AdminKit Radar: exposure trends for machine protocols
Radar will track how many MCP servers, MQTT brokers and Modbus devices are reachable from the internet without authentication, using AdminKit's own honeypots and aggregated telemetry. It has not published its first report yet — this page describes what it will measure and how, honestly, before any numbers exist.
What Radar will publish
Four protocol tracks to start, each reported as a trend over time rather than a single snapshot.
MCP exposure
How many public MCP servers accept calls without authentication, and which transport (HTTP streamable, SSE) and auth pattern they use.
MQTT exposure
How many internet-reachable MQTT brokers accept anonymous connections, and which topics are commonly left world-readable or world-writable.
Modbus TCP exposure
How many internet-reachable Modbus TCP endpoints respond to unauthenticated register reads — Modbus has no built-in authentication, so any reachable endpoint is reachable by anyone.
Honeypot observations
What AdminKit's own low-interaction honeypots (MQTT, Modbus, MCP, Telnet) see probing or connecting to them — source patterns, not identities.
Methodology
Radar's data comes from two sources: AdminKit's own low-interaction honeypots, and aggregated, anonymised telemetry from AdminKit's checks and protective layers. Both follow the same rules AdminKit holds itself to everywhere (see /security/):
-
Passive and lightweight active scanning only, the same rules as our public tools: no exploitation, no credential guessing, no attacking back.
-
Honeypots are low-interaction — they record connection attempts and payloads sent to them, and never relay traffic anywhere.
-
Aggregates are published only when at least 5 distinct sources (tenants, networks or honeypot sightings) contribute to a number — the same k ≥ 5 threshold AdminKit and Softwsp use everywhere data is aggregated.
-
Below that threshold, nothing is shown publicly, even internally approximate — no "almost enough data" previews.
-
Reports show trends and counts, never a specific organisation, device or individual IP address.
Why no numbers yet
Publishing a statistic responsibly takes real data from enough independent sources to clear the k ≥ 5 threshold above. AdminKit's honeypots and telemetry pipeline are still being built (see the products rolling out today) — Radar's first report will follow once there is enough data to report safely, not before. We would rather publish nothing than publish a number that could be traced back to one network.
Frequently asked questions
Is Radar live yet?
Not yet. This page describes what Radar will measure and how, but there are no published numbers today — that depends on AdminKit's honeypots and telemetry reaching enough independent sources to report safely.
What does "k ≥ 5" mean?
It means AdminKit will only publish an aggregate statistic once at least 5 distinct, independent sources make it up. This stops any single network, device or honeypot sighting from being identifiable in a published number.
Will Radar name specific vulnerable organisations or devices?
No. Radar publishes trends and aggregate counts by protocol, country or device category — never a specific IP address, domain or organisation. A verified asset owner can always see detail about their own assets through their AdminKit account.
How is this different from Shodan or Censys?
Shodan and Censys index what is reachable on the internet at a point in time. Radar adds AdminKit's own honeypot observations (who actually probes or connects, not just who could) and tracks exposure trends over time, aggregated above the k ≥ 5 threshold.
How do I get the first report?
There is no mailing list yet. Contact us and we will add you to the list for AdminKit's first Radar report when it publishes.
Get AdminKit's first Radar report
No mailing list yet — contact us and we will send the first report when it publishes.