Forescout Finds Most OT and Medical Segments Mixed

Forescout found only 13% of OT and 6% of IoMT segments isolated across 47,700 segments and 2.5 million devices.

Forescout Vedere Labs examined 47,700 real-world network segments and more than 2.5 million devices at 209 organizations, classifying devices as IT, OT, IoT, or IoMT. The average segment held 54 devices of four types. Although 62% of segments held one category, only 13% of segments with an OT device were OT-only and only 6% of medical-device segments were IoMT-only. IP cameras appeared in 2,266 segments, of which about 2% were camera-only and often sat beside servers; only about 20% of retail POS segments were POS-only, and the largest average blast radii were in business services, healthcare, and oil and gas. Infosecurity Magazine said nearly half of segments with OT or medical devices also contained IT or IoT, a broader claim than the 13% and 6% exclusive-segment figures both outlets report. Forescout tied mixed segments to Akira bypassing EDR via poorly segmented cameras in early 2025 and to more than 300 IP-camera takeovers linked to NoName057(16) in 2026, including Estonian and Canadian targets, and recommended smaller segments, policy-based access, and continuous drift monitoring.

• Forescout Vedere Labs analyzed 47,700 network segments and more than 2.5 million devices across 209 organizations, labeled IT, OT, IoT, or IoMT.
• The average segment held 54 devices spanning those four types; 62% of segments held a single category.
• Only 13% of OT-containing segments were OT-only, and only 6% of medical-device segments were IoMT-only.
• IP cameras appeared in 2,266 segments, about 2% of them camera-only and often beside servers.
• Only about 20% of retail POS segments were POS-only; the largest average blast radii were in business services, healthcare, and oil and gas.
• Infosecurity reported that Akira used poorly segmented cameras to bypass EDR in early 2025, and that NoName057(16) was linked to more than 300 IP-camera takeovers in 2026, including Estonian and Canadian targets.
• Forescout urges smaller segments, policy-based access, and continuous drift monitoring.
• Infosecurity's summary said nearly half of OT or medical segments also held IT or IoT, which is less specific than the 13% and 6% single-category rates in both reports.