Photo by Albert Stoynov on Unsplash
Refrigeration systems at supermarkets across Europe were knocked offline by a cyberattack. Food temperature monitoring failed. Staff could not manage stock safely. The disruption was operational, not just digital. But buried in the incident reports is a detail that matters far beyond the food retail sector: these systems were running software that had not been updated in a long time. That is not a supermarket problem. That is a problem shared by almost every business in the UK right now.
The Devices That Just Work. Until They Do Not.
Think about what is connected to your office network. Not the laptops, not the phones. Those probably receive updates automatically, or at least someone is responsible for keeping them current. Think about everything else. The Wi-Fi access points in your ceiling. The smart TV in the meeting room. The printer everyone uses but nobody manages. The networked door entry panel. Any environmental or energy monitoring kit your building runs. If you have a network-attached storage device tucked away somewhere, that too.
Every single one of these is a small computer running software. In most small businesses, not one of them has ever appeared on a patch schedule.
They get set up, connected, and then left. Because they work. Nobody thinks of a printer as a security liability. Nobody schedules a firmware check for the Wi-Fi access point. It sits there doing its job, year after year, until something breaks, or until someone on the internet finds a known flaw in that firmware version and uses it to get a foothold on your network.
Why Attackers Find These Devices First
Security researchers regularly uncover vulnerabilities in the firmware running on common office equipment. When a flaw is disclosed publicly, the manufacturer usually issues a patch. That patch only closes the risk if someone actually installs it.
If your access point is running firmware from 2021 and a significant vulnerability was disclosed in 2022, that device has been sitting on your network with a known, documented flaw for three years. Attackers do not need to guess about this. They run automated scans across vast ranges of internet addresses, looking for devices running software versions they already know how to exploit. If your device responds and matches a known vulnerable version, it goes on a list. They are not targeting you specifically. They are targeting the gap.
This is the same compression of time between discovery and active exploitation that we have written about before in the context of conventional software patches. The difference with operational and connected devices is that the window never closes, because for most businesses the patch is never applied at all.
The "Nobody Owns It" Problem
In larger organisations, this gap often comes down to fractured responsibility. The printer was ordered by the office manager. The smart display was set up by whoever needed it in the boardroom that week. The building controller was installed by a facilities contractor and never handed over to IT. None of these appear on an asset register, none sit under a clear owner, and none make it onto a patch or review schedule.
For small businesses without a dedicated IT function, the situation is simpler but the outcome is the same: these devices have never been considered part of the security picture at all. They are appliances, not computers. Except they are both.
A proper vulnerability scan of your network will surface these devices, identify what software versions they are running, and flag known weaknesses. For many small businesses, that scan is the first time anyone has seen a complete picture of what is actually connected to their network.
What You Can Do About It
Closing most of this exposure does not require a full infrastructure overhaul. A few focused steps cover the majority of the risk.
- Build a device inventory. Go through your network and list every connected device that is not a staff computer or phone. Include the make, model, and where possible the firmware version. If you cannot identify a device, that itself is a flag worth investigating.
- Check each device for firmware updates. Most equipment has an admin interface accessible through a browser via the device's IP address. From there you can usually see the current firmware version and check whether a newer one exists. The manufacturer's support page is the other place to look. Set a quarterly calendar reminder so this does not get forgotten.
- Separate connected operational devices from your main network. Putting IoT and non-computer devices onto a guest network or a dedicated network segment means that if one is compromised, an attacker cannot automatically move sideways to your laptops, file storage, or email accounts. Your network security setup should account for this kind of separation, and it is worth reviewing whether yours currently does.
- Include these devices in your regular patch process. If you already use automated patch management for your computers, ask whether it has coverage for firmware and embedded devices. Where it does not, the quarterly manual check needs to fill that gap.
A Short Practical Takeaway
The European supermarket attack is a visible example of what happens when the devices doing quiet, background work in a business are never updated. Attackers look for exactly this gap. The fix is not complicated: know what is connected to your network, check that it is running current software, and make sure the devices that just sit there and work are not doing so on firmware with publicly known flaws.
If you want to understand what your current exposure actually looks like, a vulnerability assessment is the most practical starting point. It tells you what is on your network before someone else finds out first.