New global analysis finds open feeds into power infrastructure, server rooms and conflict zones
THE HAGUE, The Netherlands, June 09, 2026 (GLOBE NEWSWIRE) -- Modat, the European internet intelligence company, today published research mapping internet-exposed RTSP (Real Time Streaming Protocol) video services, the protocol behind surveillance systems, network video recorders and industrial monitoring worldwide.
Using its Modat Magnify platform, researchers identified 973,819 active RTSP services across 210 countries in March 2026. Each was verified for live responsiveness and tested for unauthenticated access. 8,074 returned a live frame with no credentials required, opening a direct window into the site behind the camera. Authentication is part of the RTSP specification, but ships disabled on most devices.
The findings cut against a camera-focused view. The exposure is not confined to the default port: 43.9% of the surface sits on other ports, so detection built around port 554 misses nearly half the footprint. It is not only cameras: more than a third of fingerprinted services are not camera devices, including media frameworks such as GStreamer that camera-vendor fingerprinting does not catch. And the open feeds are often not benign. Modat documented a thermal array monitoring high-voltage equipment, the interior of a server facility, a SCADA water-treatment dashboard, and a single device exposing 358 live feeds. One in five viewable streams sat in a conflict-affected country.
Across the wider set of 3.36 million RTSP endpoints in Modat Magnify, 797,153 hosts presented an open stream alongside a known vendor login page, and thousands more carried industrial control system or SCADA fingerprints on the same host.
"An unauthenticated video stream is operational intelligence, not a privacy nuisance," said Soufian El Yadmani, CEO of Modat. "Layout, staffing patterns and blind spots are visible before any exploitation takes place, and treating this as a camera problem misses the point. In March 2026, CNN reported that Israel had hacked Tehran's traffic cameras years before its strikes on Iran to build targeting intelligence. The feeds were simply open. Most of what we found can be secured in minutes by requiring authentication and routing access through a VPN."
The full research, including methodology and case studies, is available at https://www.modat.io/post/exposed-rtsp
About Modat
Modat is the European internet intelligence company. Modat builds AI-driven intelligence on global internet infrastructure, revealing who is behind it, what they are preparing and when they will act. Its flagship platform, Modat Magnify, continuously scans the entire internet, profiles every connected device using deep fingerprinting and delivers contextual intelligence across more than 50 categories. Learn more at modat.io.
Media contact
Ronald Fabbro
ronald.fabbro@modat.io
A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/b2d45f74-3880-4f05-bc2d-c797d4837462
