Notifications
Clear all
Topic starter
11/07/2026 2:02 pm
TL;DR: IoT devices are expanding enterprise attack surfaces as an estimated 30 billion devices are expected to connect to businesses within five years, while roughly 25% of enterprise attacks already involve IoT devices, according to SentinelOne. Hidden devices, weak standards, and manual discovery make visibility and policy enforcement a governance issue, not just an endpoint problem.
NHIMG editorial — based on content published by SentinelOne: IoT attack surface visibility and control for connected devices
By the numbers:
- Roughly 25% of attacks on enterprises involve IoT devices.
Questions worth separating out
Q: How should security teams handle hidden IoT devices on enterprise networks?
A: Security teams should treat hidden IoT devices as unmanaged access paths until proven otherwise.
Q: Why do IoT devices create such a persistent attack surface risk?
A: IoT devices create persistent risk because they are often added outside normal IT controls, rarely standardised, and hard to monitor at scale.
Q: How do organisations know if IoT attack surface reduction is actually working?
A: It is working when discovery is current, unowned devices are rare, and unknown assets are quickly isolated rather than left on trusted networks.
Practitioner guidance
- Implement continuous device discovery Use passive and active discovery to identify IoT and connected devices as they appear, then maintain a live inventory that flags unmanaged assets for review.
- Assign every device an accountable owner Require a business owner, function, and risk classification for each connected device before it is granted persistent network trust.
- Enforce segmentation for untrusted endpoints Place unknown or low-confidence devices into restricted network zones with minimal access to core systems.
What's in the full article
SentinelOne's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor's AI-assisted network discovery approach fingerprints and classifies connected devices in mixed environments.
- The practical workflow for assigning ownership, identifying vulnerable devices, and deciding when to isolate an endpoint.
- How continuous monitoring is positioned against compliance-only scanning in enterprise attack surface programmes.
- Why the article argues that modern security teams need a response model for rogue IoT behaviour, not just inventory reporting.
👉 Read SentinelOne's analysis of IoT attack surface reduction and continuous visibility →
IoT attack surface management: what IAM teams should watch?
Explore further
11/07/2026 2:11 pm
IoT sprawl is an identity and governance problem as much as a device problem. The article correctly frames the risk as hidden endpoints, but the deeper issue is that every connected device creates an access relationship that must be owned, classified, and governed. Without ownership and policy boundaries, device presence becomes an implicit trust signal. Practitioners should treat IoT onboarding and trust assignment as part of identity governance, not an afterthought.
A question worth separating out:
Q: Who is accountable when a connected device becomes an entry point for attackers?
A: Accountability should sit with both the business owner of the device and the security team responsible for network enforcement. If a device can connect without review, no one truly owns the risk. Clear accountability means the organisation can isolate, investigate, and retire the device without delay or ambiguity.
👉 Read our full editorial: IoT attack surface visibility is now a governance problem
