Network Segmentation Failures Expand the Corporate Attack Surface

Nearly half of network segments with OT or medical devices (IoMT) also contain IT and IoT, broadening the attack surface and raising the risk of lateral movement, according to Forescout.

The security vendor analyzed 47,700 real-world network segments across organizations across multiple industries to compile its latest report, What 47,700 Segments Reveal Network Segmentation.

The report claimed that the average segment holds 54 devices across four device types: IT, OT, IoT, and IoMT. Although over three-fifths (62%) contained just one device category, 29% contained two and nearly one in 10 (9%) had three or more.

A quarter (26%) contained IT and IoT, while only 13% of segments with OT devices in them were OT only, and only 6% of IoMT segments were IoMT only.

Half of the device types most commonly found in mixed segments rank among 2026's riskiest devices , Forescout claimed. Only 2% of segments with IP cameras contained just those devices, for example.

Cameras typically a segment with workstations and servers, the report revealed, meaning a single compromised device could provide a pathway into the corporate network.

This is not a theoretical threat. Forescout has previously demonstrated how poorly segmented IP cameras could be used by ransomware gangs; something that happened in early 2025 after the Akira group used the technique to bypass EDR.

“By 2026, we routinely see hacktivist groups gaining control over exposed IP cameras in targeted organizations,” the report noted. “We tracked over 300 instances this year, including these examples carried out by the pro-Russian group, NoName057(16), in late August and early September against Estonian and Canadian targets.”

Getting Segmentation Right

To get things back on track, Forescout urged security teams to:

Establish and maintain continuous visibility of all connected assets, with an accurate inventory and insight into what is connected to the network, where devices are located, and how they communicate

Identify and prioritize “device convergence zones,” starting with segments that contain multiple device categories with risky combinations

Separate critical operational assets from enterprise IT networks

Reduce oversized network segments with dozens of devices and break them down into smaller, purpose-built segments

Implement policy-based access controls between segments, so devices only communicate with the systems required for their function

Use asset intelligence on device types, roles and behaviors to validate segmentation decisions

Continuously monitor for segmentation drift, because networks change over time as new devices are added and business requirements evolve

“Flat networks allow breaches to spread to critical systems that should not be reachable,” Forescout warned . “When diverse device types are grouped together without appropriate segmentation, compromising a single asset can have consequences far beyond its original scope.”

Detected Cyber-Threats Surge 52% in 1H 2022 News 1 September 2022

Detected Cyber-Threats Surge 52% in 1H 2022

Trust in Cyber Takes a Knock as CNI Budgets Flatline News 18 April 2024

Trust in Cyber Takes a Knock as CNI Budgets Flatline

Schools Out for Ransom: Education Under Attack Opinion 9 February 2023

Schools Out for Ransom: Education Under Attack

Interview: How YKK Is Securing the World’s Largest Zipper Manufacturing Operation Interview 30 April 2026

Interview: How YKK Is Securing the World’s Largest Zipper Manufacturing Operation

The Rising Risk Landscape for Critical National Infrastructure Opinion 23 April 2026

The Rising Risk Landscape for Critical National Infrastructure

What’s Hot on Infosecurity Magazine?

ShinyHunters Claim Hack of Rival Ransomware Gang Clop

Revolut Customers Targeted with New Wave of Phishing Attacks

Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing

New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

CRA Reporting Rules Take Effect: How to Ensure Your Organization is Ready

AI Agent Carries Out Multi-Stage Data Theft Attack

Most Firms Unable to Recover Quickly from Ransomware

A CISO's Lessons in Ransomware Response and Recovery After a Real-World LockBit Attack

ShinyHunters Claim Hack of Rival Ransomware Gang Clop

Your Security Awareness Programme Isn't Failing, It's Just Not Relevant

From APIs to Agents: How to Secure AI at Enterprise Scale

Frontier AI: How Cyber Defenders Can Harness the Defender’s Window

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Financial Services Cyber Resilience: Stress Testing Third Parties Before Attackers Do

Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust