> ## Content Index > Fetch the complete content index at: https://www.thecybersignal.com/llms.txt > Use this file to discover other available public pages before exploring further. # The FTP Ghost in the Machine: 6 Million Servers Still Expose Unencrypted Legacy Portals - URL: https://www.thecybersignal.com/the-ftp-ghost-in-the-machine-6-million-servers-still-expose-unencrypted-legacy-portals/ - Published: 2026-04-20T16:12:00.000Z - Updated: 2026-08-25T06:48:30.000Z - Author: Nicholas Robert - Tags: Enterprise Infrastructure, Vulnerability Management, Identity & Access Management (IAM), Operational Resilience, Trending *A new global scan by Censys reveals that nearly half of all internet-facing FTP servers lack basic encryption, leaving enterprise data pipelines vulnerable to credential sniffing and man-in-the-middle attacks.* **ANN ARBOR, MI** — In an era dominated by zero trust and encrypted tunnels, one of the internet’s oldest protocols remains a massive, unpatched liability. According to a state-of-the-internet report from **Censys**, approximately **6 million servers** continue to expose File Transfer Protocol (FTP) services to the public web. More alarming is the finding that nearly **50% of these servers** do not support any form of encryption, such as FTPS or SFTP. The findings underscore a persistent "Shadow Infrastructure" problem, where legacy systems — often forgotten by IT departments — continue to facilitate the movement of sensitive corporate and personal data in plain text, the exact blind spot [exposure management](https://www.thecybersignal.com/vulnerability-management-the-complete-guide/) is meant to surface. ### FTP Security Breakdown | Risk Metric | Censys Finding | | ---------------------- | ------------------------------------------------------------------------ | | Total Exposure | \~6 Million internet-facing FTP servers worldwide. | | Encryption Gap | Nearly 50% (approx. 3 million) lack any transport-layer encryption. | | Critical Vulnerability | Credentials sent in clear-text; susceptible to Man-in-the-Middle (MitM). | --- ## The Persistence of "Plain Text" Risk FTP, a protocol dating back to 1971, was never designed with modern security in mind. While secure variants like SFTP (SSH File Transfer Protocol) exist, the Censys scan reveals that millions of hosts are still configured for "Anonymous" access or clear-text authentication. **According to technical analysis from *SecurityWeek* and *CyberNews*, the exposure follows several dangerous patterns:** - **Credential Sniffing:** Because standard FTP sends passwords in the clear, any attacker positioned on the network path can intercept administrative credentials. - **Anonymous Access:** A significant portion of the 6 million servers allow "Anonymous" logins, frequently providing a gateway to internal document repositories or configuration files. - **The "Serial-to-IP" Link:** *SecurityWeek* notes that many of these exposed servers are actually **Serial-to-IP converters** used in healthcare and industrial OT (Operational Technology) environments to connect legacy hardware to the cloud. ## Geographic and Sector Concentration The exposure is not evenly distributed. Censys identified heavy concentrations of unencrypted FTP servers in regions with rapidly expanding digital footprints but lagging security oversight. Furthermore, the report highlights that many of these servers are hosted on consumer-grade ISP ranges, suggesting that small businesses and home-office setups are unwittingly acting as weak points in the broader enterprise supply chain. --- ## The CyberSignal Analysis ### Signal 01 — The "Shadow Infrastructure" Debt This incident is a definitive "Signal" for [enterprise infrastructure](https://www.thecybersignal.com/tag/enterprise-infrastructure/) management. The presence of 6 million FTP servers in 2026 isn't just a technical flaw; it’s a failure of [vulnerability management](https://www.thecybersignal.com/tag/vulnerability-management/). These servers are the "basement windows" of the corporate world — left unlocked because everyone assumes the "front door" (the firewall) is enough. For B2B leaders, the takeaway is clear: If you haven't audited your external-facing ports in the last 90 days, you likely own part of this 6-million-count problem. ### Signal 02 — The Death of "Security through Obscurity" The "Signal" here is the power of automated global scanning. Threat actors are using the same tools as Censys to map your network in seconds. As we discussed in our report on [**Common Cybersecurity Threats in 2026**](https://www.thecybersignal.com/most-common-cybersecurity-threats-for-organizations-in-2026/), attackers no longer need a complex exploit to breach a network; they just need a legacy protocol that was never turned off. In 2026, [identity & access management (IAM)](https://www.thecybersignal.com/what-is-identity-and-access-management-iam-2/) must include the "Identity" of the protocols themselves — if a service doesn't support encryption, it shouldn't have an identity on your network. --- ## Sources | Type | Source | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Research Lead | [Censys: FTP Exposure Brief](https://censys.com/blog/ftp-exposure-brief/?ref=thecybersignal.com) | | Security Intel | [SecurityWeek: Analysis of FTP Encryption Gaps](https://www.securityweek.com/half-of-the-6-million-internet-facing-ftp-servers-lack-encryption/?ref=thecybersignal.com) | | Global News | [CyberNews: Six Million Servers Exposed Online](https://cybernews.com/security/six-million-ftp-servers-exposed-online/?ref=thecybersignal.com) | | Technical Report | [GBHackers: 6 Million Public-Facing FTP Servers](https://gbhackers.com/censys-warns-6-million-public-facing-ftp-server-exposed/?ref=thecybersignal.com) | | Regional Tech | [The 420: Migration and Security Risk](https://the420.in/censys-ftp-exposed-servers-sftp-migration-security-risk/?ref=thecybersignal.com) |