Exposed devices often combine weak credentials, delayed patching, and persistent connectivity, which makes them attractive as low-cost infrastructure for attackers. Once compromised, they can provide hidden bandwidth, compute, or traffic relay capacity without disrupting the business in ways that would force immediate investigation.
Why exposed connected devices become monetisable infrastructure
Exposed connected devices become valuable to criminals because they are often cheap to compromise, hard to notice at scale, and useful even when they are not the attacker’s final target. A single device can be repurposed for proxying traffic, hosting tooling, relaying scans, or generating compute and bandwidth revenue, while blending into normal network noise.
The monetisation problem is not just intrusion, it is leverage. Devices that remain reachable from the internet or from poorly segmented networks can be turned into low-friction infrastructure that criminals rent, reuse, or chain into other fraud and extortion workflows. That makes the exposure economically attractive long after the initial compromise.
Compromise also becomes sticky when the device lacks strong authentication, secure update paths, or meaningful telemetry. If defenders cannot easily distinguish normal device behaviour from abuse, the device can keep producing value for the attacker with little operational disruption, which lowers the chance of rapid containment.
What makes connected devices attractive to attackers
Attackers favour devices that are abundant, heterogeneous, and inconsistently managed. Many connected devices ship with weak default credentials, delayed patch cycles, or limited administrative visibility, which reduces the effort required to obtain durable access. Once one model or firmware family is understood, the same technique can often be scaled across many similar assets.
Persistent connectivity is especially useful because it gives attackers a stable foothold they can rely on for command, relay, or proxy activity. The device may not store valuable business data, but it can still provide bandwidth, uptime, and geographic distribution, all of which have resale value in criminal markets.
That is why exposed devices are frequently treated as infrastructure rather than victims. The attacker is not always trying to break the device itself; they are trying to extract usable capacity from it. Device and IoT Identity Guide is relevant here because device trust, certificate-based identity, and secure onboarding are what reduce the chance that a device can be quietly absorbed into abuse infrastructure.
Why the business impact is often delayed or indirect
Criminal monetisation risk grows when abuse does not immediately impair business operations. A device that continues to function normally may still be leaking bandwidth, CPU, network reach, or privileged routing capacity behind the scenes. That means the organisation can pay the operational cost later, after the attacker has already extracted value.
Indirect harm is also easier for criminals to sustain because it creates less pressure for urgent investigation. If the device still “works,” teams may assume the exposure is theoretical, even though the attacker is already using it for fraud, tunnelling, spam distribution, or staging follow-on activity. The delay between compromise and visible outage is what makes monetisation durable.
In practice, the most dangerous devices are often the ones with narrow business purpose and broad network reach. They may not be mission-critical in the usual sense, but they can still be monetised as hidden infrastructure. The CIS Benchmarks matter here because hardened baselines reduce the easy abuse conditions that make exposed devices so profitable.
Risk and Threat Considerations
Exposed connected devices create a monetisation path because they combine low acquisition cost for attackers with useful resale value. The risk is not limited to the device itself, since compromised devices can become stepping stones for proxying, scanning, bot activity, or traffic relay without immediately degrading service quality enough to trigger attention.
Failure mechanism: weak credentials, unpatched firmware, and persistent exposure let attackers convert a device into long-lived infrastructure that quietly produces bandwidth, compute, or access value.
Impact: organisations absorb hidden abuse costs, face increased detection complexity, and may inherit secondary exposure if the device is used as a launch point into other systems or external targets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Weak device auth makes exposed devices easy to commandeer. |
| NHI-05 — Overprivileged NHI | Compromised devices are monetised more when they can relay or proxy broadly. | |
| NHI-07 — Long-Lived Secrets | Persistent device access often persists through stale embedded secrets. | |
| Recommendation — Enforce strong device authentication and eliminate default credentials. Constrain device permissions to the minimum required scope. Rotate and expire embedded secrets on a defined lifecycle. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | Connected devices need strong machine-to-machine authentication. |
| CM-6 — Configuration Settings | Hardening reduces the default exposure criminals exploit on connected devices. | |
| Recommendation — Use IA-9 to authenticate devices with unique, verifiable credentials. Apply secure configuration baselines to exposed devices. | ||
| CIS Controls v8 | CIS-5 — Account Management | Default or shared device access increases compromise and monetisation risk. |
| Recommendation — Remove default accounts and enforce unique device access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions and Authorization | Limiting device privileges shrinks the value of any compromise. |
| Recommendation — Restrict device access paths to the minimum necessary. | ||
Practitioner Guidance
What to prioritise: inventory devices by exposure and replace any reliance on default or shared credentials first. If a device is internet-reachable, treat its authentication and update path as part of the risk decision, not as a later hardening task.
What to verify: confirm that exposed devices have a supported patch channel, unique credentials or certificates, and enough telemetry to detect abnormal outbound traffic. If you cannot observe traffic patterns or ownership changes, you should assume the device can be monetised before it can be contained.
Common mistake: teams often focus on whether the device is “business critical” and miss that attackers value it for its network position, uptime, or compute availability. The key question is not whether the device stores sensitive data, but whether it can be reused as durable infrastructure.
Practitioner takeaway: Exposed devices are monetisation targets because their value to criminals comes from persistence and reach, not from visible disruption, so reduce attacker utility by tightening identity, patching, and outbound control together.