IoT Security Risks: How Enterprises Can Mitigate the Unpatchable Endpoint Problem
IoT devices are endpoints that cannot be patched, monitored, or secured with traditional tools. The answer is not better devices — it is better segmentation and network-level monitoring.
IoT devices are the endpoints your security team cannot manage. They run embedded operating systems that rarely receive patches, they ship with default credentials that are often not changed, they do not support endpoint detection agents, and they are frequently connected to the corporate network without anyone in security being consulted.
The result is a growing population of unpatchable, unmonitorable devices sitting on the same network as your crown jewels. The answer is not to secure the devices — most cannot be secured — but to contain them.
The three layers of IoT defence
1. Network segmentation (the most important control)
IoT devices belong on their own network segment, with no route to corporate systems, the internet unconstrained, or the management interfaces of other devices. This is the single most effective IoT control and the one most often absent because it requires network engineering work that nobody volunteered for.
| Device type | Segment | Egress rules |
|---|---|---|
| Smart TVs, conference room systems | IoT VLAN | Internet only; no corporate LAN access |
| Building management, HVAC | OT VLAN | No internet; no corporate LAN; monitored |
| Security cameras, access control | Physical security VLAN | Restricted egress; no corporate LAN |
| Personal devices (BYoT) | Guest network | Internet only; completely isolated |
2. Default credential management
Every IoT device ships with default credentials. Most are documented on the manufacturer's website. Change them on deployment — this is a procurement and onboarding requirement, not a security team afterthought. For devices that do not support credential changes, they should be rejected at procurement.
3. Network-level monitoring
IoT devices cannot run EDR agents, so detection is a network function. Monitor traffic in and out of IoT segments: a camera that starts communicating with an unknown external IP is suspicious; a building management system that reaches the corporate domain controller is an alert. Network flow analysis and anomaly detection are the primary tools.
The procurement problem
Most IoT risk is introduced at procurement — a department buys a smart device, plugs it into the corporate network, and security discovers it during an audit. The fix is a procurement gate: no IoT device is purchased or connected without a security assessment that checks: can credentials be changed? Can firmware be updated? What network does it need to reach? The assessment takes 30 minutes and prevents 3 years of unmanaged risk.
Containing the endpoints you cannot secure
IoT security is not about securing devices — it is about containing them. We design segmentation and monitoring strategies that let you benefit from smart devices without letting them become attack bridges.
Kinematic Digital designs mobile security programmes for enterprise organisations. See our cybersecurity services and web development practice, or book a mobile security assessment.
Frequently Asked Questions
What are the biggest IoT security risks for enterprises?
Default credentials, unpatched firmware, lack of network segmentation, and devices that cannot be patched or monitored. The risk is amplified when IoT devices share networks with corporate systems, giving attackers a bridge from a compromised camera or thermostat to the corporate domain.
How do we secure IoT devices we cannot patch?
Segmentation is the primary control. Put unpatchable devices on an isolated network with no route to corporate systems. Monitor traffic in and out of the segment. And replace the devices on a lifecycle — if a device cannot be patched, it has a replacement date, not a permanent place on your network.
Should IoT devices be on the corporate network?
No, if it can be avoided. IoT devices should be on a separate VLAN or network segment with controlled egress. A smart TV, a building management system, and a corporate laptop should not share the same broadcast domain.
What is an IoT security policy?
A documented standard for what IoT devices are permitted on the network, how they are configured (default credentials changed, firmware updated), what network segment they belong on, and how they are monitored. It should include a procurement requirement: no new IoT device is purchased without security assessment.
false
undefined