Endpoints come in all shapes and sizes, but the problem is that we rarely think of them as endpoints. We think of them as that wireless printer that never connects when I need it to, or that security camera we check once a month when something weird happens out on the street, or the smart TV with 100 different features we have never used, not even when it was a brand new novelty fresh out the box.
In other words, we’re so used to being surrounded by endpoints – all of which fulfill very different roles and and around our homes and offices, and are so commonplace in virtually every space we walk into – that we barely even think about them any more. They’re about as inert as the potted plant on the windowsill, and seem about as threatening, too.
But endpoints need to be understood as endpoints that carry inherent risks that can’t just be avoided because we’re not thinking about them. In any office, there are so many ‘unlocked doors’ in the form of voice-activated AI assistants, wireless devices, cameras, and even refrigerators and coffee machines, all of which are connected to the IoT and, as a result, constantly ready to compromise our privacy.
In early November 2026, it was reported that millions of dollars worth of food had been compromised in grocery stores across Europe because of a cyber-attack. It targeted their refrigeration units, turning temperatures as high as 50C, and it was possible because these refrigerators and freezers were seemingly inert endpoints, connected to the IoT, and inherently vulnerable to attack.
It seems like an extreme example, but it goes to show how something that you would never consider to be vulnerable could suddenly become a vehicle for cybercrime.
Where does the risk come from?
It’s commonplace for IoT devices to be sent from their factories with default usernames and passwords, and a lot of users don’t bother to change these – largely operating on the presumption that no one is going to be interested in hacking their smart fridge or coffee machine.
But firmware updates come inconsistently and, even then, most users don’t bother to authorise them. The trouble is that an out-of-date device with default credentials can give an attacker the key to your network. The average person doesn’t realise this, but lists of default credentials for common devices are freely available online. Nothing is out of reach unless you make it so.
How penetration testing fits Into this landscape
Network pentests map all connected devices, including the ones that you may have written off as ‘not a threat’. Professional testers will utilise pentest tooling from Cyver to deploy hackers’ own methods against your network, specifically looking to exploit IoT vulnerabilities. For stakeholders, a clear demonstration of risk is essential. Theoretical ‘what ifs’ rarely work on anyone who isn’t already knowledgeable about cybersecurity.
After that, it’s about remediating the proven threats, which is a lot more concrete than trying to remediate potential vulnerabilities that sound more suited to sci-fi movies than real life.