Information security industry players point out that physical world data published on the Internet, such as aircraft flight dynamics, ship beacons, radio signals, weather stations, and even surveillance camera footage, may be collected and cross-referenced on a large scale, becoming new information security risks.
With the rapid development of AI technology, physical world data published on the Internet, such as aircraft flight dynamics, ship beacons, radio signals, weather stations, and even surveillance camera footage, may be collected on a large scale, cross-referenced, and then analyzed through AI fusion to further restore the sensitive actions of enterprises, organizations, and even countries.
The latest research report from TrendAI, the enterprise AI security brand of Trend Micro, points out that Chinese manufacturers are using open source intelligence to collect and utilize publicly available business data on a large scale, highlighting that "open cyber-physical telemetry" is creating new security risks.
For example, in February 2026, Chinese manufacturers Jing'an Technology and MizarVision used completely legally obtained public data, including open flight tracking data, ship beacons and radio signals, to publicly reconstruct the situation before the US strike against Iran "Operation Epic Fury".
TrendAI researchers then investigated how this large-scale data fusion technology works and discovered a network of suspected China-related relay boxes (ORBs, a hidden proxy server infrastructure used by hackers to hide their whereabouts and launch cyber attacks).
The research pointed out that these networks are suspected of continuously and automatically connecting software-defined radios (SDRs), weather stations, AIS ship tracking systems, cameras and other equipment exposed on the public network. The research report believes that "open network entity telemetry" is a security risk category that currently lacks clear institutional ownership or responsibility.
Tom Kellermann, vice president of threat research at TrendAI, said that what is disturbing is that it is now possible to collect valuable intelligence about organizations or even countries without breaking through network defenses. Aircraft flight dynamics, shipping, radio signals, cameras and other seemingly harmless public information can be collected on a large scale and then analyzed through AI fusion to paint a very detailed picture of real-world activities.
Tom Kellermann believes that the security industry must start to treat the information that organizations expose and generate in the public environment with the same attention as protecting the assets inside the firewall. In response to such emerging risks, the report puts forward four recommendations:
First, organizations should treat telemetry data as "external signals" rather than simply records. If the data read by the sensor is disclosed or released without verification, it may cause security risks. The more detailed and detailed the telemetry data is, the higher the exposure risk may be. Therefore, in addition to the existing IT asset inventory, organizations should also establish an "open-telemetry exposure register".
Second, the audit scope should not be limited to the organization's own main assets, but should also include the "external signals" generated by related assets. Regulatory disclosures including suppliers, contractors, entourage, power procurement, and the frequency with which commercial satellite or imaging services provide imagery for a specific site can all be sources of exposure, even if these assets are not directly owned or managed by the organization.
Third, organizations should monitor whether their operations or the telemetry endpoints they rely on are subject to large-scale ORB-style crawling. If an organization publicly provides open signal data, it should continue to observe the data access situation from residential IPs to confirm whether large-scale data crawling activities occur, and establish corresponding behavioral signatures to identify such activities.
Fourth, the report recommends that OSINT-fusion (OSINT-fusion open source intelligence fusion) service providers be regarded as a category of cyber threat intelligence (CTI). For enterprises and public sectors that may be exposed to such telemetry monitoring risks, they should establish a watchlist (watchlist) of business intelligence fusion service providers operating in jurisdictions with close relations with counterparties, monitor their publicly released information, and incorporate their self-disclosed activities into the organization's strategic risk management mechanism.
