Ask a business owner how many computers they have and they'll count laptops and servers. They're usually off by double. The printers, cameras, door controllers and meeting-room screens are computers too — and they're the ones nobody patches, nobody monitors, and attackers love most.
In one widely reported case, attackers reached a casino's high-roller database through an internet-connected thermometer in the lobby aquarium. It sounds like a joke, and it's actually the modern playbook: don't attack the systems the business protects — attack the ones it forgot were computers at all. The Mirai botnet, which knocked major websites offline, was built almost entirely from compromised security cameras and home routers still running their factory passwords. Your office is full of this category of device, and most of it was set up by whoever installed it, on whatever settings it shipped with, and never touched again.
Are printers and CCTV cameras really a security risk for a business?
Yes. Printers, cameras, door controllers and other IoT devices are computers in their own right, yet they rarely get patched or watched and often share a network with your files, which makes them one of the weakest points in a business's attack surface. That's why Key IT gives IoT device security the same attention as laptops for the Melbourne businesses it looks after. To find them in your office, take the tour your attacker would take — walk around and count the things with a network cable or a Wi-Fi connection that aren't someone's computer:
Printers and multifunction copiers
They run a full operating system, store copies of scanned documents, hold email credentials for scan-to-email, and are famously left on default admin passwords.
CCTV cameras and recorders
Internet-reachable by design (that's how the app on your phone works), and a favourite way in when they're old, unpatched or still set to admin/admin.
Door controllers and alarm panels
The physical security system is itself a networked computer; a compromised one is both a cyber problem and an unlocked door.
Meeting-room screens, smart TVs, video-conference gear
Network-connected, rarely updated, and often sitting on the same network as your file server.
The long tail
HVAC controllers, time-clock terminals, label printers, that "temporary" 4G router someone installed in 2023, and even the firewall itself, whose VPN was the way in for the Akira ransomware campaign.
None of these will ever appear in a laptop count. Every one of them has an IP address, which makes every one of them a possible way in — or a place to hide once in. Your website belongs on the same list, even though it's usually hosted somewhere else: ASD warned twice in 2026 that small business websites in Australia are being hacked through outdated plugins. A WordPress site with no clear owner is the same forgotten computer, just sitting on the internet around the clock.
Why do hackers target printers and security cameras?
Because they're usually the easiest computers on your network to get into and the least likely to be watched. The economics are beautiful, from the attacker's side. A laptop gets security updates monthly, runs endpoint protection, and its user might notice something odd. A camera or printer gets none of that: firmware nobody has ever updated, a password printed in the manual that's on Google, no security software (none can be installed), and no human watching its behaviour. Best of all, these devices are switched on at 3am and nobody finds their network traffic suspicious — a camera talks to the internet constantly by design. For an attacker, a forgotten device is a free foothold: a place to get in, and a quiet place to stay while they map everything else. And because the hunting is automated — bots sweep the internet around the clock for exposed camera and printer login pages — being "too small to be a target" offers no protection at all.
How do you find every forgotten device on your network?
Ask "what has an IP address?" and answer it with a network scan, not memory — a walk-through finds what you can see; a scan finds what's actually connected. This is where the fix starts, and it's the same discipline we wrote about in our early-intel post: you can't defend what you haven't counted. Our vulnerability scanning deliberately covers any device with an IP address — not just servers and workstations — precisely because this is where the surprises live. It's common for a first scan to turn up devices the business didn't know were on the network at all, still wearing default credentials, running firmware years out of date, or reachable from the internet when they never needed to be. For door controllers, camera recorders and anything facing the internet, a penetration test goes a step further and checks whether someone could actually get in.
How do you secure IoT devices in a small business?
In five moves, in this order: inventory every device, kill default passwords, update or isolate old firmware, segment the network, and watch for odd behaviour. Most of it is housekeeping; network segmentation is the step that limits the damage when something else fails.
1. Inventory
Get the full list of everything with an IP address. A scan does this in hours; guessing does it never.
2. Kill default passwords
Every device gets a unique, strong admin password — the manual's password is public information.
3. Update or isolate
Firmware current where the vendor still ships updates; where a device is too old to update, it gets fenced off, not forgiven.
4. Segment the network
Cameras, printers and building systems belong on their own network zone (usually a separate VLAN, with firewall rules that allow only the traffic they need), so a compromised camera can see other cameras — not your file server. This is the single highest-value change for most offices. When we handle a business network setup in Melbourne, staff, guest and device traffic go on separate networks from day one.
5. Watch the odd ones out
A 24/7 SOC watches for the tell-tale behaviour — a printer suddenly talking to an overseas server is not printing.
Why we're unusually opinionated about this
Key IT sits on both sides of this problem, which is rare. We run managed cybersecurity — and we also design and install CCTV, access control and alarm systems ourselves. That means the cameras and door controllers we install are treated as what they are: computers, deployed with proper credentials, current firmware, sensible network placement and ongoing support — not bolted on by a security installer who considers the network someone else's problem. One team accountable for the physical and digital layers means nobody gets to say "not my department" about the device that let the attacker in.
Frequently asked questions
Our cameras were installed years ago by another company. Are they a risk?
Quite possibly — age, default credentials and abandoned firmware are the classic combination. We can assess what's installed, secure what's worth keeping, and tell you honestly what should be replaced.
Can you secure devices you didn't install?
Yes. Inventory, credential changes, firmware updates, segmentation and monitoring apply to any device on your network, whoever supplied it.
Does your vulnerability scanning actually cover printers and cameras?
Yes — anything with an IP address is in scope. Finding forgotten devices is one of the most common outcomes of a first scan.
What counts as an IoT device in a business?
Any network-connected device that isn't a staff computer, phone or server: printers and copiers, CCTV cameras and recorders, door controllers, alarm panels, smart TVs, video-conference gear, HVAC controllers and time clocks. If it has an IP address, it belongs on your security inventory.
Can a hacked printer or camera lead to ransomware?
Yes, it can be the first step. A compromised printer or camera gives an attacker a quiet foothold to map your network and collect saved logins (a printer's scan-to-email account is a handy prize) before moving on to your servers. Our guide to what happens during a ransomware attack covers the rest.
Doesn't Australia's new smart device law fix default passwords?
Only partly. Australia's smart device security standard, in force since 4 March 2026, bans universal default passwords on most new consumer-grade smart devices and makes manufacturers publish how long each one will get security updates. It doesn't cover gear made only for business use, and it changes nothing for the cameras and printers already on your network.
Is network segmentation disruptive to set up?
Done properly, no — it's planned and rolled out with minimal interruption, and day-to-day nobody notices except the attacker who now can't reach anything from a compromised camera.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review