Device intelligence exposed the network visibility gap across connected assets

At a glance

What this is: Ordr argues that device intelligence became necessary because traditional inventory tools could not reliably see unmanaged connected assets across IT, OT, IoT, and medical environments.

Why it matters: This matters because IAM and security teams cannot govern access, segmentation, or risk when the asset estate is only partially visible, especially where devices act as non-human identities in practice.

Context

Network visibility is the ability to see what is connected, how it communicates, and whether it is behaving as expected. In environments filled with unmanaged devices, that visibility becomes a governance control rather than a reporting metric, because incomplete discovery undermines isolation, policy enforcement, and risk analysis.

The article’s core point is that the inventory problem came first: teams could not secure what they had not identified. That matters to identity programmes because connected assets behave like non-human endpoints whose ownership, behaviour, and access relationships must be understood before controls can be made reliable.

Key questions

Q: What breaks when unmanaged devices are not visible on the network?

A: When unmanaged devices are not visible, teams lose the ability to classify assets, enforce segmentation, and spot suspicious changes. That creates blind spots in risk assessment and leaves security controls dependent on assumptions instead of observed behaviour. In mixed IT, OT, and IoT estates, invisibility quickly becomes a governance failure, not just an operational inconvenience.

Q: Why does device intelligence matter more than simple discovery?

A: Discovery only proves that something is connected. Device intelligence explains what the asset is doing, how it communicates, and whether its behaviour matches its expected role. That extra context is what makes policy defensible, especially where different device classes have very different trust and exposure profiles.

Q: What are the signs that network visibility is failing in a mixed environment?

A: Common signs include partial inventories, devices that cannot be categorised, unexpected communication paths, and policy rules that rely on exceptions more than evidence. If segmentation reviews keep uncovering unknown assets or unexplained traffic, the visibility layer is not giving security teams a reliable operating picture.

Q: How should teams govern connected devices across IT, OT, and IoT?

A: Teams should treat connected devices as governed assets with lifecycle ownership, behavioural classification, and defined network boundaries. The practical model is to combine passive discovery with device intelligence so access, segmentation, and exception handling are based on how assets actually behave rather than where they were first seen.

Technical breakdown

Why agent-based inventory misses unmanaged devices

Agent-based discovery assumes devices can run software, enroll in management, and report their state. That model works for managed endpoints but breaks in environments with IoT, OT, and medical devices that cannot host agents or were never built for conventional endpoint tooling. Passive monitoring and network telemetry fill that gap by observing communications rather than relying on installed software. The result is a more complete asset picture, but one that must still be interpreted carefully because traffic alone does not prove identity, role, or trust level.

Practical implication: build discovery around network observation for unmanaged classes of devices, not around endpoint enrollment alone.

What device intelligence adds beyond simple visibility

Visibility tells you that an asset exists. Device intelligence adds classification and behavioural context, which is what turns an IP address into a governable asset. By analysing protocols, communication patterns, and changes over time, teams can distinguish a pump from a phone, a PLC from a camera, or a legitimate device from something anomalous. This is especially important in mixed environments where the same address space can hide radically different risk profiles. Without behavioural context, policy becomes guesswork.

Practical implication: classify devices by observed behaviour and communications before assigning segmentation or access policy.

How visibility supports segmentation and policy enforcement

Segmentation depends on knowing which devices belong together, which systems they speak to, and which relationships are normal. Once teams can map connected assets and their interactions, they can define policy around actual traffic patterns instead of assumptions baked into static asset registers. That reduces the chance of overbroad trust zones and improves detection of unexpected changes. In effect, visibility is not an end state but the prerequisite for enforcing meaningful boundaries across the network.

Practical implication: use observed device relationships as the baseline for segmentation rules and drift detection.

Threat narrative

Attacker objective: The objective is to exploit blind spots in unmanaged device estates so risky assets remain unsegmented, unmonitored, and available for abuse.

1. Entry occurs when unmanaged or undocumented devices are connected faster than inventory processes can identify them.
2. Escalation follows when security teams rely on incomplete maps and therefore cannot isolate risky assets or enforce accurate policy.
3. Impact is a persistent visibility gap that leaves connected assets ungoverned, misclassified, or exposed to lateral risk.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Device visibility is now a governance prerequisite, not an operational nice-to-have. Once environments include unmanaged IoT, OT, and medical assets, inventory quality directly affects control quality. If the asset register is incomplete, segmentation, monitoring, and risk scoring all inherit that weakness. Practitioners should treat discovery as the control foundation, not as a reporting exercise.

Device intelligence closes the gap between discovery and decision-making. Knowing that a device exists is not enough when different device types have different trust assumptions, communication patterns, and risk profiles. Behavioural classification lets security teams move from naming assets to governing them. The practitioner takeaway is to base policy on observed function and communication, not on assumed asset type.

Connected assets increasingly behave like non-human identities that must be governed explicitly. Many devices communicate with persistent credentials, trusted relationships, or embedded access paths, which means identity thinking belongs in network visibility programmes. This is where NHI governance intersects with OT and IoT security: if the device cannot be reliably identified, its access cannot be reliably controlled. Teams should align asset discovery with non-human identity oversight.

Visible networks create measurable trust zones, while invisible networks create unmanaged risk pockets. The article shows that the real security shift is from hoping inventories are accurate to proving which communications are normal. That is the basis for scalable segmentation, anomaly detection, and policy enforcement. Practitioners should use visibility as the condition for trust, not the substitute for it.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide

What this signals

Device visibility debt: when security teams cannot observe unmanaged assets, every downstream control inherits uncertainty. The programme response is to treat passive discovery and behavioural classification as core governance functions, not optional tooling enhancements.

NHI programmes should pay attention to this pattern because connected devices often carry persistent trust relationships that resemble machine identities more than traditional endpoints. That makes inventory quality a direct input to access governance, segmentation design, and exception management.

For practitioners

• Implement passive asset discovery Use network telemetry and passive monitoring to identify devices that cannot support agents or enrollment, then maintain that inventory as the source of truth for unmanaged assets.
• Classify devices by observed behaviour Group assets by communications, protocols, and recurring patterns so a device’s role and risk are determined from evidence rather than manual naming conventions.
• Build segmentation from observed relationships Derive trust zones from device-to-device interactions and update them when traffic patterns change, rather than relying on static network diagrams.
• Track unmanaged devices as governable assets Create an ownership and review process for IoT, OT, and medical devices so discovery results feed policy, exception handling, and risk acceptance decisions.

Key takeaways

• Traditional inventory tools fail when devices cannot be enrolled, which leaves IoT, OT, and medical assets outside normal governance.
• Device intelligence adds behavioural context that turns discovery into usable security decision-making.
• Visibility is the prerequisite for segmentation and policy enforcement, not a substitute for them.

Key terms

• Passive Asset Discovery: A method of identifying devices by observing network traffic rather than actively scanning hosts. It can surface systems that are communicating on the network, including devices that may have bypassed normal onboarding. This makes it useful for spotting foreign systems and validating inventory records.
• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
• Network Visibility: Network visibility is the ability to see and understand activity across connections, workloads, applications, and databases in context. It goes beyond collecting logs or packets by showing how traffic and access patterns relate to each other, so teams can distinguish normal behavior from suspicious movement and respond with precision.
• Behavioural Classification: A method of deciding whether an automated actor is allowed to perform an action by evaluating patterns of use, not just the presence of automation. It uses sequencing, consistency, and business correlation to separate approved workflows from suspicious activity.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity control to the broader security programmes that depend on accurate asset and access visibility.