Network Segmentation Failures Are Expanding the Corporate Attack Surface
Forescout finds nearly half of OT and medical segments also hold IT or IoT, widening lateral movement.
Forescout analyzed 47,700 real-world network segments and found the average held 54 devices spanning IT, OT, IoT, and IoMT. Nearly half of segments with OT or medical devices also contained IT or IoT, and only 2% of IP-camera segments held cameras alone. Forescout says mixed segments enable lateral movement: Akira used poorly segmented cameras to bypass EDR in early 2025, and pro-Russian NoName057(16) was linked to more than 300 IP-camera takeovers in 2026, including Estonian and Canadian targets.
- Forescout analyzed 47,700 segments; the average held 54 devices of four types.
- Only 13% of OT segments and 6% of IoMT segments were single-category.
- Just 2% of IP-camera segments contained cameras alone, often beside servers.
- Akira used poorly segmented cameras to bypass EDR; NoName057(16) compromised cameras in 2026.
- Forescout urges smaller segments, policy-based access, and continuous drift monitoring.
Full article450 words · extracted from infosecurity-magazine.com · click to collapse
Nearly half of network segments with OT or medical devices (IoMT) also contain IT and IoT, broadening the attack surface and raising the risk of lateral movement, according to Forescout.
The security vendor analyzed 47,700 real-world network segments across organizations across multiple industries to compile its latest report, What 47,700 Segments Reveal About Network Segmentation.
The report claimed that the average segment holds 54 devices across four device types: IT, OT, IoT, and IoMT. Although over three-fifths (62%) contained just one device category, 29% contained two and nearly one in 10 (9%) had three or more.
A quarter (26%) contained IT and IoT, while only 13% of segments with OT devices in them were OT only, and only 6% of IoMT segments were IoMT only.
Read more on network segmentation: Micro-Segmentation Used by 83% of Cybersecurity Leaders
Half of the device types most commonly found in mixed segments rank among 2026's riskiest devices, Forescout claimed. Only 2% of segments with IP cameras contained just those devices, for example.
Cameras typically share a segment with workstations and servers, the report revealed, meaning a single compromised device could provide a pathway into the corporate network.
This is not a theoretical threat. Forescout has previously demonstrated how poorly segmented IP cameras could be used by ransomware gangs; something that happened in early 2025 after the Akira group used the technique to bypass EDR.
“By 2026, we routinely see hacktivist groups gaining control over exposed IP cameras in targeted organizations,” the report noted. “We tracked over 300 instances this year, including these examples carried out by the pro-Russian group, NoName057(16), in late August and early September against Estonian and Canadian targets.”
Getting Segmentation Right
To get things back on track, Forescout urged security teams to:
- Establish and maintain continuous visibility of all connected assets, with an accurate inventory and insight into what is connected to the network, where devices are located, and how they communicate
- Identify and prioritize “device convergence zones,” starting with segments that contain multiple device categories with risky combinations
- Separate critical operational assets from enterprise IT networks
- Reduce oversized network segments with dozens of devices and break them down into smaller, purpose-built segments
- Implement policy-based access controls between segments, so devices only communicate with the systems required for their function
- Use asset intelligence on device types, roles and behaviors to validate segmentation decisions
- Continuously monitor for segmentation drift, because networks change over time as new devices are added and business requirements evolve
“Flat networks allow breaches to spread to critical systems that should not be reachable,” Forescout warned. “When diverse device types are grouped together without appropriate segmentation, compromising a single asset can have consequences far beyond its original scope.”