The Cybersecurity Time Bomb

If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk.

The security industry, manufacturers, integrators and end customers have a massive problem treating security technology like static infrastructure. Unlike a door or a fence, security devices today are essentially networked computers and leaving them untouched for years is no different than running an old Windows XP box on the open internet, a hacker’s dream.

The "Install It and Forget It" Mentality
Most security deployments follow a familiar cycle:

Step 1. The sale is made. The customer chooses a security system based on features, cost, and brand reputation. Cybersecurity isn’t usually a significant factor in the buying decision.

Step 2. The system is installed. Integrators deploy cameras, access control, and other devices, get them up and running, and hand everything over to the end user.

Step 3. Nothing happens. No one thinks about firmware updates. No one checks for vulnerabilities. The system runs for years.

And then, one day, something happens. Maybe an attacker exploits an old vulnerability. Ransomware may lock down the entire network. Maybe an IP camera gets hijacked and used in a botnet attack. And suddenly, everyone is asking: “Why wasn’t this system secured?” The answer? Because no one took ownership of keeping it secure.

We Should Have Learned by Now
A perfect example of this problem is Mirai, the botnet that weaponized thousands of unpatched IoT devices to launch history's most significant DDoS attacks. When Mirai hit the news in 2016, it wasn’t exploiting some sophisticated zero-day (a software flaw that is unknown to the vendor or developers, meaning there is no patch or fix available).

The vulnerability had been patched years earlier. The problem was that most devices had never been updated.

Fast forward to today, and the same issue persists. Thousands of security cameras, NVRs, and access control systems are still unpatched on networks because no one prioritized updates. If Mirai wasn’t enough of a wake-up call, what would be?

A Three-way Blame Game
The problem is not just on one side. It is a perfect storm of bad habits from manufacturers, integrators, and end customers.

For their part, some manufacturers still design products with a ship-it-and-forget-it mentality. They build hardware, ship it and move on to the next model. Many devices still ship with default admin passwords that never get changed. Firmware updates are often buried on a website somewhere with no automated update process.

Worse, some manufacturers treat their products as obsolete within a few years, even if customers still use them. This leaves integrators and customers on their own to secure products never built with cybersecurity in mind.

Integrators are stuck in the middle, expected to be cybersecurity experts whether they want to be or not. If a vulnerability is discovered after deployment, customers often turn to the integrator first, even if the manufacturer has not provided an update or the system is beyond its supported lifecycle.

However, integrators are running a business, and patching is not a revenue-generating activity. Customers are reluctant to pay for ongoing cybersecurity maintenance, and many integrators do not have a built-in service model for regular updates. Making matters worse, many security devices do not have easy remote update mechanisms. If firmware updates require on-site visits or manual downloads, they often do not happen.

End customers, meanwhile, often do not think about cybersecurity until something goes wrong. IT and security teams do not always communicate, leading to security devices connected to the main corporate network without proper segmentation, running on outdated firmware, and still using default passwords years after installation. Many customers assume their security devices are secure out of the box, but that is rarely true.

Breaking the Cycle
Fixing this problem starts with recognizing that cybersecurity is not a one-time setting; it is an ongoing process. Manufacturers need to take responsibility for long-term security by supporting products for longer lifecycles and shipping products with cybersecurity features enabled.

Integrators need to shift their approach as well. Cybersecurity can no longer be an afterthought; it needs to be built into service contracts with ongoing maintenance plans that include regular firmware updates and security checks. Security technicians also need better training on cybersecurity best practices, so they are not just installing equipment but actively securing it. Instead of leaving security configurations up to the customer, integrators should ensure devices are adequately secured at installation.

End customers must stop assuming cybersecurity is someone else’s job and start demanding more transparency from manufacturers. If a vendor cannot tell you how they handle security updates, that’s a red flag. Security devices should also be segmented from the leading network to prevent a single compromised device from exposing an entire organization. Most importantly, cybersecurity maintenance needs to be budgeted for; treating it as a one-time cost is a recipe for disaster.

The solution is not a mystery; it is a matter of taking responsibility at every level. Whether you are a manufacturer, an integrator or a customer, it is time to stop passing the buck and start treating cybersecurity as the ongoing, critical process that it is.

This article originally appeared in the May / June 2025 issue of Security Today.

Featured

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.