Forescout's 47,700-segment census finds OT isolated in 13% of the segments that carry it
The Sept. 22 study of 2.5 million devices in 209 organizations found cameras alone in 51 of 2,266 camera segments, and Black Hills Information Security's John Strand says the true isolation rate is lower.
The Watch · Security desk
What happened
- Forescout Research released a study on Sept. 22 covering 47,700 network segments, more than 2.5 million devices and 209 organizations, sorting each device as IT, OT, IoT or medical.
- Of the segments holding at least one OT device, 13% held OT alone, and only 6% of segments with medical devices were dedicated to those devices.
- Nearly half of the segments containing OT or medical devices also carried IT and IoT assets in the same segment.
- IP cameras appeared in 2,266 segments and only 51 of those held cameras alone; Forescout says cameras typically share a segment with workstations and servers.
- Forescout says the path has been used in anger: the Akira ransomware group worked through poorly segmented IP cameras in early 2025 to get around endpoint detection.
Why it matters
- Who's exposed exposure In 87% of OT-bearing segments, an intruder who lands on an IT or IoT device is already inside the OT broadcast domain, so incident scoping has to start wider than the network diagram suggests.
- Who has to decide decision The control that survives this census is a rehearsed disconnect, and Strand's version requires someone below the CTO to hold the authority to cut OT from external networks mid-incident.
- What it limits constraint Forescout's remedy list stays inside inventory, convergence-zone triage and inter-segment access policy. The work lands on operations budgets, not on a network rebuild.
- What doesn't add up contradiction Strand rates the 13% as high based on years of offensive testing, which makes this census the optimistic reading of how much isolation actually exists.
Next story · Security · Oct 5
ClingSTUN backdoor turns vulnerable Linux devices into proxies that check in through public STUN serversConfirmed3 publishers
Subtract the 51 exclusive camera segments and 2,215 remain where a camera shares its broadcast domain with something else [14]. Forescout puts the average segment at 54 devices [10]. Owning the camera in an average segment puts an attacker one hop from 53 other devices [25]. The average device in the dataset belongs to 1.5 segments, not one [11].
At the top level the picture looks tidy. Sixty-two percent of segments held a single device category, 29% held two and 9% held three or more [8]. IT alone accounts for 54% of all segments, and IT paired with IoT another 26% [9]. So IT-only segments make up 54 of those 62 points, about seven in eight of the single-category segments [26]. Eleven percent of segments held more than 51 devices, and 17% were single-device micro-segments [12].
Forescout found the largest average blast radius in business and professional services, healthcare, and oil and gas, with utilities, financial services and retail at the low end [16]. The retail average hides the point-of-sale case. Ninety-five of 478 segments containing POS systems were POS-only, leaving 383 that most often shared space with printers, VoIP equipment or IP cameras [17][27].
John Gallagher, vice president at Viakoo, tied the pattern to who owns the gear. "OT and IoT systems have often been managed and maintained by the line-of-business such as manufacturing, facilities, or physical security, and lack IT-level hygiene around network management and cybersecurity," Gallagher said [24].
John Strand, owner at Black Hills Information Security, said his testers rarely find the isolation clients describe. "We've been doing offensive security testing for years, and the vast majority of the time when an organization says a network is air-gapped, it really isn't," Strand said. "The only places where we consistently see truly air-gapped networks are classified environments and classified security assessments" [22]. He put the workable control elsewhere: "What's realistic is having a documented plan to rapidly disconnect OT systems from external networks during an incident. Organizations need to know exactly how that happens and who has the authority to make that call. That authority cannot be limited to waiting for the CTO or CEO" [23].
The exploitation record in the report comes from outside the census. "By 2026, we routinely see hacktivist groups gaining control over exposed IP cameras in targeted organizations," the report said, counting more than 300 instances this year, including operations by the pro-Russian group NoName057(16) against Estonian and Canadian targets in late August and early September [19][20].
What the study measures is which device categories sit in the same segment, plus industry averages for blast radius; it does not report a traversal test inside the 209 organizations [15]. Forescout's own framing of the consequence is short: "Flat networks allow breaches to spread to critical systems that should not be reachable" [13].
What to watch
- Whether Forescout releases the per-industry segment data behind the blast-radius ranking, so healthcare and oil and gas operators can compare their own estates.
- Whether the 300-plus camera takeovers tracked this year produce a documented intrusion that moved past the camera segment.
- Whether the 6% IoMT-only figure draws regulator or payer attention in healthcare, which Forescout ranks near the top for average blast radius.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption58
- Hype gap+8
- Incentives76
- Confidence70
Perspective Coverage
3 publishers- Builder
- Builder 18%
- Operator
- Operator 74%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A study released Sept. 22 by Forescout Research (Vedere Labs) analyzed 47,700 network segments holding more than 2.5 million devices across 209 organizations.
- [2]
The report is titled "What 47,700 Segments Reveal About Network Segmentation".
- [3]
Researchers sorted each device into one of four categories: IT, OT, IoT, or medical (IoMT).
- [4]
IP cameras were the least isolated device type in the dataset: cameras appeared in 2,266 segments, roughly 5% of the total, and only 51 of those, about 2%, contained cameras exclusively.
- [5]
Cameras typically share a segment with workstations and servers, meaning a single compromised device could provide a pathway into the corporate network.
- [6]
Forescout's recommendations focus on visibility and containment rather than a network redesign: full inventory of connected assets, flagging device convergence zones, moving critical OT and IoMT systems off general IT networks, breaking up oversized segments, policy-based access controls between segments, asset intelligence to validate decisions, and continuous monitoring for segmentation drift.
- [7]
Nearly half of the segments with OT or IoMT devices also contain IT and IoT assets, widening the attack surface and opening the door to lateral movement.
- [8]
62% of segments contained devices from a single category, 29% contained two, and 9% had three or more.
- [9]
The most common setups were IT devices alone (54% of segments) or IT paired with IoT gear (26%).
- [10]
The average segment in the dataset held 54 devices.
- [11]
The average device belonged to 1.5 segments rather than one.
- [12]
Roughly 11% of segments exceeded 51 devices, while 17% were single-device micro-segments.
- [13]
"Flat networks allow breaches to spread to critical systems that should not be reachable," Forescout warned.
- [14]
2,215 of the camera-bearing segments contained a camera plus at least one other device.
- [15]
The published accounts of the study describe per-segment device-category composition, industry blast-radius averages and remediation advice; they do not describe a reachability or traversal test inside the 209 organizations.
- [16]
Forescout found the largest average blast radius in business and professional services, healthcare, and oil and gas, with utilities, financial services, and retail on the low end.
- [17]
In retail, only 95 of 478 segments containing point-of-sale systems, about 20%, were dedicated to POS alone; the rest most often shared space with printers, VoIP equipment or IP cameras.
- [18]
Forescout has previously demonstrated how poorly segmented IP cameras could be used by ransomware gangs; the Akira group used the technique to bypass EDR in early 2025.
- [19]
"By 2026, we routinely see hacktivist groups gaining control over exposed IP cameras in targeted organizations," the Forescout report noted.
- [20]
Forescout tracked over 300 instances of hacktivist camera control this year, including examples carried out by the pro-Russian group NoName057(16) in late August and early September against Estonian and Canadian targets.
- [21]
John Strand, owner at Black Hills Information Security, said the 13% number actually seems a bit high.
- [22]
"We've been doing offensive security testing for years, and the vast majority of the time when an organization says a network is air-gapped, it really isn't. The only places where we consistently see truly air-gapped networks are classified environments and classified security assessments."
- [23]
"What's realistic is having a documented plan to rapidly disconnect OT systems from external networks during an incident. Organizations need to know exactly how that happens and who has the authority to make that call. That authority cannot be limited to waiting for the CTO or CEO."
- [24]
"OT and IoT systems have often been managed and maintained by the line-of-business such as manufacturing, facilities, or physical security, and lack IT-level hygiene around network management and cybersecurity."
- [25]
In a segment of average size, a compromised device sits one hop from 53 others.
- [26]
IT-only segments account for about seven in eight of the single-category segments.
- [27]
383 of the retail segments containing point-of-sale systems also held other device types.
- [28]
Of all segments that included at least one OT device, only 13% consisted of OT devices alone; the rest shared space with IT or IoT equipment.
- [29]
Only 6% of segments containing medical devices were dedicated solely to IoMT.
- [30]
87% of segments containing an OT device also contain IT or IoT equipment.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comNetwork Segmentation Failures Are Expanding the Corporate Attack Surface
1 article · September 22, 2026
- scworld.comJust 13% of network segments are OT-only, says Forescout Research
1 article · September 22, 2026
- securityweek.comOnly 13% of OT Network Segments Are Fully Isolated: Analysis
1 article · September 22, 2026
Topics and entities
Topics
- Lateral Movement
- Network Segmentation
- Medical Device Security
- IP camera security
- OT Security