Forescout’s Vedere Labs conducted a large-scale analysis of 47,700 network segments across 209 organizations, categorizing devices into IT, OT, IoT, and medical (IoMT). While 62% of segments contained devices from a single category, only 13% of segments with OT devices were exclusively OT, and only 6% of segments with medical devices were exclusively medical. Many OT and medical devices share network segments with IT and IoT devices, increasing potential exposure. The average segment contained 54 devices spanning four device types, and devices often belonged to multiple segments. The research identified industries with larger average blast radii, such as business services, healthcare, and oil and gas. Forescout recommends improving device inventory, identifying risky segment overlaps, isolating critical OT and IoMT systems, breaking up large segments, and restricting unnecessary inter-segment traffic.

The shared network segments between OT, medical, IT, and IoT devices increase the attack surface and potential for lateral movement within networks, potentially exposing critical operational and medical systems to threats originating from less secure IT or IoT devices. This segmentation weakness could facilitate compromise propagation and increase the blast radius of cyberattacks in affected industries, particularly in healthcare, business services, and oil and gas sectors.

Forescout recommends organizations build comprehensive inventories of connected devices, identify and flag network segments where risky device types converge, move critical OT and medical devices off general IT networks to dedicated segments, break up oversized network segments, and restrict unnecessary traffic between segments. These measures focus on improving visibility and containment rather than requiring full network redesigns. No official patch or fix applies as this is a network architecture and segmentation issue.