IoT devices like security cameras are some of the most insecure things on the internet. If they share a network with your files, your point-of-sale system, or your accounting software, they're a backdoor an attacker can walk right through.
A few years ago a retail client called us after a breach. Someone had gotten into their internal network, poked around their point-of-sale system, and made off with several months of transaction data. The investigation eventually traced the entry point not to a phishing email, not to a weak password — but to a security camera.
Specifically, a $89 IP camera they'd installed in the parking lot two years earlier. The default admin password had never been changed. The camera's firmware hadn't been updated since the day it was installed. And it sat on the same network as everything else in the building.
Once an attacker got into that camera — trivially easy to do — they had a foothold on the same network segment as the POS terminals, the server, and the shared file drive. From there, it was just a matter of patience.
This isn't a rare story. It's the kind of thing we see again and again, because most small businesses install security cameras, thermostats, smart TVs, and other "internet of things" devices without thinking about the security implications. The cameras go in, they work, and that's the end of the conversation. The network conversation never happens.
We want to change that. This isn't complicated to fix — but you do have to know it's a problem first.
Security cameras, smart thermostats, badge readers, wireless access points, digital signage players — these all fall under the umbrella of IoT devices: things that connect to your network and run some kind of software, but aren't traditional computers with a human watching over them.
The security problems with IoT devices are almost universal:
Most IP cameras ship with default usernames and passwords — "admin/admin" or "admin/12345" are genuinely common. There are public databases online that list the default credentials for thousands of device models. Attackers scan the internet for these devices and try the known defaults. If no one changed the password during setup (and in our experience, most businesses never do), the camera is compromised before it's even been through a full day of recording.
Your Windows server gets security patches. Your firewall gets firmware updates. Your cameras? Probably not. Most small businesses install a camera system, confirm it works, and never think about it again. The cameras just sit there, running the same firmware from the day they shipped, accumulating vulnerabilities as researchers and attackers find them. Some camera manufacturers have a poor track record of even releasing security patches at all.
Consumer-grade and small-business-grade IoT devices are built to be easy to set up and cheap to manufacture. Security is frequently an afterthought. Some communicate with manufacturer cloud services in ways that are hard to audit. Some have hardcoded backdoor credentials that the manufacturer uses for support access. Some have been found to exfiltrate data to servers in countries you'd prefer your business data not visit.
With a computer, if something starts behaving strangely, someone notices. With a camera, the only evidence anyone sees is the video feed — and if the camera is still showing footage, people assume it's fine. An attacker can be living inside a camera for months, using it as a persistent foothold into your network, and you'd have no idea.
Here's the thing about a network: if a device is on it, that device can talk to other devices on it. That's kind of the point. But it also means a compromised camera can talk to your file server, your accounting software, your point-of-sale terminals — anything else on the same network segment.
An attacker who gets into a device on your network will typically start by scanning to see what else is there. Your file server, your database server, any Windows machines, other network devices — all of this becomes visible. They're not necessarily going to move immediately. They may sit quietly for weeks, watching traffic, mapping your environment, looking for the most valuable target.
Once they've mapped the network, attackers move from the compromised device toward higher-value targets. If they can get to a Windows machine, they might try to escalate privileges. If they can reach a file server, they might start quietly exfiltrating data. If they can reach a POS system, they're looking at cardholder data. This is exactly how the retail breach we mentioned started — one cheap camera was the entry point; the POS data was the destination.
Increasingly, attackers use initial footholds like compromised IoT devices to stage ransomware attacks. They get in, move laterally to find your backups and your main servers, disable or encrypt the backups first, then deploy ransomware across everything at once. The camera was just the door. For a deeper look at what a modern attack looks like, our Cybersecurity Essentials guide covers the full threat landscape.
A compromised IoT device that nobody's watching is a gift that keeps giving. Even if you respond to an incident and clean up your servers, if the camera that was the original entry point is still running compromised firmware, the attacker may simply re-enter through the same door. IoT devices are often overlooked during incident response for exactly this reason.
The solution to this problem is called network segmentation — specifically, putting your IoT devices on a separate network segment that can't directly communicate with the rest of your business systems. The most common way to do this is with VLANs.
VLAN stands for Virtual Local Area Network. It's a way of dividing a single physical network into multiple logically separate networks. Think of it like having separate lanes on a highway — traffic in one lane doesn't automatically cross into another. Devices on one VLAN can't directly reach devices on another VLAN unless traffic is explicitly permitted through a firewall or router that controls what can cross between them.
A VLAN isn't a separate physical network — you don't need to run separate cables for each segment (though you can). It's configured in software on a managed switch and enforced at the network layer. The cameras, thermostats, and badge readers go on the IoT VLAN. Your servers, workstations, and POS systems go on the business VLAN. The two can talk to the internet (with appropriate firewall rules), but they can't talk to each other.
When a camera gets compromised — and we're assuming "when," not "if" — the attacker is stuck on the IoT VLAN. They can see other cameras, maybe other IoT devices, but they can't reach your file server, your domain controller, your POS terminals, or your workstations. The blast radius of a compromised camera is contained. The camera becomes a problem to fix, not a catastrophe.
This is the same principle that makes a proper business firewall worth having — layered defenses that contain damage rather than assuming nothing will go wrong.
To implement VLANs, you need:
We hear this one a lot. Your router probably already has a "guest network" option. Can't you just put the cameras on that?
For wireless IoT devices, a guest network can be a reasonable starting point — it's much better than nothing. A properly configured guest network isolates clients from each other and from the main network. If your cameras support Wi-Fi and your guest network is correctly set up, you've taken a meaningful step.
But there are important caveats:
Many cameras are wired, not wireless. If your IP cameras are connected via Ethernet (which is common for reliability reasons), a Wi-Fi guest network doesn't help at all. You need VLAN support in your switches to segment wired devices.
Consumer "guest networks" aren't always as isolated as they should be. The implementation varies a lot by router/access point. Some genuinely block guest clients from reaching the main network; others have bugs or misconfigurations that allow cross-network traffic. Don't assume isolation without verifying it.
You lose visibility and control. A guest network gives you basic isolation, but a proper VLAN setup lets you define precise firewall rules: the cameras can reach the internet (for cloud storage or remote viewing), but they can't reach anything on your LAN. You can log traffic crossing the boundary, set rate limits, and monitor for unusual behavior. A guest network gives you "sort of isolated"; VLANs give you "specifically controlled."
Think of a guest network as a band-aid and VLANs as the actual fix. If you're currently running cameras on your main network, moving them to a guest Wi-Fi network today while you plan a proper VLAN setup is a reasonable interim step. Just don't stop there.
Network segmentation is the most important fix, but it's not the only one. A camera that's been segmented but still has the default password and three-year-old firmware is still a compromised camera — it's just one that can't escape into the rest of your network. Here's what else matters:
Every IP camera, NAS, managed switch, access point, and network-connected device should have the default password changed before it goes live. Use strong, unique passwords — and store them in a business password manager so they're not lost when staff turns over. This is the single most basic step and is still skipped constantly.
Set a reminder to check for firmware updates on your cameras and other IoT devices at least quarterly. For most devices this means logging into the management interface and checking for updates, or signing up for the manufacturer's security bulletin. It's not glamorous, but it closes the vulnerabilities attackers exploit.
Many IP cameras come with remote cloud access, UPnP (a protocol that can automatically punch holes in your firewall), Telnet, and other services enabled by default. Turn off anything you don't actively use. UPnP in particular should almost always be disabled — it's a convenience feature that creates security problems by automatically forwarding ports on your firewall without your knowledge.
Do you know every device connected to your network? Cameras, yes — but what about the smart TV in the conference room, the Wi-Fi thermostat, the network-connected copier, the VoIP phone adapters? Any of these can be entry points if they're misconfigured or running old firmware. An honest network assessment often turns up devices people forgot were there.
Not all camera systems are equally problematic. Enterprise-grade NVR (network video recorder) systems from vendors like Axis, Hanwha, or Verkada are designed with security practices in mind — automatic firmware updates, better default configurations, audit logs, proper access controls. They cost more than the $89 camera from an online marketplace. But the $89 camera's true cost includes the risk you're accepting.
If you've read this far and you're not sure what your camera setup looks like, here are three things you can do right now — before you even call anyone:
1. Find out what's on your network. Log into your router or firewall and look at the list of connected devices. Identify anything that isn't a computer, phone, or known piece of office equipment. Those are your IoT devices. For most businesses, the list is longer than expected. A smart TV you forgot about. A camera installed by a previous employee. A badge reader no one thought about since it was installed three years ago.
2. Check the passwords. For every camera and IoT device you identify, look up the default credentials for that model (just Google "brand model default password"). Then log into the device and check whether those credentials still work. If they do, change them today. This takes twenty minutes and is genuinely one of the highest-value security tasks you can do.
3. Find out whether your cameras are on a separate network. Ask your IT person or IT provider whether your IoT devices are segmented from your main business network. The answer should be a clear "yes, they're on a VLAN" or at minimum "yes, they're on a separate guest network." If the answer is "I'm not sure" or "they're on the same network as everything else," you've identified a real problem worth fixing.
The good news is this is genuinely fixable, and it doesn't require replacing your cameras or starting over from scratch. It's a network configuration change — one that a competent IT provider can typically implement in a few hours with the right equipment. If your current infrastructure doesn't support VLANs (consumer switches, consumer router), that's a slightly bigger project, but one that usually makes sense as part of a broader network upgrade. We cover what that looks like in our cybersecurity guide.
Your security cameras are supposed to make your business safer. With the right network setup, they will. Without it, they might be doing the opposite.