Securing Security Cameras and Physical IoT
Your security cameras are supposed to be the thing watching for threats — not the thing creating one. But every IP camera, door controller, or smart sensor you add to your network is also a small computer with its own firmware, its own login, and its own chance of being the weakest link an attacker finds first. Independent research on this is blunt: nearly 4 in 10 security cameras in a typical network carry some kind of exploitable cyber vulnerability, almost always traceable to outdated firmware or a password nobody ever bothered to change.
Why Cameras Are a Bigger Risk Than They Look
A camera doesn’t feel like “IT equipment” the way a laptop does, so it rarely gets the same patching discipline. Industry research backs that instinct up with hard numbers: in one large-scale study of tens of thousands of deployed cameras, 68% were running out-of-date firmware, and of those, 54% carried a known, documented cybersecurity vulnerability — not a theoretical one, but one already published and exploitable. Extrapolated across an average camera network, that works out to roughly 4 in 10 cameras sitting exposed at any given time. On top of that, nearly a quarter of organizations studied were found reusing the same password across every camera from a given manufacturer, which turns one compromised device into an open door for every other camera on the same brand.
The Default Password Problem
Most IP cameras, video doorbells, and NVR (network video recorder) boxes ship with a default admin username and password printed right on the box or in the manual — and those defaults are published online, searchable by model number, and routinely scanned for by automated bots looking for exactly this. Changing the default credentials the day you unbox a device isn’t optional hardening; it’s the single highest-value five minutes you’ll spend on camera security, and it should happen before the device is ever connected to your live network, not after.
Firmware Updates Are Not Optional Maintenance
Camera manufacturers patch real vulnerabilities on a regular basis, but unlike a laptop or phone, almost nothing about a camera nags you to install the update. That means someone on your team needs to own a recurring calendar reminder — quarterly is reasonable for most small businesses — to log into each camera or NVR’s admin panel and check for firmware updates manually. If your camera system is old enough that the manufacturer has stopped releasing updates for it entirely, that’s a signal it’s time to budget for replacement, not keep running it as-is.
Network Segmentation: Keep Cameras Off Your Main Network
The single most effective structural fix is putting your cameras and other IoT devices on their own isolated VLAN or guest network, separate from the network your point-of-sale system, employee workstations, and file servers live on. If a camera does get compromised on a segmented network, the attacker is stuck on a dead-end branch with no path to your actual business systems. Our network segmentation guide walks through how to set this up without needing an enterprise-grade firewall.
Remote Access and Cloud Apps Deserve the Same Scrutiny
Most modern camera systems come with a companion mobile app or cloud portal for remote viewing — convenient, and also another login surface to secure properly. Use a unique, strong password for that account (never reused from anywhere else), turn on two-factor authentication if the manufacturer offers it, and disable remote access entirely for any camera or system that doesn’t genuinely need to be checked from off-site. The fewer ways in, the fewer ways to get in.
Physical IoT Beyond Cameras
The same principles extend to the broader category of physical IoT devices creeping into small business offices: smart door locks, thermostats, smart plugs, and sensor-based alarm systems. Every one of these is a networked device with firmware, a login, and a manufacturer who may or may not still be supporting it. Before adding any new smart device to your business, check whether the manufacturer has a track record of ongoing security updates, and apply the same default-password and network-segmentation rules you’d apply to a camera. Our broader IoT security guide covers this category in more depth.
How Attackers Actually Find Exposed Cameras
The realistic attack path for an internet-exposed security camera rarely starts with a hacker targeting your business specifically. It starts with a crawler. Specialized search engines built for scanning the internet’s IP address space — Shodan and Censys are the best-known examples, often described as “IoT search engines” — continuously probe public IP addresses for devices that respond to known camera, DVR, and NVR login banners, then index what they find: manufacturer, model, firmware version, open port, and sometimes a live login screen. Anyone, including an attacker with no particular skill, can search that index for a camera brand with a known vulnerability or for devices still answering on a default port, and get a list of exposed targets in seconds. Your camera doesn’t need to be famous or valuable to end up in that index; it just needs to be reachable from the public internet, which is exactly what most consumer-grade and even a lot of “business” camera systems are by default once they’re plugged in and powered on.
Two configuration mistakes account for the overwhelming majority of exposures that end up in those indexes. The first is default or weak credentials: cameras shipped with a factory username and password that installers never change, or that quietly revert during a firmware update. Automated scanning tools try the standard default-credential list against every camera they find, and a meaningful share still work on the first try. The second is UPnP (Universal Plug and Play) — a convenience feature on most home and small-business routers that lets a device automatically open a port-forwarding rule to the internet without anyone configuring it on purpose. A camera or DVR requesting UPnP access to make remote viewing “just work” is also making itself directly reachable from the open internet, bypassing whatever firewall protection the router would otherwise provide, often without the business owner ever realizing a port was opened at all.
Closing both gaps takes less than an hour of configuration work and doesn’t require replacing any hardware. Change every camera and NVR’s default username and password to something unique immediately after installation, and check it again after any firmware update, since updates sometimes reset credentials back to factory defaults. Log into the router and disable UPnP entirely, then set up remote camera access deliberately instead, through the manufacturer’s cloud relay service (which doesn’t require any open port) or through a VPN connection into the network. The more durable fix, especially once you have more than a handful of cameras, is to put them on their own VLAN that can’t reach your business network or the internet directly, so even a camera that does get compromised can’t be used as a stepping-stone to the systems that actually matter.
Bottom Line
Security cameras and physical IoT devices get bought for safety and then quietly forgotten about from an IT standpoint, which is exactly the gap that turns nearly 4 in 10 of them into the easiest device on the network to compromise. Change every default password before a device goes live, put cameras on their own network segment, and put a recurring reminder on the calendar to check for firmware updates. None of that requires a security budget — it requires treating the camera system as the computer it actually is.
