According to the State of Ransomware 2026 report from Sophos — a global survey of 2,158 IT and security leaders across 17 countries — an exposed application or system was the most common entry point in ransomware attacks, present in 38% of cases. An employee's device accounted for 30%, and the firewall itself — the equipment that filters what goes in and out of the network — for 21%. An internet-connected device, such as a camera, showed up in 3%.
Those numbers only describe the door used to get in. They say nothing about how far the attacker got afterward — and that second question is what decides how much damage gets done. On a network where the finance computer, the security camera, the printer, the guest Wi-Fi, the factory machine and the lobby TV all share the same space, the door used to get in barely matters: once inside, the path to the data that is worth money is wide open.
That is why internal network separation shows up in nearly every serious security recommendation, from CISA, the US critical-infrastructure agency, to CERT.br, Brazil's national computer emergency response team: not as a full infrastructure overhaul, but as the difference between a small incident and one that stops the whole company.
A Network That Grew Without a Design
In most companies, nobody decided everything would sit on one network. It happened by addition: the file server came first, then the computers, then the networked printer, then the security cameras, then the lobby TV because "it's just a Wi-Fi connection," then the new production machine with a control panel that also needs internet access. Each device went in through whichever path was easiest, and nobody stopped to ask whether it needed to see the others.
The camera vendor's technician asks for an open port on the equipment that filters traffic, to reach the system remotely. Someone opens it, because that is faster than pushing back on the request. The lobby TV joins the main Wi-Fi, the same one the finance laptop uses, because setting up a separate network felt like extra work that day. A few months later, nobody remembers who asked for what, let alone why.
The result is a network where any weak point — most often a reused password, but it could just as easily be an outdated device or an unpatched flaw — turns into a path to everything else. CERT.br puts the mechanism in plain terms when it recommends splitting networks apart: "dividing the network into smaller, segregated segments limits lateral movement and the spread of malicious programs." Lateral movement is the technical name for exactly that: an attacker gets in through one point and walks across the network looking for something worth taking — a file server, a finance system, a backup.
Dividing the network into smaller, segregated segments limits lateral movement and the spread of malicious programs.
It is worth noting that most attacks do not start with the camera or the TV — Sophos's numbers show that exposed systems, employee devices and firewalls together account for nearly 90% of cases. But that does not make the peripheral device harmless: it is often the easiest target once the attacker is already inside, precisely because nobody treated that corner of the network as part of the company's security.
Why Wiring Everything The Same Way Falls Short
The common way of setting up a network is to not set it up at all: everything on the same cable, everything on the same Wi-Fi, with all the trust placed in a single piece of equipment at the front door, the perimeter firewall. As long as it holds, things look fine. The moment something gets past it — and the numbers show that something does, regularly — there is no second line to slow it down.
Another version of the same habit is treating every access request as a one-off, without asking what that device actually needs to reach. A security camera does not need to talk to the finance system. A printer does not need to see the leadership's file server. When nobody has drawn those boundaries, the default answer to any request is "sure, open it up," and the network keeps looking more and more like one room with no walls inside.
What Has to Be in Place
Separating a network internally does not mean rebuilding the whole infrastructure. It means dividing what already exists into parts that cannot see each other by default, opening only what is actually needed.
A map of who needs to talk to whom. Before touching any equipment, it is worth listing what each group of devices genuinely needs to reach — the finance system does not need to see the camera, and the camera does not need to see finance.
Logical divisions within the same network. Using the same cabling and the same network equipment, it is possible to create separate parts — one for administrative computers, one for cameras and security equipment, one for guests, one for production. That division is what the technical side calls network segmentation.
A single channel for access requests. Instead of the camera vendor's technician negotiating an open port directly with whoever happens to be nearby, every request goes through one person who logs what was opened, for whom, and for how long.
Access control between the parts. A piece of equipment decides what can cross from one part of the network to another — without it, the division exists only on paper.
Periodic review of who has access to what. Access granted for a one-off project, or to a vendor that no longer works with the company, needs to be removed — not left active until someone notices, months later.
A plan that already knows how to isolate a piece of the network. When something falls outside the norm, the right response is to shut down only the affected segment, not the entire network or one computer picked in the dark.
This is how Skills IT works: mapping who needs to talk to whom, dividing the network into parts that cannot see each other, and keeping a plan ready to isolate only the affected piece when something falls outside the norm.
The Payoff For Whoever Decides
The payoff of separating a network shows up exactly on the day something goes wrong. Without separation, a problem on a single device becomes a reason to shut down the entire operation until someone understands how far the damage reaches — production stops, finance stops, support stops, all at once, because nobody can say with confidence what was exposed.
With the network divided, the same problem stays contained to the piece where it started. Production keeps running while the affected piece is isolated and checked. Downtime for the team drops, because there is no need to investigate the whole network — only the segment that had the incident. And the decision to shut something down or keep it running stops being a guess made under pressure, because the map of who connects to whom already existed before the problem happened.
That kind of payoff does not show up on the month's IT invoice. It shows up on the day the company does not lose a week of revenue because of a camera or a printer nobody remembered was even on the network.
Questions to Bring to the Next Meeting
- Is there a map of who needs to talk to whom on the network? If the answer is "not sure," the network probably grew by addition, not by design.
- Are the security camera and the finance computer on the same network? If they are, a problem on one can reach the other with no barrier in between.
- Who approves a request to open a port for a vendor? If the answer is "whoever is nearby," there is no control — there is luck.
- Does anyone periodically review the access granted to former vendors? Without that review, every closed project leaves a door open behind it.
- If any single device were breached today, could it be isolated without shutting everything down? If the answer is no, the next small incident will cost like a big one.
