⚡ Quick Summary
- IoT devices now outnumber traditional endpoints 3-to-5 on corporate networks, creating massive security blind spots
- Traditional endpoint security tools cannot protect devices that lack the ability to run security agents
- Network segmentation and device visibility are the highest-impact controls for IoT security
- Regulatory frameworks and cyber insurance are beginning to require demonstrable IoT security controls
What Happened
The cybersecurity industry is undergoing a fundamental shift in how it defines and protects endpoints, driven by the rapid proliferation of Internet of Things devices across corporate networks. March 2026 has seen a convergence of warnings from security vendors, government agencies, and industry analysts highlighting that traditional endpoint security strategies — designed for laptops, desktops, and servers — are inadequate for networks where printers, cameras, HVAC systems, smart displays, and dozens of other connected devices each represent potential attack surfaces.
This week's warnings from HP about printer security blind spots and Apple's emergency patches for older devices against the Coruna exploit kit are symptoms of a broader pattern: the devices organisations spend the least time thinking about are increasingly the ones attackers are targeting first. The traditional security perimeter has not just expanded — it has fragmented into thousands of individually managed devices, each with its own firmware, update cycle, and vulnerability profile.
Industry analysts estimate that the average mid-sized business now has three to five IoT devices for every traditional computing endpoint on its network. Many of these devices were deployed without security review, operate on the same network segments as critical business systems, and receive firmware updates irregularly if at all.
Background and Context
The endpoint security market was built around a relatively simple model: protect the devices that humans use directly. Antivirus software, endpoint detection and response (EDR), and mobile device management (MDM) solutions all assume a device with a screen, a user, and an operating system that supports security agent installation. IoT devices break every one of these assumptions.
A networked printer, a smart thermostat, or a conference room display typically runs a stripped-down embedded operating system that cannot host traditional security agents. These devices authenticate to the network using credentials that are rarely rotated, communicate using protocols that may not support encryption, and are managed through web interfaces that often contain their own vulnerabilities. The result is a class of network-connected devices that sits outside the protective umbrella of the security tools organisations have already deployed.
The problem has been known for years, but three factors have converged in 2026 to force action. First, the volume of IoT devices in corporate environments has reached a tipping point where they can no longer be dismissed as edge cases. Second, attackers have demonstrated repeatedly that IoT devices provide reliable, low-resistance pathways into otherwise well-defended networks. Third, regulatory frameworks — including updated NIST guidelines and emerging EU cybersecurity requirements — are beginning to hold organisations accountable for the security of all networked devices, not just traditional endpoints.
Why This Matters
The rethinking of endpoint security matters because it represents a fundamental shift in how organisations must approach network defence. The castle-and-moat model — where a strong perimeter protects everything inside — has been eroding for years as cloud adoption and remote work punched holes in network boundaries. IoT devices deliver the final blow by placing potentially vulnerable devices deep inside the network, behind the perimeter defences, with direct access to internal resources.
The zero-trust security model, which has gained significant traction in enterprise security strategy, is theoretically well-suited to address IoT challenges. By treating every device as untrusted and requiring continuous verification, zero-trust architectures can contain the damage from a compromised IoT device. However, implementing zero-trust for devices that cannot run authentication agents or support modern identity protocols requires network-level controls — microsegmentation, network access control, and behavioural analytics — that many organisations have not yet deployed at the granularity IoT security demands.
For businesses managing their operations with enterprise productivity software, the IoT security challenge intersects with productivity infrastructure in concrete ways. Networked printers that handle sensitive documents, smart displays that connect to collaboration platforms, and conference room systems that integrate with Microsoft Teams and Zoom all represent devices where security vulnerabilities could compromise business communications and data.
Industry Impact
The network security vendor landscape is responding with products specifically designed for IoT visibility and protection. Companies like Armis, Claroty, and Nozomi Networks have built platforms that discover, classify, and monitor IoT devices on enterprise networks, providing the visibility that is a prerequisite for any security strategy. Traditional security vendors including Palo Alto Networks, Fortinet, and Cisco are integrating IoT-specific capabilities into their existing platforms.
The managed security services market is also evolving. Managed detection and response (MDR) providers are expanding their monitoring scope to include IoT device telemetry, offering SMBs that lack in-house expertise a path to IoT security without building dedicated capabilities. This is particularly relevant for small businesses that may be running their entire operation on a few workstations with a genuine Windows 11 key alongside a dozen or more IoT devices that receive no security monitoring.
The insurance industry is taking notice as well. Cyber insurance underwriters are beginning to include IoT security assessments in their risk evaluations, and policies may soon require demonstrable IoT security controls as a condition of coverage. Organisations that cannot demonstrate visibility into and control over their IoT device estate may face higher premiums or coverage exclusions.
Expert Perspective
The most effective IoT security strategies in 2026 share a common characteristic: they start with visibility rather than control. Organisations cannot secure devices they do not know exist, and network discovery scans consistently reveal 30 to 50 percent more connected devices than IT teams expect. The first step for any organisation is a comprehensive device inventory that includes every networked device, not just those managed through traditional IT asset management systems.
Network segmentation remains the highest-impact single control for IoT security. Placing IoT devices on isolated network segments that limit their ability to communicate with critical business systems — and limiting their outbound internet access to only the services they require — contains the blast radius of any individual device compromise. This approach does not prevent devices from being compromised, but it significantly reduces the attacker's ability to use a compromised IoT device as a pivot point into the broader network.
What This Means for Businesses
Every organisation should conduct an IoT device inventory as a priority action. Map every connected device on the network, identify its function, determine its firmware version, and assess whether it is receiving regular security updates. Devices that are end-of-life and no longer receiving updates should be replaced or isolated on dedicated network segments with strict access controls.
Businesses using affordable Microsoft Office licence deployments should ensure that the devices handling their document workflows — printers, scanners, and multifunction devices — are included in their security management programmes with the same diligence applied to user workstations.
Key Takeaways
- IoT devices now outnumber traditional computing endpoints on most corporate networks by 3-to-5 ratio
- Traditional endpoint security tools cannot protect devices that lack the ability to run security agents
- Network segmentation is the highest-impact single control for containing IoT security risks
- Device visibility — knowing what is on the network — is the essential first step
- Regulatory frameworks and cyber insurance are increasingly requiring demonstrable IoT security controls
- SMBs face the greatest risk due to limited security resources relative to their IoT device footprint
Looking Ahead
The endpoint security market will continue evolving toward a model that treats all networked devices — regardless of form factor, operating system, or function — as endpoints requiring protection. The companies that succeed in this expanded market will be those that can provide unified visibility and control across traditional and IoT endpoints, reducing the complexity that currently forces organisations to manage multiple, disconnected security tools for different device categories.
Frequently Asked Questions
Why are IoT devices a security risk for businesses?
IoT devices like printers, cameras, and smart displays run embedded operating systems that cannot host traditional security agents, often have default credentials and outdated firmware, and sit on the same networks as critical business systems.
What is the most important step for IoT security?
Start with device visibility — conduct a comprehensive inventory of every connected device on your network. You cannot secure devices you do not know exist, and discovery scans consistently find 30-50% more devices than IT teams expect.
How does network segmentation help with IoT security?
Placing IoT devices on isolated network segments limits their ability to communicate with critical business systems, containing the damage if any single device is compromised and preventing attackers from using it as a pivot point.