Page 2 of 2

The Cybersecurity Time Bomb

• May 19, 2025

If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk.

The security industry, manufacturers, integrators and end customers have a massive problem treating security technology like static infrastructure. Unlike a door or a fence, security devices today are essentially networked computers and leaving them untouched for years is no different than running an old Windows XP box on the open internet, a hacker’s dream.

The "Install It and Forget It" Mentality
Most security deployments follow a familiar cycle:

Step 1. The sale is made. The customer chooses a security system based on features, cost, and brand reputation. Cybersecurity isn’t usually a significant factor in the buying decision.

Step 2. The system is installed. Integrators deploy cameras, access control, and other devices, get them up and running, and hand everything over to the end user.

Step 3. Nothing happens. No one thinks about firmware updates. No one checks for vulnerabilities. The system runs for years.

And then, one day, something happens. Maybe an attacker exploits an old vulnerability. Ransomware may lock down the entire network. Maybe an IP camera gets hijacked and used in a botnet attack. And suddenly, everyone is asking: “Why wasn’t this system secured?” The answer? Because no one took ownership of keeping it secure.

We Should Have Learned by Now
A perfect example of this problem is Mirai, the botnet that weaponized thousands of unpatched IoT devices to launch history's most significant DDoS attacks. When Mirai hit the news in 2016, it wasn’t exploiting some sophisticated zero-day (a software flaw that is unknown to the vendor or developers, meaning there is no patch or fix available).

The vulnerability had been patched years earlier. The problem was that most devices had never been updated.

Fast forward to today, and the same issue persists. Thousands of security cameras, NVRs, and access control systems are still unpatched on networks because no one prioritized updates. If Mirai wasn’t enough of a wake-up call, what would be?

A Three-way Blame Game
The problem is not just on one side. It is a perfect storm of bad habits from manufacturers, integrators, and end customers.

For their part, some manufacturers still design products with a ship-it-and-forget-it mentality. They build hardware, ship it and move on to the next model. Many devices still ship with default admin passwords that never get changed. Firmware updates are often buried on a website somewhere with no automated update process.

Worse, some manufacturers treat their products as obsolete within a few years, even if customers still use them. This leaves integrators and customers on their own to secure products never built with cybersecurity in mind.

Integrators are stuck in the middle, expected to be cybersecurity experts whether they want to be or not. If a vulnerability is discovered after deployment, customers often turn to the integrator first, even if the manufacturer has not provided an update or the system is beyond its supported lifecycle.

However, integrators are running a business, and patching is not a revenue-generating activity. Customers are reluctant to pay for ongoing cybersecurity maintenance, and many integrators do not have a built-in service model for regular updates. Making matters worse, many security devices do not have easy remote update mechanisms. If firmware updates require on-site visits or manual downloads, they often do not happen.

End customers, meanwhile, often do not think about cybersecurity until something goes wrong. IT and security teams do not always communicate, leading to security devices connected to the main corporate network without proper segmentation, running on outdated firmware, and still using default passwords years after installation. Many customers assume their security devices are secure out of the box, but that is rarely true.

Breaking the Cycle
Fixing this problem starts with recognizing that cybersecurity is not a one-time setting; it is an ongoing process. Manufacturers need to take responsibility for long-term security by supporting products for longer lifecycles and shipping products with cybersecurity features enabled.

Integrators need to shift their approach as well. Cybersecurity can no longer be an afterthought; it needs to be built into service contracts with ongoing maintenance plans that include regular firmware updates and security checks. Security technicians also need better training on cybersecurity best practices, so they are not just installing equipment but actively securing it. Instead of leaving security configurations up to the customer, integrators should ensure devices are adequately secured at installation.

End customers must stop assuming cybersecurity is someone else’s job and start demanding more transparency from manufacturers. If a vendor cannot tell you how they handle security updates, that’s a red flag. Security devices should also be segmented from the leading network to prevent a single compromised device from exposing an entire organization. Most importantly, cybersecurity maintenance needs to be budgeted for; treating it as a one-time cost is a recipe for disaster.

The solution is not a mystery; it is a matter of taking responsibility at every level. Whether you are a manufacturer, an integrator or a customer, it is time to stop passing the buck and start treating cybersecurity as the ongoing, critical process that it is.

This article originally appeared in the May / June 2025 issue of Security Today.