Armis Security just dropped a report saying 80% of organizations have at least one unmanaged IoT device on their network, creating a massive blind spot for security. Beyond corporate espionage, the infamous “fridge attack” scenario became a stark reminder years ago that even a simple appliance can be weaponized. The question now is just how deep the vulnerabilities run in all our connected environments.
Key Takeaways
- With over 80% of companies running unmanaged IoT devices, you have to run a full inventory and risk assessment.
- The 2013 “fridge attack” proved smart appliances can be used for attacks, which shows why strong network segmentation is non-negotiable.
- Outdated firmware on IoT devices is a huge attack vector because manufacturers often stop providing security updates.
- Default credentials are still a massive security hole, showing the urgent need for strong password policies on every connected device.
- Merging operational technology (OT) and IT networks without the right security protocols creates major vulnerabilities in critical infrastructure.
The Unseen Majority: 80% Unmanaged IoT Devices
That 80% statistic from Armis on unmanaged IoT devices is a flashing red light for anyone in cybersecurity. An unmanaged device is one your IT department doesn’t inventory, monitor, or secure. We’re talking about the smart thermostats in the office, the connected coffee makers in the break room, even the smart TVs in conference rooms. These things often get a pass on normal security because they’re seen as harmless consumer junk, not actual enterprise assets.
My own work on enterprise networks confirms this every day. Companies will have perfect visibility into their servers and workstations. But when you ask them about the smart lighting system in their new building or the networked security cameras, you get blank stares. Because nobody’s watching, these devices rarely get patched, their default passwords stay put, and their network traffic is a total mystery. They’re the perfect back door for an attacker. It’s a complete failure of basic asset management and sets the stage for the next “fridge attack.”
The 2013 “Fridge Attack”: A Prophetic Warning
Back in 2013, we got proof of concept that a smart refrigerator could be part of a botnet sending spam emails. This wasn’t some sophisticated state-sponsored hack. It was a simple exploit hitting a consumer device with garbage security. The incident, which Proofpoint reported, involved a compromised fridge and other home appliances, but the real takeaway was that any internet-connected device can be hijacked for attacks. It showed that DDoS attacks or spam campaigns could come from anywhere, making them much harder to trace and stop. The attack surface isn’t just your laptops and servers anymore. It’s everything with an IP address.
A lot of people at the time just shrugged. “Who cares if a fridge sends spam?” But that completely misses the point. The *mechanism* of compromise is the real threat here. The ability to remotely control that device could be used today to launch ransomware, exfiltrate data, or pivot into more sensitive parts of the network. What we learned is that a device’s function has nothing to do with its security importance. A vulnerable smart lightbulb can be just as big a threat as an unpatched server if it gives an attacker a foothold.
Outdated Firmware: A Persistent Vulnerability
The Department of Homeland Security’s CISA consistently lists unpatched vulnerabilities in IoT devices as a top concern for critical infrastructure. This is a direct result of how manufacturers just neglect firmware updates. Unlike your phone or laptop that gets regular patches, many smart devices are sold with “fire and forget” firmware. Once they’re in the field, they almost never get an update to fix new vulnerabilities, which creates a critical vulnerability just waiting to be found.
Think about a smart security camera system you installed three years ago. It might have been secure when you bought it, but without updates, it’s a sitting duck for any exploit discovered since then. Attackers don’t need fancy zero-days when they can just scan for devices running five-year-old code on network-connected door locks or HVAC systems. This issue is acute in industrial IoT (IIoT) environments, where hardware might run for a decade or more, long after the manufacturer stops caring about security support. Industry standards must mandate long-term security support for all connected devices.
Default Credentials: The Open Door Policy
A 2024 report by Forescout Technologies found that over 60% of IoT devices still use default or easily guessable credentials when they’re deployed. This is a wide-open invitation for compromise. The Mirai botnet, which took down big chunks of the internet in 2016, worked by exploiting this exact problem by scanning for devices with default usernames and passwords. That was almost a decade ago, and the problem is still here.
This one drives me crazy because it’s so easy to fix. Change the default password. It’s basic security hygiene, yet it’s ignored constantly. Installers want to get in and out quickly, so they leave “admin/admin” or “root/password” on the device. The end-users often don’t even know they can change it. This is a systemic failure across the entire supply chain, from manufacturers shipping devices with well-known defaults to the integrators who just plug them in and walk away. Every connected device, from a lightbulb to a network-attached storage unit, must have its default credentials changed immediately upon installation. No exceptions.
OT/IT Convergence: Blurring the Lines, Multiplying Risks
The convergence of Operational Technology (OT) and Information Technology (IT) networks is accelerating, bringing a whole new class of security challenges. According to a 2025 Deloitte study, 75% of critical infrastructure organizations have already partially or fully integrated their OT and IT networks. This integration offers efficiency gains but also means a vulnerability in a factory floor sensor could now provide a path into the corporate network, and vice-versa. The air gap, once a key security control for OT systems, is disappearing.
My primary disagreement with conventional wisdom is the continued belief that you can manage OT security with standard IT tools and frameworks. It doesn’t work. OT systems have totally different priorities (they value availability and safety over confidentiality), often run on proprietary protocols, and have patch cycles that are nothing like IT’s, you can’t just reboot a factory control system in the middle of a production run. Treating OT security as ‘IT security with a different label’ is a dangerous oversimplification that exposes critical infrastructure to unacceptable risks. Specialized OT security solutions and dedicated expertise are essential to manage this convergence.
The ‘fridge attack’ and all the IoT hacks since have taught us one thing: every connected device is a potential way in. Organizations need a complete, proactive strategy for smart device security, which means starting with a detailed asset inventory and rigorous vulnerability management. Ignoring these devices is not an option.
What is a “fridge attack” in cybersecurity?
It’s when a compromised smart appliance, like a refrigerator, is used in a botnet to send spam or launch a DDoS attack. The term comes from a real-world proof-of-concept incident back in 2013 that showed how even simple connected devices could be weaponized.
Why are unmanaged IoT devices a significant cybersecurity risk?
They’re a huge risk because your IT department doesn’t know they exist. That means they aren’t monitored or secured, leaving them with old vulnerabilities and default passwords, an easy target for attackers looking for a way into your network.
How can organizations mitigate the risks of outdated firmware on smart devices?
You need a solid patch management program just for IoT gear. That means regularly checking manufacturer websites for updates, and if a device can’t be patched, you have to wall it off on a segmented network. It also helps to buy from manufacturers who actually have a strong track record for security support.
What is the primary danger of default credentials on IoT devices?
The primary danger is that default credentials are public knowledge and easily found by automated attack tools. Botnets can scan for them, gain instant access, and take control of the device to use it as a launchpad for more attacks inside your network, usually without anyone knowing.
How does OT/IT convergence impact cybersecurity for smart devices?
OT/IT convergence blurs the old lines between industrial control systems and corporate networks. This means a vulnerability in a smart device on the factory floor can directly threaten IT systems, and a compromised email account could potentially affect critical operations, dramatically expanding the attack surface.
