The Office Is Getting Smarter — and More Vulnerable
Walk through almost any small or mid-size business office in 2026, and you'll encounter a remarkable variety of connected devices: smart thermostats adjusting the climate, IP-based security cameras watching the parking lot, badge readers controlling access to the server room, VoIP phones on every desk, a connected espresso machine in the break room, a fleet of wireless printers, smart TVs in conference rooms, and environmental sensors scattered throughout the building.
Most business owners would call that progress. IT professionals increasingly call it a nightmare.
The Internet of Things (IoT) has quietly become one of the fastest-growing and least-managed attack surfaces in modern business. According to IoT Analytics, the number of connected IoT devices worldwide surpassed 18 billion in 2025 and is projected to exceed 25 billion by 2027. A meaningful portion of that growth is happening inside business environments — and the vast majority of those devices are being deployed without meaningful security oversight.
This isn't a theoretical problem. It's an active, exploited vulnerability that attackers are leveraging right now to gain footholds inside business networks. And for small and mid-size businesses, the risk is especially acute — because enterprise-grade IoT security programs are rare outside the Fortune 500.
Here's what's actually happening, why it matters, and what your business can do about it.
What "IoT Device Sprawl" Actually Means
IoT sprawl refers to the unchecked proliferation of connected devices across a business network — devices that weren't part of a planned IT deployment, aren't being actively managed, and often aren't visible to IT staff at all.
This happens organically and quickly. A facilities manager installs a smart HVAC controller. Marketing buys a digital signage display that connects to Wi-Fi. The front desk gets a new badge reader that the vendor configures remotely. Someone brings in a connected air quality monitor for a health-conscious open office. The break room gets a Keurig with a Wi-Fi enabled reorder feature.
Nobody thinks of any of these as "IT decisions." But every single one of them is a network-connected computer running software — often outdated, often unpatched, often with default credentials still in place.
A 2025 study by Palo Alto Networks found that 57% of IoT devices on enterprise and SMB networks are vulnerable to medium or high-severity attacks, and 98% of IoT device traffic is unencrypted. That's not a typo. Almost all of the data moving between your connected devices and their cloud backends is transmitted in plaintext that anyone on the same network — or intercepting traffic — can read.
Why IoT Devices Are Such an Easy Target
They're Almost Never Patched
Traditional endpoints like laptops and servers get patched regularly — or at least they should. IoT devices are a different story. Most small businesses install a smart camera or thermostat and never think about firmware updates again. Vendors release security patches, but there's no automatic enforcement mechanism, no MDM solution watching over a Nest thermostat, and no one on staff whose job it is to update the badge reader firmware.
This matters enormously. Attackers actively scan for known vulnerable firmware versions on common IoT devices. Tools that automate this process are freely available on the dark web — and increasingly, AI-assisted scanning has made the process faster and more targeted than ever before.
Default Credentials Are Still Everywhere
Industry research consistently shows that a staggering percentage of IoT devices deployed in business environments are still running default manufacturer usernames and passwords. "admin/admin." "admin/password." "root/1234." These credentials are publicly documented, easily searchable, and one of the first things attackers try when they find an exposed device.
This isn't a new problem — it's been documented for over a decade. Yet in 2026, it remains one of the most common paths attackers use to gain initial access to business networks.
IoT Devices Rarely Support Security Agents
Your endpoint protection platform can run an agent on a Windows laptop. It cannot run an agent on a Honeywell connected thermostat. Your EDR solution doesn't know the IP camera in the lobby exists. Your vulnerability scanner may find it, but it can't remediate it, patch it, or enforce policy on it.
This invisibility is precisely what makes IoT devices so dangerous. They exist inside your network perimeter but outside your security tooling — often for years without anyone noticing.
They Provide Lateral Movement Opportunities
Even if a compromised IoT device itself contains no sensitive data, it provides attackers with a foothold inside your network. From a compromised IP camera on your corporate Wi-Fi, a sophisticated attacker can probe other devices, escalate privileges, and eventually reach systems that do contain sensitive data — financial records, customer information, healthcare records, intellectual property.
The 2013 Target breach — still one of the most instructive case studies in enterprise security — began with attackers compromising an HVAC vendor's network credentials. In 2026, the same attack vector is more common, more automated, and more dangerous than ever.
The Small Business IoT Risk Landscape in 2026
Small and mid-size businesses face a different IoT risk profile than large enterprises — in some ways worse.
No dedicated IoT security team. Large organizations increasingly have IoT security programs, dedicated network segments for OT/IoT devices, and staff responsible for device inventory. Most SMBs have none of these.
More vendor-managed devices. Small businesses frequently let vendors — security companies, HVAC contractors, copier vendors — manage their own connected devices remotely. This creates third-party access paths that aren't tracked, governed, or revoked when relationships end.
Flat networks. Most small business networks aren't segmented. IoT devices, workstations, servers, and cloud access all live on the same flat network. A compromised printer can see everything else.
Growing compliance implications. If your business handles protected health information, payment card data, or controlled unclassified information, your IoT devices are in scope for compliance frameworks. HIPAA, PCI-DSS 4.0, and CMMC 2.0 all require you to identify and secure networked devices — including IoT endpoints. Unmanaged connected devices are now a compliance liability, not just a security one.
What an IoT Security Program Actually Looks Like for SMBs
You don't need a Fortune 500 security operations center to manage IoT risk effectively. But you do need a structured approach. Here's what that looks like in practice.
Step 1: Get a Complete Device Inventory
You cannot secure what you don't know exists. The first step in any IoT security program is a comprehensive discovery exercise — finding every networked device on your infrastructure, including devices that weren't officially deployed by IT.
This typically requires network scanning tools that go beyond traditional asset management platforms. Many IoT devices don't respond to standard discovery protocols the way a Windows workstation does. Purpose-built network discovery tools, combined with a thorough walkthrough of your physical space, are both necessary.
At Layer27, our Infrastructure Pro service includes comprehensive network discovery as a foundation — because we've seen firsthand how many devices exist on client networks that nobody in the organization knew about.
Step 2: Segment IoT Devices onto Separate Networks
The single most impactful thing most small businesses can do for IoT security is network segmentation. Put simply: IoT devices should not share a network with your workstations, servers, and business-critical systems.
A dedicated IoT VLAN (virtual local area network) limits the blast radius of a compromised device. If an attacker takes over a smart TV in your conference room, they're on the IoT VLAN — they can't pivot to your file server or accounting system without breaking through additional network controls.
This is a core principle of Zero Trust architecture: never assume that because a device is inside your network, it should have access to everything else inside your network. Proper segmentation enforces that principle at the network layer.
Step 3: Change Default Credentials Immediately — Every Time
Every IoT device that enters your environment should have its default credentials changed before it's connected to your network. This sounds basic, and it is — but it remains one of the most consistently ignored security practices in SMB environments.
Build this into your procurement and deployment process. Create a documented procedure. Make it as automatic as putting a device on the right network segment.
Step 4: Establish a Firmware Patching Process
IoT device firmware patching is genuinely difficult — there's no unified platform, update schedules are inconsistent, and many devices require manual intervention. But ignoring it entirely isn't acceptable.
Your approach should include:
- Knowing the firmware version currently running on every IoT device
- Subscribing to vendor security advisories for your device models
- Scheduling quarterly firmware review cycles
- Including IoT devices in your overall vulnerability management program
Devices that are end-of-life and no longer receiving security updates should be isolated or replaced — not left running indefinitely on your network.
Step 5: Apply Least-Privilege Network Access
IoT devices should only be able to communicate with what they absolutely need to function. A badge reader needs to talk to its access control server. It does not need internet access. A security camera needs to communicate with its recording system. It does not need access to your file shares.
Firewall rules and access control lists can enforce this — but only if someone has taken the time to map device communication requirements and configure the rules accordingly. This is where many SMBs fall short.
Step 6: Monitor IoT Device Behavior
Even well-managed IoT devices can be compromised. Ongoing monitoring of network traffic from IoT segments can detect anomalous behavior — a thermostat suddenly generating outbound traffic to an unknown IP address, or a printer attempting lateral connections to other network hosts.
This kind of behavioral monitoring is one of the capabilities our Managed Detection & Response (MDR) and 24x7 SOC services extend to connected device environments. Traditional endpoint monitoring doesn't cover IoT, but network-level behavioral analysis does — and it's increasingly essential for businesses with significant IoT deployments.
IoT and Compliance: What the Frameworks Actually Require
If your business operates in a regulated industry, IoT devices aren't just a security concern — they're a compliance concern.
HIPAA: The 2025 Security Rule update explicitly addresses networked medical devices and connected office technology in covered entity environments. Any networked device that could potentially access or transmit PHI must be included in your risk analysis and addressed in your security program.
PCI-DSS 4.0: Requirement 12.3 now requires organizations to maintain an inventory of all hardware and software components in scope for the cardholder data environment. If your payment processing systems share network space with unmanaged IoT devices, that's a compliance problem.
CMMC 2.0: Defense contractors handling CUI must account for all networked assets — including IoT devices — in their system security plans. Unmanaged connected devices in a CMMC-assessed environment are a finding waiting to happen.
Layer27's Compliance practice helps businesses navigate these requirements, including the increasingly complex intersection between IoT device management and regulatory frameworks. Getting ahead of this now is significantly less painful than addressing it during an audit.
Building IoT Security Into Your Broader Technology Strategy
IoT security doesn't exist in isolation. It's most effective when it's integrated into your broader IT governance and security posture.
For businesses just beginning to formalize their IT security programs, starting with a foundation like Safe Start gives you the baseline controls — including network security, endpoint management, and security policy — that make IoT-specific controls more effective. You can't layer sophisticated IoT monitoring on a flat, unmanaged network and expect good outcomes.
For businesses with existing managed IT relationships, this is a conversation worth having with your provider explicitly. Ask: "What IoT devices are on our network? Are they segmented? Are they being monitored?" If your provider can't answer those questions confidently, that's a gap that needs to close.
Our Security Awareness Training programs also now include modules specifically addressing IoT risk in the workplace — helping employees understand why plugging in a personal smart speaker at the office isn't just a policy violation, but a genuine security risk.
The Business Case: This Is a Risk, Not Just a Tech Problem
Business leaders sometimes tune out when conversations turn to network segmentation and firmware patching. Fair enough — that's what IT teams are for.
But the business stakes of unmanaged IoT risk are very real:
- Breach costs: The average cost of a small business data breach exceeded $4.9 million in 2025 according to IBM's Cost of a Data Breach Report — a figure that includes regulatory fines, legal costs, customer notification, and remediation.
- Cyber insurance: Carriers are increasingly asking about IoT security controls during underwriting. Unmanaged connected devices can affect your coverage eligibility and premium.
- Operational disruption: A ransomware attack that originates from a compromised IoT device disrupts operations the same as any other ransomware attack. The source doesn't change the outcome.
- Reputational damage: A breach traced to a security camera your vendor installed two years ago and you forgot about is still your breach. Customers and partners don't distinguish.
This is ultimately a risk management decision, not just a technology decision. And like most business risks, it's significantly cheaper to address proactively than reactively.
Actionable Steps You Can Take This Week
You don't need a six-month project to start reducing IoT risk. Here's what you can do immediately:
- Walk your space. Physically walk through your office and make a list of every device that might be connected to your network. Include things you don't think of as "IT" — displays, thermostats, cameras, printers, access controls.
- Log into your router or managed switch. Look at connected devices. You may be surprised what you find.
- Google your devices' default credentials. If your devices are still running them, change them today.
- Ask your IT team or provider three questions: Do we have an IoT VLAN? Are IoT devices monitored? When did we last update their firmware?
- Schedule a formal network assessment. If you don't have a complete, current picture of your network, get one.
The Bottom Line
IoT device sprawl is one of the defining IT security challenges for small and mid-size businesses in 2026 — not because it's new, but because it's been largely ignored while the problem quietly grew to significant scale. The connected office is here, it's expanding, and it's creating attack surface that most businesses have no visibility into and no controls over.
The good news: this is a solvable problem. It doesn't require enterprise budgets or specialized staff. It requires inventory, segmentation, basic credential hygiene, patch management, and monitoring — all things that fit within a structured managed IT and security program.
The businesses that address this now will be significantly better positioned than those that wait for a breach to prompt action.
Ready to find out what's actually on your network? Layer27's team can conduct a comprehensive network assessment, identify unmanaged IoT devices, and build a security strategy that covers your entire connected environment — not just your laptops.