Industrial edge vendors under measurement: 2,805,294 Zyxel, 1,884,815 Draytek and 14,144 Moxa matches

Routers, switches and industrial gateways are the part of the estate that nobody lists in a configuration management database, and they are also the part that keeps answering after everything else has been patched. A set of ZoomEye queries for five such vendors produces a wide range of totals worth reading carefully.

Context and method

All figures were collected on 26 September 2026 through the ZoomEye Python SDK with sub_type=all.

Query	Total
`app="Zyxel"`	2,805,294
`app="Draytek"`	1,884,815
`app="Moxa"`	14,144
`app="Rockwell"`	847
`app="Beckhoff"`	20
`port=8291`	8,926,087

port=8291 is included because it is a widely documented management port on MikroTik devices and appears in the same population these vendors serve. It is a port measurement, not a vendor measurement, and the difference between those two kinds of query is the main subject of this piece.

Analysis

The range from 2,805,294 to 20 is not a range of deployment sizes. It is a range of how well each vendor's products identify themselves. Zyxel and Draytek, both consumer and small business networking brands, present distinctive web interfaces that scanners match reliably, which is why the figures run into the millions. Moxa sells industrial networking equipment, most of it on private networks, which explains a smaller number. Rockwell and Beckhoff sell control systems, and those devices commonly speak industrial protocols rather than HTTP, which is why 847 and 20 appear at the bottom.

The practical implication of the bottom of that list is more significant than the top. An industrial controller that does not present an HTTP interface will not be found by a web-oriented fingerprint, and that is not a limitation the operator can fix by choosing a better query. It is a statement that the visible internet and the reachable internet are different populations, and industrial networks are disproportionately in the second category.

The scale at the top has its own meaning. Zyxel and Draytek devices are the routers and gateway products that small organizations deploy, and the same population appears repeatedly in the vulnerability cycle in this product class, including at the consumer grade where a firmware fix depends on the owner noticing a notification.

Implications

For asset owners, the useful reading of these numbers is about concentration. An organization with a large branch network built on a single low-cost vendor brand has one firmware process to manage and a large number of devices that all fail together when a flaw is found. That is the argument for a documented refresh cycle in this class, and for a rule that any device serving as a perimeter must be reachable for updates.

For security programs building exposure measurement from scratch, the industrial figures are a reminder to check protocol coverage. Queries that cover only HTTP identify a fraction of operational technology, and the rest has to be found by scanning the ports those devices actually use. A measurement program that reports on web services and calls itself complete has a known blind spot in exactly the environment where downtime matters most.