recent Fortinet report. The figure represents the number of hostile probes that scour networks for open ports and exploitable services, indicating a sharp uptick in threat actors’ early-stage activity. ¹

The surge is largely driven by attackers leveraging commercial scanners such as Nessus or OpenVAS, which have become more accessible through cloud computing resources. These tools automate the mapping of network topologies and expose known vulnerabilities, allowing adversaries to identify high-value targets before launching exploitation attempts.

Back in 2018 a similar spike was observed when Shodan made it easy for anyone to scan millions of devices worldwide; however, this latest wave shows even greater automation and larger target pools due to the rapid expansion of Internet‑of‑Things (IoT) endpoints. With billions of connected sensors, cameras, and industrial controllers now online, the attack surface has grown dramatically, providing new opportunities for mass scanning campaigns.

Experts note that while automated scanners themselves are not new, their increased deployment reflects both improved computational power available via cloud platforms and a shift toward “attack-as-a-service” models where threat actors outsource discovery tasks to third-party tools. This trend means that vulnerability discovery can occur at unprecedented speed, often preceding any visible exploitation attempt.

For defenders, systematic mapping of internal networks—through regular penetration testing, continuous monitoring, and zero‑trust architectures—is essential to stay ahead of reconnaissance efforts. Patch management remains critical: persistent gaps continue to enable ransomware and data breaches across modern enterprises, especially those with complex supply‑chain interdependencies.