Forescout’s 2026 Report Ranks Riskiest Connected Devices Across IT, IoT, OT and IoMT
Summary
Forescout’s 2026 report analyzes millions of devices using telemetry from the first week of February to rank risk across IT, IoT, OT and IoMT. Routers led IT risk; financial services had the highest average risk, while Telnet exposure rose in several industries.
Key points
- Forescout scored devices using configuration, potential organizational impact, and internet exposure, drawing on Device Cloud telemetry from the first week of February 2026.
- Routers ranked as the riskiest IT device type; VoIP systems led IoT, power distribution units led OT, and medication dispensing systems led IoMT.
- Financial services had the highest average device risk, followed by government and healthcare.
- Routers averaged nearly 32 vulnerabilities per device; routers also accounted for roughly a third of the most dangerous vulnerabilities in organizational networks.
- Telnet exposure increased in financial services, healthcare, and manufacturing; in financial services it rose from 3% to 12%.
- The report identifies outdated firmware, exposed management services, weak or default credentials, and poor network segmentation as recurring device risks.
Article Details
- Publisher
- Forescout Research – Vedere Labs
- Report Period
- First week of February 2026
- Scope
- Risk assessment of connected devices in enterprise environments across IT, IoT, OT, and IoMT, using Forescout Device Cloud telemetry.
- Sample Size
- Millions of devices; exact count not disclosed.
- Key Statistics
- The report identifies 20 riskiest device types across IT, IoT, OT, and IoMT.
- Nine of the 20 device types also appeared in the 2025 report.
- Eleven device types appeared on the list for the first time in 2026.
- Device risk scores range from 1 to 10.
- Routers averaged nearly 32 vulnerabilities per device in the dataset.
- Recommendations
- Identify, prioritize, and reduce risk across IT, OT, IoT, and IoMT rather than managing each environment in isolation.
- Use automated controls across the enterprise, not only in isolated environments, and do not rely exclusively on endpoint agents.
- Support continuous risk reduction, enforcement, and verification across interconnected systems.
MITRE ATT&CK
T1078 · Valid AccountsThe report describes threat actors targeting UPS devices with default credentials.T1110 · Brute ForceThe report says exposed router and firewall management interfaces are targeted in brute-force attempts.T1566 · PhishingThe report identifies phishing as a common initial access vector against endpoints.
People
Vendors
Products
Forescout Device CloudSince 2020, Forescout Research – Vedere Labs has monitored the riskiest connected devices in organizational networks using telemetry drawn from assets in the Forescout Device Cloud.Windows 10Windows 10 reached end of support on October 14, 2025, and Windows 11 is the primary supported desktop version (excluding Windows server versions).Windows 11Windows 10 reached end of support on October 14, 2025, and Windows 11 is the primary supported desktop version (excluding Windows server versions).
Industries
Financial ServicesIn 2026, financial services has the highest average device risk, followed by government and healthcare.GovernmentIn 2026, financial services has the highest average device risk, followed by government and healthcare.Healthcare| **5** | Domain Controller | RFID Reader | BACnet Router | Healthcare Workstation |Manufacturingthan three times that of retail, and average device risk in government is more than double that of manufacturing.RetailThey are used in hospitals, warehouses, retail, financial institutions, and many other organizations.