The IoT Attack Surface: How Many Devices Are Really At Risk?

Learn More

The concept of an attack surface refers to the total number of entry points through which an attacker could attempt to gain unauthorized access to a system or network. In traditional IT environments, the attack surface is relatively well-defined — endpoints, servers, cloud services, and user accounts.

In IoT environments, the attack surface is vastly larger, far less understood, and growing faster than most organizations can manage.

Table of Contents

The Scale of the Problem

What Makes Up the IoT Attack Surface?

Why the True Scale Is Rarely Known

The Attack Surface Keeps Growing

IoT Security Best Practices

The Scale of the Problem

The global IoT device count is measured in the tens of billions. Analyst estimates vary, but the trajectory is consistent — connected devices are being deployed at a rate that far outpaces the security controls put in place to protect them.

In enterprise environments, the IoT estate typically spans far more devices than IT and security teams realize. Devices are added by facilities teams, third-party contractors, operational departments, and individual business units — often without formal IT approval, security assessment, or documentation.

The result is a shadow IoT problem: a significant portion of an organization’s connected devices are unknown to the security function, unmanaged, and unmonitored.

What Makes Up the IoT Attack Surface?

The IoT attack surface is not limited to obvious connected devices. It extends across several categories that organizations frequently underestimate.

Operational and industrial devices

— sensors, actuators, PLCs, and SCADA-connected equipment — are often the highest-consequence assets in the IoT estate. A compromised industrial sensor or controller can disrupt physical processes with immediate real-world impact.

Building management systems (BMS)

— control HVAC, lighting, physical access, and fire suppression in commercial facilities. These systems are increasingly connected to corporate IT networks, expanding the attack surface significantly while often sitting outside the scope of formal security programs.

Physical security devices

— IP cameras, access control readers, intercoms, and alarm systems

— are widely deployed, frequently internet-facing, and rarely monitored from a cybersecurity perspective.

Networked medical devices

— in healthcare environments represent some of the highest-risk IoT assets. Compromised medical equipment can affect patient safety directly, and many devices run outdated firmware with no available patches.

Smart building infrastructure

— smart meters, environmental sensors, energy management systems, and connected lighting — adds further scale to an already complex IoT estate.

Why the True Scale Is Rarely Known

Most organizations significantly underestimate the size of their IoT attack surface for several reasons.

Decentralized procurement means devices are purchased and deployed by teams outside IT — facilities managers, operations leads, and contractors — without security review or asset registration.
Legacy deployments add devices that predate current asset management processes entirely. Devices installed years or decades ago may not appear in any inventory system.
Third-party and vendor devices connected to the network for remote monitoring, maintenance, or support are frequently overlooked. These devices may remain connected long after the original maintenance task is complete.
Dynamic environments — particularly in manufacturing, healthcare, and smart buildings — see devices added, removed, and reconfigured on an ongoing basis, making point-in-time inventories unreliable.

The practical consequence is straightforward: organizations cannot accurately assess their IoT risk without first understanding what is connected to their networks.

The Attack Surface Keeps Growing

Several trends are actively expanding the IoT attack surface across enterprise environments.

IT/OT convergence connects previously isolated operational systems to corporate networks and cloud platforms — dramatically increasing the number of OT and IoT devices exposed to network-based attack.

Remote monitoring and management introduce external connectivity into environments that were once air-gapped — creating pathways for attackers to reach operational devices from outside the organization.

Digital transformation initiatives drive the deployment of new connected devices and sensors to capture operational data — often without corresponding security investment.

Supply chain integration connects partner and vendor systems to internal networks, extending the attack surface beyond organizational boundaries.

Learn more: IoT vs. OT vs. IT Security: What’s the Difference?

IoT Security Best Practices

Start with discovery.
Passive, agentless asset discovery is the foundational step in understanding and managing the IoT attack surface. Without an accurate, continuously updated device inventory, every other security control operates with incomplete information.
Assume the attack surface is larger than you think.
Shadow IoT, legacy devices, and third-party connections consistently result in organizations discovering significantly more connected devices than expected. Build security programs around this reality.
Prioritize by consequence.
Not all IoT devices carry equal risk. Focus initial security investment on devices where compromise would have the greatest operational, safety, or business impact — industrial controllers, BMS platforms, and medical devices typically sit at the top of this list.
Monitor continuously.
Given the dynamic nature of IoT environments, point-in-time assessments quickly become outdated. Continuous network monitoring provides ongoing visibility into device behavior and new connections as they appear.
Extend security governance to cover IoT procurement.
Require security assessment as part of the procurement process for any device that will connect to the corporate network — regardless of which team is making the purchase.

IoT Ransomware: How Attacks On Connected Devices Are Evolving

IOT SECURITYRANSOMWARE THREATS

Learn how ransomware groups exploit IoT devices as entry points, pivot points, and targets to cause operational disruption.

INTERNET OF THINGS

Nation-State Threats Targeting IoT And Industrial Devices

IOT SECURITYTHREAT INTELLIGENCE

Understand how nation-state actors target IoT and industrial devices and what this means for critical infrastructure security.

INTERNET OF THINGS

Botnet Attacks And IoT: How Your Devices Can Be Weaponised

CYBER THREATSIOT SECURITY

Learn how compromised IoT devices are recruited into botnets, the risks this creates, and how organizations can detect and prevent it.

This article is part of the Wizard Cyber Learning Hub — an educational resource for cybersecurity professionals and organizations seeking to strengthen their security posture across IT, OT, and IoT environments.