The Devices Your Security Stack Can't See: Edge Device and IoT Security for Canadian SMBs

Walk through most Canadian SMB offices and count the computers — laptops, workstations, maybe a server room. That count is what most organizations have secured: endpoint protection on every machine, Microsoft 365 with MFA enforced, a perimeter firewall. The security posture, on paper, looks reasonable.

Now count everything else with an IP address.

The camera above the front door. The one covering the parking lot. The badge reader beside the server room entrance. The network switch in the wiring closet. The wireless access points on the ceiling. The multifunction printer in the corner. The smart TV in the boardroom. The HVAC controller that facilities management installed two years ago and nobody has touched since.

None of those devices run an endpoint detection and response agent. None receive updates from Windows Update. Most have never had their default credentials changed. Most are absent from vulnerability scans, patch schedules, and incident response plans. In the average Canadian SMB, that hidden inventory runs to dozens of devices — all sharing a network with domain controllers, file servers, and every Microsoft 365 endpoint in the building.

Attackers have noticed.

The Numbers Changed in 2026

The Verizon 2026 Data Breach Investigations Report recorded something that had not happened in the report's 19-year history: vulnerability exploitation overtook credential theft as the single most common initial access vector, accounting for 31% of all breaches — up from 20% in the prior year, a 55% increase in one reporting cycle.

The driver of that shift was edge devices. Network firewalls, VPN concentrators, routers, and other perimeter appliances went from representing 3% of exploitation-driven breaches to 22% — a seven-fold increase in a single year. Endpoint operating systems are being patched more aggressively than in previous years, so attackers have pivoted to the perimeter hardware that is chronically neglected: the devices you reach by IP address rather than Active Directory, whose firmware update requires a maintenance window nobody schedules.

The remediation picture explains the attacker opportunity: only 26% of known exploited vulnerabilities were actually remediated in 2025, down from 38% the year before, and the median time-to-patch for network appliances has risen to 43 days. The window between public CVE disclosure and mass exploitation on internet-facing devices has collapsed to near-zero. The math does not work in defenders' favour.

Canada's Exposure

Canadian businesses have enthusiastically adopted connected devices. IDC research conducted at the end of 2023 found that 92% of Canadian businesses had deployed IP-based connected solutions. Forescout's analysis of ten million devices across more than 700 organizations, published in November 2025, found that 65% of all connected assets are now non-traditional IT devices — they are not workstations, laptops, servers, or hypervisors, and they cannot run conventional endpoint security agents.

That 65% is entirely unprotected by the endpoint detection tools most Canadian SMBs have deployed. It becomes visible only if someone maintains a network-level asset inventory and actively monitors traffic from those segments.

Breaches in Canada are correspondingly expensive. The 2026 IBM Cost of a Data Breach Report found that the average Canadian breach now costs CA$7.11 million and takes an average of 205 days from initial intrusion to containment. That 205-day window is what happens when a threat actor gains a foothold on an unmonitored device and moves laterally without triggering alerts. Industrial and energy sectors — which carry the highest connected-device exposure — reported the highest Canadian breach costs at CA$8.89 million and CA$9.21 million per incident respectively.

The CIRA 2025 Cybersecurity Survey found that 42% of Canadian organizations reported a breach of customer or employee data in the previous 12 months, with the steepest year-over-year increases concentrated in smaller businesses that lack dedicated security staff to detect lateral movement on unmonitored segments.

What Actually Gets Exploited

Understanding which device categories attract sustained attacker attention clarifies where SMBs should direct effort first.

Network firewalls and VPN appliances are the category driving the DBIR's numbers. Devices from Ivanti, Fortinet, Palo Alto Networks, and SonicWall have all carried actively exploited critical vulnerabilities in recent years. These appliances sit directly on the internet, and when a critical CVE is published, mass scanning begins within hours. A firewall running firmware from 18 months ago is not a firewall — it is an open door with the manufacturer's badge on it.

IP cameras and physical access control systems attract persistent attention because they are deployed at scale, connected to the corporate network, and almost never updated. Default administrative credentials on cameras from multiple major manufacturers have been exploited in large-scale botnets. Beyond botnets, a compromised camera gives attackers persistent network presence from a device that nobody checks during incident response.

Network switches and wireless access points are the backbone of internal infrastructure but are rarely included in patch cycles. An unmanaged switch running outdated firmware can be used to intercept internal traffic or enable VLAN-hopping attacks that bypass the segmentation controls your firewall enforces at the perimeter.

Printers remain a perennial security failure. Network-connected multifunction devices store copies of processed documents, accept inbound connections on multiple ports, and ship with default credentials (admin/admin, admin/blank) that the majority of organizations never change. Many are accessible from anywhere on the corporate network and, in misconfigured environments, from the internet.

Smart building systems — HVAC controllers, building management systems, digital signage, and connected door locks — are the category least likely to appear in any security review. Many run embedded firmware that has not received an update since installation. They are routinely connected directly to the main corporate network because facilities management and IT rarely coordinate, and they appear nowhere in backup, patching, or incident response documentation.

What the CCCS Recommends

In February 2025, the Canadian Centre for Cyber Security published ITSM.80.101 — Security Considerations for Edge Devices — jointly with CISA, Australia's ASD ACSC, the UK's NCSC, and other Five Eyes partners. The document addresses exactly the class of devices driving the DBIR's exploitation numbers and provides guidance grounded in documented real-world compromise cases.

The CCCS separately publishes ITSAP.00.012 — Internet of Things (IoT) Security, which applies to the cameras, printers, smart building systems, and connected appliances present in most Canadian SMB environments.

The CCCS Baseline Cyber Security Controls for Small and Medium Organizations includes network segmentation as a baseline requirement — specifically calling out separation of point-of-sale systems, financial systems, IoT devices, and guest traffic from internal corporate segments.

Together, these documents outline the same core controls.

Five Controls That Make a Measurable Difference

1. Build a Complete Asset Inventory

You cannot protect devices you do not know exist. Most Canadian SMBs have never produced a full inventory of network-connected assets beyond the machines enrolled in MDM or Active Directory. A network scan reveals everything currently connected: the camera on a DHCP lease from three years ago, the smart thermostat facilities installed during a renovation, the decommissioned access point someone never unplugged.

The output should be a documented list of every network-connected device — manufacturer, model, firmware version, physical location, network segment, and the date of last update. This list is the foundation for every other control.

2. Change Every Default Credential Before Deployment

The single most common entry point for IoT and edge device compromise is default administrative credentials that were never changed. Every device shipped from a manufacturer with admin/admin, admin/password, or any other published default should have its credentials changed before connecting to the network. Where the device supports it, create a unique administrator account, disable the default account, and use a passphrase of at least 15 characters stored in your password manager. This applies to cameras, switches, access points, printers, VPN appliances, and every smart building controller on your network.

This step costs nothing and eliminates a substantial portion of the risk profile for these devices.

3. Isolate IoT and Edge Devices on Dedicated VLANs

Connected devices with limited security capabilities should not share a network segment with file servers, Active Directory, and workstations. VLAN isolation ensures that a compromised camera or printer cannot directly reach internal systems — all traffic between segments must pass through a firewall where it can be inspected, restricted, and logged.

The practical implementation for most Canadian SMBs:

Outbound internet access for IoT devices should be restricted to specific required destinations. A camera does not need to reach arbitrary cloud services — restrict it to the manufacturer's update server and your network video recorder. Anomalous outbound traffic from IoT devices is often the first observable indicator of compromise.

4. Maintain a Firmware Patching Schedule

Firmware updates exist for the same reason Windows patches do: vendors find vulnerabilities and release fixes. The difference is that firmware updates do not happen automatically — someone has to apply them, and they require a maintenance window, a tested rollback procedure, and often physical or out-of-band access.

The CCCS guidance recommends that firmware updates be included in your patching policy with defined schedules, responsible personnel, and back-out plans. For internet-facing devices — firewalls, VPN appliances, and remote access gateways — the DBIR data is direct: critical vulnerabilities in these devices are exploited within hours of public disclosure. These devices require the shortest patch window of anything on your network, measured in 48 hours for critical CVEs, not the next quarterly maintenance window.

For internal IoT devices, a quarterly firmware review is a reasonable baseline. Log into each device's administrative interface, apply available updates, and record the firmware version installed and the date. For devices the manufacturer has discontinued firmware support for, treat end-of-support as a replacement trigger — not a reason to keep running the device indefinitely.

5. Monitor for Anomalous Traffic

Devices with known, predictable behaviour are straightforward to monitor. A camera should send traffic to your NVR and nowhere else. A printer should accept print jobs and management traffic. Any deviation — outbound connections to unexpected external addresses, lateral connections to other VLANs, large data transfers at unusual hours — is a detection signal.

Network-level logging from a managed firewall, or a SIEM tool aggregating firewall logs, surfaces this behaviour automatically. If your managed IT provider does not include network traffic analysis in their standard service, ask explicitly — the visibility gap on IoT and edge device segments is where incidents develop undetected for months.

A Practical Starting Point

The realistic starting point for most Canadian SMBs is a three-step sequence: audit, isolate, and update.

Audit: run a network scan to identify every connected device. The output is your IoT and edge device inventory.

Isolate: work with your IT provider to move non-managed devices to a dedicated VLAN, separated from your main corporate segment by firewall rules that block lateral traffic.

Update: review the firmware version on every internet-facing appliance against the vendor's current release and apply any critical or high-severity patches within 48 hours of their availability.

These three steps require no new tools and modest budget. They do require scheduled time and a documented process that repeats on a defined cycle. They also reflect exactly what the CCCS recommends in ITSM.80.101 and the Baseline Controls — which means following them puts your organization on the right side of the guidance Canada's technical authority on cybersecurity has provided.

The devices your endpoint security cannot see are not theoretical risk. The Verizon 2026 DBIR shows they are the primary driver of the largest shift in initial access vectors in nearly two decades. In a Canadian threat environment where the average breach costs CA$7.11 million and takes 205 days to contain, leaving 65% of your connected assets unmonitored is not an acceptable posture.

Sources

• Verizon. *2026 Data Breach Investigations Report.* helpnetsecurity.com
• Forescout. *New Forescout report finds 65% of connected assets are outside traditional IT visibility.* itsecurityguru.org
• IBM. *Cost of a Data Breach Report 2026 — Canada.* canada.newsroom.ibm.com
• CIRA. *2025 Cybersecurity Survey.* cira.ca
• Canadian Centre for Cyber Security. *Security Considerations for Edge Devices (ITSM.80.101).* cyber.gc.ca
• Canadian Centre for Cyber Security. *Internet of Things (IoT) Security (ITSAP.00.012).* cyber.gc.ca
• Canadian Centre for Cyber Security. *Baseline Cyber Security Controls for Small and Medium Organizations.* cyber.gc.ca
• CISA / CCCS / NCSC-UK / ASD ACSC. *Guidance and Strategies to Protect Network Edge Devices.* cisa.gov

Cloud Forces secures Canadian SMB networks from the devices most managed IT providers overlook — from network device inventory audits and VLAN isolation design through edge device patch management and anomaly monitoring. Explore our Cybersecurity services or contact us to book a network device security assessment.