For our 30th episode, we're tackling the cybersecurity blind spot that almost no one discusses but everyone should worry about. You've secured your laptops. You've rolled out multi-factor authentication. Your firewall is properly configured. But what about that office printer quietly storing every contract and payslip you've printed this year on a hard drive nobody ever wipes, with a password an attacker can guess in three tries? This episode reveals the uncomfortable truth about Internet of Things (IoT) devices in your business. We're talking about printers, CCTV systems, smart thermostats, networked door locks, and every other "smart" device you've stopped thinking about as a computer. These forgotten devices are giving attackers a free pass into networks that are otherwise properly secured. We share a real case study from our recent emails about a marketing agency that spent £15,000 on security, passed their audit with flying colours, and still got breached through their office printer. This isn't theoretical paranoia. This is happening right now to businesses that think they've got security sorted. What You'll Learn Why your office printer is possibly the biggest security risk in your building How default passwords on "forgotten" devices create easy access points for attackers The real story of a £15,000 security investment defeated by a £300 printer What network segmentation actually means and why it matters for small businesses How to create and maintain an accurate device inventory Practical steps to secure IoT devices without enterprise budgets Why your CCTV system might be livestreaming to the internet right now How smart thermostats become backdoors into your network Key Topics Covered The Forgotten Device Problem Modern offices are full of computers disguised as other things. Every printer, every CCTV camera, every smart thermostat, and every networked door lock is actually a computer connected to your network. Most businesses secure their obvious computers whilst completely forgetting about these devices, creating perfect entry points for attackers who aren't bothering with sophisticated social engineering when they can just log in with "admin/admin". Real Case Study: The £15,000 Security Investment Defeated by a Printer A 30-person marketing agency listened to our ransomware and authentication episodes, then invested £15,000 in proper security: new firewalls, endpoint protection, hardware authentication keys for every staff member, and a security audit that came back clean. Two months later, they discovered someone had been accessing their client files for weeks through their HP printer that still used factory default credentials. The printer had full network access and stored copies of everything printed. Nobody had changed the password. Nobody had checked it during the audit. Nobody even thought about it. Default Credentials: The Epidemic Nobody Discusses Attackers maintain databases of default passwords for thousands of devices. They don't need to crack complex passwords when they can try "admin/admin" or "admin/password" and gain access to printers, cameras, or thermostats within seconds. These devices often ship with administrative interfaces accessible from the network, and most businesses never change the defaults because they don't think of these devices as security concerns. Network Segmentation Explained (Without Enterprise Complexity) Network segmentation sounds enterprise-level complicated, but the basic concept is simple: not everything on your network should be able to access everything else. Your printer doesn't need access to your accounting server. Your CCTV system doesn't need to reach your customer database. Creating separate network zones for different device types means a compromised printer can't become a stepping stone to your sensitive data. The Device Inventory Challenge Most small businesses have no accurate list of what's actually connected to their network. They know about the laptops and servers but often forget about the smart coffee machine someone plugged in last year, the wireless access points in the meeting rooms, or the networked thermostat the facilities team installed. Without knowing what's connected, you can't secure it. We discuss practical methods for discovering and documenting every device on your network. Practical IoT Security Steps We break down actionable steps that don't require enterprise budgets or dedicated security teams. This includes conducting device audits, changing default passwords, implementing basic network segmentation, regular firmware updates, and creating ownership responsibility for every connected device. The goal is proportionate security that's actually achievable for small businesses. Key Takeaways Every connected device is a computer. If it has an IP address, it's a potential security risk that needs management and protection. Default passwords are attackers' best friends. The first thing to do with any new device is change the administrative password. Never assume factory defaults are acceptable. Network segmentation isn't optional anymore. IoT devices should be isolated from your main business network, even if that means starting with basic VLAN separation. Device inventory is fundamental. You can't secure what you don't know exists. Conduct regular network scans to discover forgotten devices. Ownership matters. Every device needs someone responsible for its security. Don't let devices become "nobody's problem" because that's when they become everyone's problem. Security audits miss IoT devices. Standard security assessments often focus on servers and workstations whilst completely overlooking printers, cameras, and other IoT equipment. Firmware updates apply to everything. IoT devices need security patches just like computers. Many businesses forget this entirely. Your £15,000 security investment can be defeated by a £300 printer. Security is only as strong as your weakest link, and IoT devices are often the weakest links because they're forgotten. Resources & References Mentioned in This Episode Previous Episodes Referenced: Episode 17: Social Engineering - The Human Firewall Under Siege Ransomware episodes (multiple) Authentication episodes featuring Mark Bell Cyber Essentials episodes Electoral Commission accountability episode Hardware Authentication: AuthenTrend hardware keys (mentioned as sponsor) Case Studies: Marketing agency breach via printer (anonymized client) Recommended Reading & Tools NCSC Guidance: National Cyber Security Centre - IoT security guidance Network Discovery Tools: Fing, Advanced IP Scanner, or similar free network scanning utilities Device Documentation: Spreadsheet templates for device inventory available on our website Practical Action Steps This Week: Find your printer's admin interface. Log in. If you can't remember the password, that's probably because it's still set to "admin". Change it. Now. List five connected devices that aren't computers or phones. These are your starting inventory. Check one device's firmware. Is it up to date? When was it last updated? Who's responsible for keeping it current? This Month: Complete device inventory. Use network scanning tools to discover everything connected to your network. Document it all. Change all default passwords. Every printer, camera, thermostat, and access point needs unique, strong credentials. Assess your network segmentation. Can your printer access your file server? It shouldn't. Start planning basic network separation. Assign device ownership. Every device needs someone responsible for its security, updates, and maintenance. This Quarter: Implement basic network segmentation. Even simple VLAN separation is better than everything on one network. Create update schedules. IoT devices need regular firmware updates just like computers. Review and test. Verify your device inventory is accurate. Check that passwords actually changed. Confirm segmentation works. Who Should Listen to This Episode? This episode is particularly relevant for: Small business owners who've invested in cybersecurity but may have overlooked IoT devices IT managers and solo IT staff responsible for securing business networks with limited resources Office managers who purchase and install connected devices without considering security implications Business owners who think they've "done security" but haven't considered printers, cameras, and similar devices Anyone who's ever said "it's just a printer" when security concerns were raised Why This Episode Matters We've covered passwords, multi-factor authentication, ransomware, supply chain attacks, shadow IT, and social engineering across 30 episodes. We've discussed major breaches at household names and examined what it takes to protect heads of state. But we've deliberately avoided IoT security until now because we knew it would make people uncomfortable, possibly angry, and definitely worried. The uncomfortable truth is that whilst you've been securing laptops and servers, your office printer has had full network access, stores every document you print, and still uses the password it shipped with. The CCTV system protecting your premises might be livestreaming to the internet because nobody changed the default settings. The smart thermostat saving you money on heating is potentially giving attackers a way into your network. This isn't theoretical paranoia. We're seeing breaches through IoT devices happen to businesses that have otherwise invested properly in cybersecurity. The marketing agency case study we discuss spent £15,000 on security and still got breached through a printer nobody thought to check during the security audit. IoT security is the blind spot in small business cybersecurity. This episode gives you the knowledge and practical steps to finally address it without enterprise budgets or dedicated security teams. Celebrating 30 Episodes This milestone episode also marks an important achievement for the podcast. Since launching in June 2025, we've: Reached Top 12 in Apple Podcasts Management category worldwide Peaked at 3,500 daily downloads Built an audience that's 47% US, 37% UK despite being a UK-focused show Made cybersecurity almost entertaining whilst maintaining technical accuracy Helped businesses actually implement security improvements, not just understand threats We're genuinely grateful to everyone who's been listening, sharing, and most importantly, doing the work. The chart positions and download numbers are nice, but what matters more is when someone emails to say they've finally sorted Cyber Essentials or retired Dave from IT as a single point of failure. Coming Up Episode 31 (Next Week): Regular episode format continues with another crucial small business cybersecurity topic Episode 32 (22nd December): Christmas Special - a festive take on cybersecurity for small businesses Connect With Us Need Help? If you need direct assistance with IoT device security, Cyber Essentials, network segmentation, or any topic we've covered, contact us at: [email protected] Website & Resources Visit thesmallbusinesscybersecurityguy.co.uk for: Detailed guides on everything we've discussed Step-by-step walkthroughs for printer security, camera configuration, and network segmentation Device inventory templates and checklists All episode show notes and transcripts Subscribe & Follow Apple Podcasts: Currently Top 12 in Management category worldwide Spotify: New episodes every week All major podcast platforms: Search for "The Small Business Cyber Security Guy" Share This Episode Know someone who's ever said "it's just a printer"? They need this episode in their life. Share it with: Business owners who think they've got security sorted IT managers dealing with limited budgets and forgotten devices Office managers who purchase connected devices Anyone responsible for small business network security Support the Show If you've had real value from this podcast: Leave a review on Apple Podcasts or Spotify - tell us what you've actually changed in your business Share episodes with other business owners who need to hear this Tell us what's landing - your feedback helps us create more useful content Subscribe so you don't miss episodes About the Hosts Noel Bradford With over 40 years in IT and cybersecurity across enterprises including Intel, Disney, and BBC, Noel now serves as CIO/Head of Technology for a boutique security-first MSP. He brings enterprise-level expertise to small business constraints, translating million-pound solutions into hundred-pound budgets. His mission is making cybersecurity practical and achievable for resource-constrained small businesses. Mauven MacLeod Former government cyber analyst, Mauven, brings systematic threat analysis and government-level security thinking to commercial reality. With her Glasgow roots and ex-government background, she translates complex security concepts into practical advice for small businesses, asking the questions business owners actually need answered. Graham Falkner Regular contributor and co-host for special episodes, Graham adds additional perspective and helps make complex cybersecurity topics accessible to small business audiences. His role includes managing the legal disclaimers and ensuring content remains grounded in practical business reality. Legal Disclaimer Everything discussed in this episode is for general guidance and educational purposes. It's meant to point you in the right direction but absolutely shouldn't be treated as professional advice tailored specifically to your business. Your situation is unique. What worked brilliantly for one business might be completely inappropriate for another. We do our very best to keep everything accurate and current, but the cybersecurity world moves faster than a caffeinated squirrel. Things can change between when we record and when you're listening, so always double-check critical technical details with qualified professionals before making major changes to your systems. If we've mentioned any websites, products, or services, we're giving you information, not necessarily endorsing them. We can't be responsible for what happens on their end or if things go sideways when you use them. If you're dealing with serious cybersecurity incidents, actual data breaches, or complex compliance issues, please talk to proper professionals rather than just relying on podcast advice. We're here to educate and help you understand the landscape, not to replace your security consultant, solicitor, or IT team. Think of us as your knowledgeable mates down the pub who work in cybersecurity, not your official contracted consultants. We care about your business, but we're not your insurance policy. Stay safe out there, keep learning, and remember: when in doubt, get a second opinion from someone who can see your specific situation. This has been a Small Business Cyber Security Guy production. Copyright 2025, all rights reserved. Episode 30 | December 2025 | The Small Business Cyber Security Guy Podcast

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related