The thermostat, the meeting room speaker and the badge reader at the door are all convenient. They are also computers on your network, and each one is a way in if nobody is looking after it.
This is not a reason to avoid connected devices. It is a reason to add them deliberately rather than one at a time as somebody happens to buy them.
What we actually mean by IoT
Internet of Things is the umbrella term for physical devices that connect to a network: cameras, printers, sensors, access control, appliances, even the coffee machine. They collect and share data, and many act on their own without anyone touching them.
The awkward part is that these devices are often bought outside IT, installed by whoever supplied them, and then never updated. They quietly sit on the same network as your file server for the next five years.
Ten steps that deal with most of the risk
1. Write down what you have
Every smart device on the network: cameras, printers, speakers, thermostats, access readers. Model, location and who uses it. Without this list you cannot act quickly when a vulnerability is announced.
2. Change the default passwords
Factory passwords are published in the manuals. Replace them with strong, unique ones and store them somewhere the team can actually reach, which means a password manager rather than a spreadsheet.
3. Put them on their own network
A separate Wi-Fi network or VLAN for connected devices. This single step means a compromised camera cannot reach your accounting system.
4. Keep firmware updated
Check for updates on a schedule, apply them promptly, and replace devices that no longer get security updates at all. An unsupported camera is not a bargain.
5. Watch how they behave
Monitor what these devices talk to. A camera that suddenly starts sending data to an unfamiliar address is the kind of thing you want an alert about, not a surprise.
6. Decide now what you would do
Who gets called, how a device is isolated, what happens if it is part of something you depend on. Ten minutes of planning is worth a great deal at the moment it matters.
7. Turn off what you do not use
Disable unused features and block internet access where a device does not need it. Give each one the minimum it needs to do its job.
8. Have an approval step
Before a new device joins the network, someone asks two questions: does it need internet access, and does it hold anything sensitive? That is enough to catch most of the bad ideas.
9. Use encryption where you can
For data in transit and at rest. Many devices support it and ship with it switched off.
10. Review twice a year
Passwords, segmentation, firmware, and whether anything on the list has quietly been retired or replaced.
None of this requires ripping anything out. Most of it is configuration, done once, then maintained. If your network was set up properly to begin with, several of these are already true.