Only 13% of OT Network Segments Are Fully Isolated, According to Forescout Research

Limited Isolation of OT and IoMT Networks

A study by Forescout's Vedere Labs found that most organizations do not isolate their operational technology (OT) or connected medical devices (IoMT) on dedicated network segments. The research, which analyzed 47,700 network segments and over 2.5 million devices across 209 organizations, revealed that only 13% of segments with OT devices were exclusively OT. For medical devices, this figure dropped to just 6%.

Shared Networks Increase Risk

The majority of OT and IoMT segments share space with IT or IoT equipment, increasing potential attack vectors. IP cameras were identified as the least isolated device type, appearing in 5% of total segments, with only 2% of those being exclusively for cameras. The average network segment contained 54 devices of four different types, indicating complex and interconnected environments.

Industry-Specific Vulnerabilities

The largest average 'blast radius' for potential cyberattacks was observed in business and professional services, healthcare, and oil and gas sectors. Even in industries with lower overall averages, specific high-value systems remain vulnerable. For instance, in retail, only 20% of point-of-sale (POS) segments were dedicated solely to POS systems, with the rest often sharing networks with printers, VoIP equipment, or IP cameras.

Recommendations for Improved Security

Forescout recommends focusing on improved visibility and containment rather than complete network redesigns. Key recommendations include creating a comprehensive inventory of connected devices, identifying segments where risky device types converge, migrating critical OT and IoMT systems off general IT networks, breaking down oversized segments, and restricting unnecessary traffic between segments.