IoT and OT on the Network: Protecting the Devices Nobody Planned For

Walk through almost any modern enterprise and you will find a remarkable variety of connected devices that never appear on an IT asset list. Security cameras, badge readers, smart lighting, conference room displays, printers, building management systems, medical equipment, and industrial controllers all communicate over the network. Collectively known as the Internet of Things and operational technology, these devices now frequently outnumber traditional computers in many organizations. Most were deployed by facilities, clinical, or engineering teams rather than IT, and few were designed with security as a priority.

Why These Devices Are Difficult to Secure

IoT and OT devices present challenges that conventional security tools were not built to address. Many cannot run endpoint security agents. They often operate on outdated operating systems that cannot be patched, sometimes because a manufacturer has stopped issuing updates and sometimes because patching would require taking critical equipment offline. Default passwords remain common. And these devices frequently sit on the same network segments as business systems, providing attackers with an inconspicuous entry point.

In operational environments such as manufacturing, utilities, and healthcare, the stakes extend beyond data. A compromised controller or infusion pump can affect physical processes and human safety.

Start With Visibility

The first and most important step is discovering what is actually connected. Modern approaches analyze network traffic to identify and classify devices automatically, determining the manufacturer, model, function, and typical behavior of each. Machine learning is particularly useful here, since it can recognize device types from their communication patterns without requiring agents or manual inventory.

Many organizations are surprised by what discovery reveals: devices nobody knew existed, devices running long-unsupported software, and devices communicating with unexpected external destinations.

Segment and Enforce Least Privilege

Once devices are identified, they can be grouped and isolated. A camera needs to communicate with its video recorder, not with the finance system. A medical device needs to reach specific clinical applications, not the open internet. Policies that restrict each device class to its legitimate communication paths sharply limit an attacker’s ability to use a compromised device as a stepping stone.

Monitor Behavior Continuously

Because most IoT and OT devices perform narrow, predictable functions, deviations from their normal behavior are meaningful. Continuous monitoring can flag a printer suddenly scanning the network or a controller receiving commands from an unfamiliar source.

The Bottom Line

IoT and OT devices have quietly become a large and vulnerable part of the enterprise attack surface. Automated discovery, segmentation by device type, least-privilege policies, and behavioral monitoring allow organizations to protect these devices without agents or disruptive patching. Collaboration between IT, security, facilities, and operations teams is essential. Organizations that address this blind spot now will close a path attackers increasingly favor, and protect operations where the consequences are physical as well as digital.