Poor Network Segmentation Leaves OT and Medical Devices Vulnerable

Most organisations running operational technology (OT) or connected medical devices do not keep those systems on dedicated network segments, according to research from Forescout’s Vedere Labs.

The study examined 47,700 network segments containing more than 2.5 million devices across 209 organisations. The findings indicate that critical industrial and medical systems frequently share network space with standard IT or Internet of Things (IoT) equipment, increasing the risk of lateral movement during a cyberattack.

Critical Isolation Gaps in OT and IoMT

Of all segments containing at least one OT device, only 13% were composed exclusively of OT equipment. The remaining segments shared space with IT or IoT devices.

The lack of isolation was even more pronounced for medical devices, known as the Internet of Medical Things (IoMT). Only 6% of segments containing medical devices were dedicated solely to IoMT, leaving the vast majority of medical equipment connected to broader enterprise networks.

IP cameras were identified as the least isolated device type in the dataset. While they appeared in approximately 5% of all segments, only about 2% of those segments contained cameras exclusively.

Sector-Specific Risks and Blast Radius

The research highlighted that the average segment held 54 devices across different categories, and the average device belonged to 1.5 segments. This interconnectedness increases the potential “blast radius” if a single device is compromised.

The largest average blast radii were found in the healthcare, oil and gas, and business and professional services sectors. In retail environments, the risk is also notable; only 20% of segments containing point-of-sale (POS) systems were dedicated to POS alone, with most sharing space with printers, VoIP equipment, or IP cameras.

Recommended Containment Strategies

To mitigate these risks, researchers suggest prioritising visibility and containment over immediate, large-scale network redesigns. Recommended security measures include:

• Developing a complete inventory of all connected devices.
• Flagging segments where high-risk device types converge.
• Moving critical OT and IoMT systems off general IT networks.
• Breaking up oversized segments to limit exposure.
• Restricting unnecessary traffic between different network segments.