Forescout’s annual “Riskiest Connected Devices” report is out for 2026, and the findings point to a fast-expanding set of device categories presenting serious risk to enterprise networks. Published by Forescout Research’s Vedere Labs at RSAC 2026, the report analyzed millions of devices in Forescout’s Device Cloud using a multifactor risk scoring methodology.

The headline finding: network infrastructure now represents the highest overall risk, surpassing traditional endpoints. Routers moved from fifth place in 2025 to first in IT, and now account for roughly one-third of the most critical vulnerabilities in organizational networks. Routers and switches average nearly 32 vulnerabilities per device.

Eleven device types appear on the riskiest list for the first time this year, including serial-to-IP converters and workstations in IT; printers, time clocks, and RFID readers in IoT; power distribution units, I/O modules, and BACnet routers in OT; and medication dispensing systems, medical image printers, and DICOM gateways in IoMT. Forescout notes that 40% of the riskiest device types were not on the list last year, and 75% were not on it two years ago.

“Organizations are connecting more specialized devices than ever, many of which are unmanaged and unagented, and adversaries are evolving their attacks accordingly,” said Barry Mainz, CEO of Forescout. “Threat actors are increasingly exploiting east-west traffic and could target emerging device categories like serial-to-IP converters, medication dispensing systems, and RFID readers. Once a foothold is gained through one of these devices, attackers move laterally across networks to evade traditional, perimeter-focused security layers.”

The report also highlights legacy operating system exposure accelerating with the end of Windows 10 support. Legacy Windows OS is most prevalent in retail (39%), healthcare (35%), and financial services (29%). Telnet usage, despite being unencrypted, rose across most sectors, with financial services going from 3% to 12% exposure and manufacturing from 5% to 12%.

“We are seeing ransomware threat actors leveraging routers and IP cameras, while malware jumps from IT networks into OT workstations and even medical systems,” said Daniel dos Santos, VP of Research at Forescout. “Defenders need security strategies that can identify, prioritize and reduce risk across IT, OT, IoT, and IoMT domains.”