NEARLY half of network segments containing operational technology (OT) or medical devices (IoMT) also include IT and internet of things (IoT) equipment, potentially widening organisations’ attack surfaces and enabling lateral movement, according to security vendor Forescout. Its report, *What 47,700 Segments Reveal About Network Segmentation*, analysed real-world network segments across multiple industries. The average segment contained 54 devices spanning four categories.
While 62% contained only one device category, 29% contained two and 9% contained three or more. Only 13% of segments containing OT devices were OT-only, while just 6% of IoMT segments were limited to IoMT devices.
Forescout said IP cameras commonly share segments with workstations and servers, creating a possible route into corporate networks if one device is compromised. It cited previous demonstrations involving poorly segmented cameras and said more than 300 incidents involving exposed IP cameras had been tracked in 2026, including attacks by the pro-Russian hacktivist group NoName057(16) against targets in Estonia and Canada in late August and early September.
The report also referred to an early-2025 incident in which the Akira group used the technique to bypass endpoint detection and response (EDR), although the supplied material does not establish that all such incidents involved confirmed network compromise.
Forescout recommends maintaining continuous visibility of connected assets, identifying high-risk “device convergence zones”, separating critical operational systems from enterprise IT, reducing oversized segments, applying policy-based access controls and monitoring for segmentation drift as networks change.