Last updated: May 2026

Connected devices now outnumber traditional IT endpoints on most enterprise networks. Routers, IP cameras, medical equipment, building automation controllers, industrial sensors, and dozens of other device types operate alongside laptops and servers, often on the same network segments, often without any security agent installed. Forescout’s 2026 research found that 40% of the riskiest device types were not even on their risk list a year ago, and 75% were absent two years ago. Routers and switches alone average 32 vulnerabilities per device. The connected device security challenge is growing faster than most security teams can respond to it manually. This guide covers what connected device security requires, why purpose-built IoT security solutions exist, what capabilities matter when evaluating them, and how organizations are protecting their connected device environments in 2026.

---

On this page:

• What Is Connected Device Security?
• Why Connected Device Security Requires Its Own Approach
• Connected Device Security Risks in 2026
• The Most Vulnerable Connected Device Categories
• Core Connected Device Security Capabilities
• Network Segmentation for Connected Devices
• Connected Device Vulnerability Management
• Standards and Frameworks for Connected Device Security
• What to Look for in an IoT Security Solution
• Connected Device Security Best Practices
• Connected Device Security by Industry
• Securing Your Connected Device Environment

---

What Is Connected Device Security?

Connected device security is the practice of protecting network-connected devices, their communications, and their data from unauthorized access, compromise, and disruption. The category covers IoT devices (cameras, printers, VoIP phones, smart building systems), IoMT devices (medical equipment, clinical monitors, infusion pumps), OT devices (PLCs, SCADA systems, industrial controllers), and IIoT devices (factory floor sensors, edge gateways, environmental monitors).

What ties these device types together from a security perspective is a shared set of limitations. Most connected devices cannot run endpoint security agents. They ship with default credentials that frequently go unchanged. They receive firmware updates infrequently, if at all. Many communicate over proprietary or legacy protocols that predate modern encryption standards. And they are deployed at scale, meaning a single vulnerability class can affect hundreds or thousands of devices across an organization simultaneously.

Traditional IT security tools were designed for endpoints that cooperate with the security infrastructure: they accept agents, they authenticate to directory services, they process patches on a regular cycle. Connected devices do none of these things reliably. This is why connected device security has emerged as a distinct discipline, and why purpose-built IoT security solutions exist.

The connected device attack surface continues to expand. IoT Analytics projects 21 to 24 billion connected devices globally in 2026. Absolute Security’s research found that 83% of organizations experienced operational disruption following cyber incidents in 2025, with average annual downtime costs reaching $49 million. An unmonitored connected device is often the entry point.

Related: IoT Security: The Complete Guide to Protecting Connected Devices

Why Connected Device Security Requires Its Own Approach

The differences between connected device security and traditional endpoint security are structural, not just a matter of scale:

No agent, no visibility. IT security depends on agents running on endpoints to provide telemetry, enforce policies, and detect threats. Connected devices cannot host these agents. Without a purpose-built solution, they operate as blind spots on the network.

Patching is constrained. IT endpoints receive automated patch deployments on regular cycles. Connected devices may require vendor-specific update procedures, maintenance windows coordinated with operations teams, or validation testing that takes weeks. Some devices cannot be patched at all without voiding certifications or causing operational disruption. An IoT security solution helps organizations identify which patches are available, evaluate them before deployment, and apply compensating controls when patching is not feasible.

Protocol diversity creates monitoring gaps. Connected devices communicate over dozens of protocols, many proprietary: BACnet for building automation, HL7 and DICOM for medical systems, Modbus and CIP for industrial equipment, MQTT and CoAP for IoT sensors. Standard network monitoring tools designed for HTTP/HTTPS and SMB traffic miss this communication entirely.

Scale overwhelms manual processes. A mid-size hospital may have 15,000 connected devices. A manufacturing campus might have 50,000. Manually inventorying, assessing, and writing security policies for each device is not viable. Connected device security requires automation at every stage: discovery, classification, vulnerability assessment, policy generation, and monitoring.

Consequences extend beyond data loss. A compromised laptop results in data exposure. A compromised infusion pump, building HVAC controller, or industrial PLC can affect patient safety, physical operations, or worker wellbeing. Connected device security must account for these operational and safety dimensions.

Connected Device Security Risks in 2026

Botnets at Unprecedented Scale

The Aisuru botnet (also tracked as TurboMirai) achieved DDoS capability exceeding 20 Tbps in the 2025-2026 timeframe, recruiting IoT devices, including IP cameras and network video recorders. Microsoft Azure blocked a single 15.72 Tbps attack linked to IoT botnets. Connected devices with default credentials and limited authentication remain the primary recruitment pool.

Ransomware Using Connected Devices as Entry Points

Ransomware operators increasingly target connected devices for initial access, then pivot to higher-value IT or OT systems. Dragos tracked 119 ransomware groups impacting more than 3,300 industrial organizations in 2025. GuidePoint Security recorded a 58% year-over-year increase in ransomware victims. Manufacturing and healthcare, both heavily reliant on connected devices, are the most targeted sectors.

Supply Chain Compromise at Device Scale

BadBox 2.0 compromised more than 10 million smart TVs, projectors, and infotainment systems with pre-installed malware in 2025, the largest known TV botnet. The malware was embedded before devices reached the buyer. Supply chain attacks at this scale make post-deployment connected device security controls essential.

Nation-State Pre-Positioning in Network Infrastructure

The VOLTZITE threat group targeted edge devices and remote access infrastructure at utilities and telecommunications providers to establish persistent access. Forescout’s research confirmed that network infrastructure, particularly routers, has overtaken traditional endpoints as the highest-risk category in 2026. Routers account for roughly one-third of the most critical vulnerabilities across enterprise networks.

Shadow Connected Devices Expanding the Attack Surface

Devices connect to enterprise networks without security team awareness or approval. Facilities teams install smart building systems. Clinical engineers connect new medical devices. Vendors deploy monitoring equipment during service visits. Each expands the attack surface without appearing in any IT asset inventory. Palo Alto Networks identified a 332% increase in unique internet-exposed OT devices and services, with nearly 20 million OT-related devices now observable on the public internet.

Related: The Top IoT Cybersecurity Breaches in 2025

The Most Vulnerable Connected Device Categories

Forescout’s 2026 Riskiest Connected Devices report identifies the highest-risk device types across four categories, based on vulnerability density, exposure, and business impact:

IT: Routers, serial-to-IP converters, workstations, firewalls, and domain controllers lead the risk rankings. Routers and switches average 32 vulnerabilities per device and account for 34% of the most critical vulnerabilities in organizational networks.

IoT: VoIP systems, printers, time clocks, network video recorders, and RFID readers represent the highest risk. These devices are widely deployed, infrequently patched, and often use default credentials.

IoMT: Medication dispensing systems, medical image printers, DICOM gateways, MRI scanners, and healthcare workstations carry the greatest risk in clinical environments. These devices run legacy operating systems, require constant connectivity, and are difficult to patch without disrupting clinical workflows.

OT: Power distribution units (PDUs), I/O modules, and BACnet routers are new entrants to the risk list, reflecting how OT risk is expanding into operational infrastructure components that were previously overlooked.

Financial services recorded the highest average device risk of any industry in 2026, followed by government and healthcare. Legacy Windows systems remain widely deployed: 39% in retail, 35% in healthcare, 29% in financial services.

Related: 11 Common IoT Devices That Are Vulnerable to Hacking

Core Connected Device Security Capabilities

An effective connected device security program requires five capabilities that work together:

Passive Device Discovery and Inventory

Connected device security starts with knowing what is on the network. Discovery must be passive in environments with sensitive devices, since active scanning can crash PLCs, disrupt medical equipment, and cause operational outages. Passive deep packet inspection observes network traffic without sending packets to devices, building an inventory from observed communications.

A useful inventory captures more than device presence. It includes manufacturer, model, firmware version, operating system, communication patterns and peers, open ports, known vulnerabilities, and the device’s operational role within the organization.

Asimily’s protocol analyzer uses passive deep packet inspection to discover and classify connected devices across IT, IoT, OT, and IoMT environments. When the platform encounters a new device type, rapid protocol analysis allows classification without waiting for a full product release cycle.

Contextual Vulnerability Prioritization

Connected devices accumulate vulnerabilities faster than teams can remediate them. The average medical device carries 6.2 vulnerabilities, and 60% of medical devices in active use are end-of-life with no available patches. Raw CVSS scores do not account for network context, exploit availability, or compensating controls.

Asimily’s prioritization combines analysis from Asimily Labs, AI/ML-based techniques, and the MITRE ATT&CK framework to enable actual attack-path analysis. The platform determines whether a vulnerability on a specific device in a specific network position is realistically exploitable. This reduces the actionable vulnerability list by an order of magnitude, allowing teams to focus on findings that carry real operational risk.

Automated Segmentation Policy Generation

Network segmentation is the most effective control for connected devices that cannot protect themselves. But writing granular policies for thousands of heterogeneous devices is the primary reason segmentation projects stall.

Asimily generates segmentation policies based on observed device behavior and integrates with existing NAC platforms (including Cisco ISE), firewalls, and switch infrastructure. The Policy Simulation feature allows teams to preview the effects of policies before enforcement. Targeted segmentation groups devices by exploit vector using the MITRE ATT&CK framework, delivering risk reduction across thousands of devices in days rather than months.

Continuous Behavioral Monitoring

Connected devices that behave normally follow predictable communication patterns: they talk to specific servers, at specific intervals, using specific protocols. Behavioral monitoring baselines these patterns and alerts when a device deviates, connecting to unexpected destinations, transferring unusual data volumes, or communicating over protocols it has never used before.

Asimily’s threat detection supports custom detection rules, integrates with SIEM and SOAR platforms, and provides packet capture on detection events for forensic analysis.

Patch and Configuration Management

An IoT security solution should help detect available firmware updates, evaluate patches before deployment, and automate the update process where possible. For devices that cannot be patched, the solution should provide compensating controls: virtual patching, configuration hardening, and segmentation policy tightening.

Asimily’s patching capability combines direct firmware updates with automated compensating controls. The Risk Simulator models the impact of remediation actions before they are executed, giving teams confidence that a change will improve security without disrupting operations.

Related: Automated IoT Visibility and Deep Categorization

Related: Continuous IoT Vulnerability Detection

Related: Network Segmentation and Microsegmentation Solutions

Network Segmentation for Connected Devices

Segmentation deserves its own focus because it is the single most impactful control for connected device environments. When a device cannot host its own defenses, the network must enforce boundaries on its behalf.

Effective connected device segmentation operates at three levels:

Macro-segmentation separates connected devices from general-purpose IT systems. IoT, OT, and IoMT devices should not share network segments with user workstations, email servers, or domain controllers. This limits the lateral movement paths available to an attacker who compromises a connected device.

Zone-based segmentation groups connected devices by function, risk profile, or regulatory requirement. Medical devices in a separate zone from building automation. Production OT in a separate zone from corporate IoT. Each zone has firewall rules governing what traffic can cross zone boundaries.

Targeted segmentation applies risk-based policies at the exploit-vector level. Rather than writing individual rules for each device, this approach identifies the attack vectors that affect groups of devices and blocks those vectors at the network layer. Asimily’s targeted segmentation reduces the number of policies required while delivering broader risk reduction, because blocking one exploit vector can protect every device vulnerable to it simultaneously.

Related: What is Microsegmentation?

Related: Targeted Segmentation: Manage IoT Risk 10x Faster

Connected Device Vulnerability Management

Connected device vulnerability management differs from IT vulnerability management in three important ways:

Patch availability is unreliable. Many connected device manufacturers do not provide regular firmware updates. When patches exist, they may require vendor coordination, compatibility testing, and scheduled maintenance windows. Some patches void manufacturer warranties or safety certifications.

Active scanning is often unsafe. Traditional vulnerability scanners send probes to devices that can crash PLCs, disrupt medical equipment, and cause safety incidents. Vulnerability assessment for connected devices must rely on passive identification combined with vulnerability database correlation.

Compensating controls must fill the gap. When a device cannot be patched on the timeline its vulnerability severity demands, other controls must reduce the risk: network segmentation restricts what the device can communicate with, virtual patching blocks known exploitation techniques at the network layer, and configuration hardening removes unnecessary services.

Asimily’s connected device vulnerability management combines passive discovery (to identify devices and their firmware versions without disruption), automated correlation with vulnerability databases (including CVE lists, EPSS, SBOMs, and manufacturer advisories), contextual prioritization (using MITRE ATT&CK attack path analysis), and prescriptive remediation (specific instructions ranked by effort and impact).

Related: Risk-based IoT Vulnerability Prioritization

Standards and Frameworks for Connected Device Security

NIST Cybersecurity Framework (CSF 2.0) provides the risk management structure for governing connected device security programs, organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

NIST SP 800-183 (Networks of Things) specifically addresses the architecture and security considerations of connected device deployments, including communication patterns, data protection, and system composition.

NISTIR 8259 Series defines a core baseline of cybersecurity capabilities that device manufacturers should build into their products, covering device identification, configuration, data protection, logical access, software updates, and cybersecurity awareness.

CISA CPG 2.0, released in December 2025, unified IT, IoT, and OT security goals for the first time under six functions, reflecting the operational convergence that connected device environments create.

EU Cyber Resilience Act introduces mandatory security requirements for all products with digital elements sold in the EU. Incident reporting obligations take effect in September 2026, requiring manufacturers to report actively exploited vulnerabilities within 24 hours.

IEC 62443 covers industrial automation and control system security, applicable to OT and IIoT connected devices in manufacturing, energy, and critical infrastructure environments.

UK Code of Practice for Enterprise Connected Device Security is under development following a 2026 consultation. 76% of respondents agreed that enterprise-connected device risks are sufficiently different from consumer IoT to warrant an independent code of practice.

Industry-specific regulations impose requirements on particular connected device types: HIPAA and FDA cybersecurity guidance for medical devices, NERC CIP for utility infrastructure, and PCI DSS for payment-connected devices.

Related: Asimily and NIST CSF 2.0 Alignment

What to Look for in an IoT Security Solution

When evaluating IoT security solutions for your connected device environment, these capabilities separate platforms that work in production from those that work only in demos:

Coverage across device categories. The solution should discover, classify, and monitor IT, IoT, OT, and IoMT devices from a single platform. Solutions that cover only one category leave gaps that attackers will find.

Passive-first discovery. Active scanning has a place in IT environments, but connected device discovery must default to passive methods. Ask vendors specifically how they handle discovery in environments with medical devices, industrial controllers, and other sensitive equipment.

Industrial and clinical protocol support. If the solution only parses standard IT protocols, it will miss the majority of connected device communications. Look for native support of BACnet, Modbus, CIP, HL7, DICOM, MQTT, and vendor-specific variants.

Risk-based prioritization, not just scanning. A vulnerability list is not a risk assessment. The platform should analyze exploit likelihood using structured frameworks like MITRE ATT&CK, accounting for network position, known exploits, device criticality, and existing compensating controls.

Automated segmentation with simulation. Manual policy creation does not scale. The platform should generate policies from observed device behavior and let you simulate the effects before enforcement.

Integration with existing infrastructure. The solution should enforce policies through your current NAC, firewall, and switch infrastructure, and integrate with your SIEM, SOAR, and CMDB platforms.

Incident response support. Packet capture on detection events, device-level context for responders, and automated quarantine capabilities.

Asimily addresses each of these requirements as a unified connected device security platform. Request a proof-of-concept in your environment to evaluate coverage and accuracy with your device population.

Connected Device Security Best Practices

1. Discover and inventory every connected device continuously. Automated, passive discovery should run continuously, not as a one-time project. Include devices deployed by facilities, clinical engineering, vendors, and contractors.
2. Segment connected devices from general-purpose IT. At a minimum, connected devices should not share network segments with user workstations, email, or directory services. Apply targeted segmentation by risk profile and exploit vector for further reduction.
3. Prioritize vulnerabilities by exploit likelihood and operational impact. Use contextual risk scoring, not raw CVSS. Account for network exposure, known exploits, device function, and compensating controls.
4. Apply compensating controls for unpatchable devices. Segmentation, virtual patching, and configuration hardening reduce risk without requiring firmware changes.
5. Eliminate default credentials at deployment. Change default passwords and disable unnecessary services before connecting any device to your network. Audit existing devices regularly.
6. Monitor device behavior continuously. Baseline normal communication patterns for each device type. Alert on deviations: unexpected destinations, unusual data volumes, protocol anomalies.
7. Establish clear ownership for connected device security. Define which team is responsible for device inventory, vulnerability management, segmentation, and incident response across IT, IoT, OT, and IoMT.
8. Evaluate device security during procurement. Assess manufacturer security practices, patch commitments, SBOM availability, and end-of-life policies before purchase.
9. Include connected devices in your incident response plan. Build playbooks for device-specific scenarios: quarantining a compromised medical device without disrupting patient care, isolating a building system without affecting operations, and containing a botnet-enrolled sensor.
10. Review and update regularly. Connected device environments change constantly. Quarterly reviews of inventory accuracy, segmentation policy effectiveness, and vulnerability remediation progress keep your program current.

Connected Device Security by Industry

Healthcare. The most complex connected device environment. A typical hospital operates 10,000 to 50,000 connected devices across clinical, facilities, and IT functions. IoMT devices directly affect patient safety, and regulatory requirements (HIPAA, FDA, state mandates) add compliance obligations. Asimily works with healthcare delivery organizations across the U.S. to provide IoMT visibility, risk prioritization, and segmentation.

Manufacturing. The most targeted sector. Over 70% of manufacturers have experienced cyber incidents linked to connected devices. IIoT sensors, PLCs, SCADA systems, and building automation all create an attack surface. IT/OT convergence means a compromise in one domain can reach the other.

Financial Services. Forescout’s 2026 data shows that financial services have\ the highest average device risk of any industry. ATMs, trading systems, surveillance infrastructure, and branch IoT all require connected device security coverage.

Energy and Utilities. Geographically distributed SCADA, smart grid, and remote monitoring infrastructure. NERC CIP compliance requirements. Nation-state targeting of utility networks through edge devices and remote access infrastructure.

Government. Second-highest average device risk behind financial services. Large, heterogeneous connected device environments spanning physical security, building automation, IT infrastructure, and specialized operational systems.

Related: Asimily for Healthcare

Related: Asimily for Manufacturing

Securing Your Connected Device Environment

Connected device security requires three things: complete visibility into every device on your network, contextual understanding of which vulnerabilities carry real risk, and automated segmentation that limits what an attacker can reach. Patching, compliance, monitoring, and incident response all build on that foundation.

Asimily provides these capabilities across IT, IoT, OT, and IoMT environments from a single platform. From device discovery through vulnerability prioritization, segmentation orchestration, behavioral monitoring, and incident response, the platform addresses the full connected device security lifecycle.

Talk to an Asimily Connected Device Security Expert

See the Asimily Platform Overview

---

Asimily is the next-generation cyber asset and exposure management platform for IT, IoT, OT, and IoMT environments. Ranked 11th on the 2024 Deloitte Technology Fast 500 for fastest-growing cybersecurity companies in North America. Learn more.

Interested in learning more? Check out our platform overview.