Nearly half of network segments with OT or medical devices (IoMT) also contain IT and IoT, broadening the attack surface and raising the risk of lateral movement, according to Forescout.
The security vendor analyzed 47,700 real-world network segments across organizations across multiple industries to compile its latest report, What 47,700 Segments Reveal About Network Segmentation.
The report claimed that the average segment holds 54 devices across four device types: IT, OT, IoT, and IoMT. Although over three-fifths (62%) contained just one device category, 29% contained two and nearly one in 10 (9%) had three or more.
A quarter (26%) contained IT and IoT, while only 13% of segments with OT devices in them were OT only, and only 6% of IoMT segments were IoMT only.
Read more on network segmentation: Micro-Segmentation Used by 83% of Cybersecurity Leaders
Half of the device types most commonly found in mixed segments rank among 2026’s riskiest devices, Forescout claimed. Only 2% of segments with IP cameras contained just those devices, for example.
Cameras typically share a segment with workstations and servers, the report revealed, meaning a single compromised device could provide a pathway into the corporate network.
This is not a theoretical threat. Forescout has previously demonstrated how poorly segmented IP cameras could be used by ransomware gangs; something that happened in early 2025 after the Akira group used the technique to bypass EDR.
“By 2026, we routinely see hacktivist groups gaining control over exposed IP cameras in targeted organizations,” the report noted. “We tracked over 300 instances this year, including these examples carried out by the pro-Russian group, NoName057(16), in late August and early September against Estonian and Canadian targets.”
Getting Segmentation Right
To get things back on track, Forescout urged security teams to:
- Establish and maintain continuous visibility of all connected assets, with an accurate inventory and insight into what is connected to the network, where devices are located, and how they communicate
- Identify and prioritize “device convergence zones,” starting with segments that contain multiple device categories with risky combinations
- Separate critical operational assets from enterprise IT networks
- Reduce oversized network segments with dozens of devices and break them down into smaller, purpose-built segments
- Implement policy-based access controls between segments, so devices only communicate with the systems required for their function
- Use asset intelligence on device types, roles and behaviors to validate segmentation decisions
- Continuously monitor for segmentation drift, because networks change over time as new devices are added and business requirements evolve
“Flat networks allow breaches to spread to critical systems that should not be reachable,” Forescout warned. “When diverse device types are grouped together without appropriate segmentation, compromising a single asset can have consequences far beyond its original scope.”
