A grocery store receipt printer that starts preaching unionization sounds like a punchline until you realize the same firmware gap that lets it get hijacked lets attackers walk through the network behind it. The corporate IoT attack surface is now the single biggest blind spot in enterprise security — and most organizations have not built a defense for it. The pattern is simple: thousands of unmanaged devices, years-out-of-date firmware, and a new entry point opening every time someone plugs in a smart thermostat.
Kaspersky reported IoT attacks roughly doubled in the first half of 2021 versus the previous six months. The number of connected devices is projected to surpass 27 billion by 2025, with roughly two-thirds of businesses worldwide already using IoT products.
The threat model, in plain terms
A compromised IoT device is rarely the prize. It is the bridge. An attacker walks in through a printer, camera, or smart TV with weak or no endpoint protection, then pivots to the real corporate network. In one documented case, hackers targeted a government body's conference room Smart TV, recorded sensitive discussions for weeks before detection. From there, attackers pivot to data theft, hospital disruption, or control systems at power plants. Compromised devices also serve as nodes for botnets — collections of "zombie" devices used to flood target networks with traffic until they collapse.
Why patching is the actual problem
The instinct is to blame lazy IT teams for not changing default credentials, and sometimes that is the case. But the deeper issue is structural: smart devices ship with dozens of software vulnerabilities that end users cannot fix themselves. Patches depend on the vendor, and vendors are slow. A grocery store is not going to write firmware updates for a receipt printer it bought on price. The longer a device sits on a network, the longer it stays exposed to whatever new exploit lands next.
The legacy industries catching up
There is a sharp split in how companies approach IoT security. Tech-native firms like Apple and Google treat hackers as a known threat and patch accordingly. Older industrial or appliance makers expanding into smart products often do not. That gap is now structural — and widening.
Who should care
| Industry | Risk Profile | Primary Concerns |
|---|---|---|
| Healthcare | High | Patient data, medical device integrity, HIPAA exposure |
| Manufacturing | High | Production downtime, IP theft, industrial control systems |
| Finance | Medium-High | Transaction data, customer PII, regulatory penalties |
| Retail | Medium | POS systems, customer data, brand damage |
| Government | High | Sensitive discussions, classified data, national security |
Our analysis
The market rewards deployment speed, not patching speed. Vendors profit from shipping hardware; customers absorb the ongoing security costs. That asymmetry is the real problem. Until buyers treat firmware support the way they treat warranty length, attackers will keep finding the path of least resistance. A practical near-term test: ask every IoT vendor how many CVEs from the prior calendar year they patched within 90 days. Smaller vendors often cannot answer — and that answer tells you everything.
What to watch next
Operational technology is the next frontier of this problem. Building management systems, industrial controllers, and medical devices have deployment horizons measured in years, not months. If consumer IoT patching is bad, OT patching is a generation behind. Expect regulators to name specific device classes over the next 18 months.
Key takeaways
- IoT devices are typically the entry point, not the target.
- Patch speed, not default passwords, is the structural weakness.
- Segment IoT devices off the main network before adding anything else.
Frequently asked questions
Why are IoT devices such a frequent target?
They often ship without endpoint protection, default credentials active, and rarely receive timely firmware updates — making them easy entry points.
How big is the IoT attack surface?
The number of connected devices is projected to surpass 27 billion by 2025, with roughly two-thirds of businesses worldwide already using IoT products.
What is the biggest risk from a compromised IoT device?
It serves as a pivot point into the broader corporate network for data theft, ransomware staging, or botnet recruitment.
What can a small business do right now?
Enumerate every connected device, isolate them on a separate VLAN, and demand vendor patch policies in writing before purchasing.