If One Device is Compromised, How Much of your Business is Exposed?

A contractor connects remotely. An employee opens a malicious attachment. A connected device goes unpatched.

Different starting points. The same question for IT leadership:

If an attacker gains access, how far could they get?

A modern firewall is an important part of the answer. So are the access rules, switching infrastructure and wireless networks behind it.

The real test is how effectively those controls limit what happens next.

The UK figures deserve attention

The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 65% of medium-sized businesses and 69% of large businesses identified a cyber security breach or attack in the preceding 12 months. These figures include attempted attacks, rather than only successful compromises. They estimated around two in five medium-sized UK businesses experienced cyber-crime in the preceding 12 months.

At the more serious end, the NCSC’s Annual Review 2025 recorded 204 nationally significant incidents, compared with 89 the previous year. These were incidents handled by the NCSC, rather than a count of every incident affecting UK organisations.

Neither finding tells us how an attacker would move through your network. They do give leadership a clear reason to examine how well the business could contain a successful intrusion.

Yesterday’s access can become today’s exposure

Most business networks develop over time.

New sites open. Applications move. Suppliers need access. Temporary exceptions are introduced to keep a project moving.

Each decision may be reasonable. The difficulty comes when the access outlives the requirement.

Consider a hypothetical example. A contractor needs remote access to maintain an application. Their account is given connectivity to an entire server subnet because that is quicker to configure.

The work finishes, but the access remains.

If an attacker later compromises that account and gets past the authentication controls, they could inherit more connectivity than the original task required.

The firewall could be enforcing its configuration perfectly while permitting access the business no longer needs.

For IT leaders, that makes policy review an operational responsibility. Every significant permission should have a purpose, an owner and a review date.

Separate networks need enforceable boundaries

Corporate devices, guest Wi-Fi, printers and building systems may already sit on separate VLANs.

That is a useful foundation. Its security value depends on the communication permitted between them.

If broad access remains available between segments, the separation may offer less protection than leadership assumes.

There is also a visibility question. Depending on the design, traffic between devices on the same subnet, or between VLANs routed through a core switch, may never pass through the perimeter firewall.

That can be a legitimate architectural choice. It needs to be understood when deciding where inspection, access controls and monitoring belong.

The practical task is to map important traffic flows and confirm which controls govern them.

Supplier access deserves closer scrutiny

The same UK Government survey found that only 30% of medium-sized businesses and 48% of large businesses formally reviewed the cyber security risks posed by their immediate suppliers.

That measures supplier risk review, rather than the security of individual remote connections. It nevertheless raises a useful question: how confidently can you account for the access external organisations have?

IT support providers, software vendors and maintenance contractors may all need different permissions.

Those arrangements should be reviewed as services and responsibilities change. Multifactor authentication remains essential, alongside restrictions on what an authenticated account can reach.

Where appropriate, use application-specific access, time-limited permissions and device checks. Remove access promptly when the requirement ends.

Measure what the business could contain

Blocked threats and quarantined files are useful operational measures. Leadership also needs evidence about the consequences of a successful intrusion.

Start with four questions:

• Which critical systems could a compromised employee device reach?
• Could a supplier account access anything beyond its intended service?
• How would the team identify and isolate suspicious internal activity?
• What would isolation interrupt, and how would essential operations continue?

A controlled exercise can test those answers before an incident does.

Choose one realistic scenario and one critical business service. Validate the permitted connections, check the available monitoring and rehearse the containment decision.

Record the gaps, assign owners and agree priorities.

Use the next refresh to review the wider network

A firewall renewal or replacement is a useful opportunity to examine the architecture around it.

Before choosing the next appliance, establish where inspection is required, which access rules remain justified and whether switching and wireless policies support the same security objectives.

Include identity, endpoint protection and operational responsibilities in that review. Containment depends on these controls working together.

At Robinscroft, we help organisations understand their network environment, identify unnecessary exposure and prioritise practical improvements across firewalls, switching and wireless infrastructure.

Start with one critical service. Establish what can reach it, why that access exists and how you would contain a compromise.

That gives your IT team a clear action plan, and your leadership team better evidence of how the business is protected.