Printer Security: How One Unsecured Printer Becomes Your Weakest Link
About 20% of enterprise endpoints are printers. Roughly 99% sit at factory defaults — storing credentials for your email server, file shares, and directory at admin level.
About 20% of the endpoints inside a typical enterprise are printers. Roughly 99% of those sit at factory defaults, with the administrator password published online and most network ports wide open. Each one stores credentials for the email server, the file server, and the directory it has to talk to — often at administrator-level privilege.
That’s the setup behind the breach Jim LaRoe, founder and CEO of Symphion, described on episode 94. One organization with 11,000 networked devices got hacked through a single printer. The attacker didn’t need a zero day. They needed a forgotten endpoint with default credentials.
Why printers are the forgotten endpoint
Printers grew up outside IT. For most of the last 40 years they sat under supply chain and procurement, alongside toner and break-fix contracts. The managed print service industry, which LaRoe estimates at $40 billion a year, sells cost reduction. Security has rarely been a line item.
That ownership gap matters. Security teams know printers are on the network, but the budget and procurement process don’t flow through them. Scanners can see a printer the same way they see a server, but the team that would have to remediate often has no authority over the fleet. So printers get bought, plugged in, and left alone — some of the least hardened devices on the network, and tier-one infrastructure in hospitals where admissions, pharmacy, and labs all depend on them.
What an attacker gets from one compromised printer
Modern enterprise printers are full IoT devices: disparate operating systems, large hard drives, web servers, FTP, fax-over-IP, scan-to-email, and direct connections to mail servers, file shares, and directory services. LaRoe puts it bluntly — a printer “receives, transmits, processes, and stores the most sensitive data of the enterprise.” Stored on the device, often at factory defaults, you can find saved SMTP credentials, file-server credentials with write access, LDAP or Active Directory credentials at admin level, cached print jobs full of PHI and contracts, and USB walk-up access that bypasses the network entirely.
A red team working a printer isn’t phishing for a foothold — they already have one. They’re pivoting. It’s the same east-west exposure that makes the perimeter insufficient on its own: once an attacker is on the printer, they’re inside the trust boundary other systems assume is safe.
Not an outlier
Public examples go back a decade. Hacktivists once probed roughly 800,000 unprotected US printers and used about 150,000 of them, mostly on university networks, to mass-print messages. That was 2015 reconnaissance, before AI made automation cheap. Becker’s Healthcare now reports cameras and printers as the top two IoT endpoints getting hacked across healthcare systems. Most incidents never get a public root cause — the lawyers see to that.
Why 99% sit at factory defaults
| Reason | What it looks like |
|---|---|
| Ownership confusion | Procurement buys, IT runs the network, security owns risk — nobody owns hardening. |
| No security line item | Managed print contracts price for break-fix and toner, not security. |
| Disparate firmware | Each manufacturer ships its own OS and access model; generic tools cover only part of the fleet. |
| Reset-to-default | Servicing a printer commonly resets it to factory. Hardening evaporates. |
| Sparse CVEs | Vendors self-report inconsistently, so databases under-represent the real attack surface. |
The honest reading: printer security isn’t a technology problem. It’s an accountability problem with technical consequences.
How to reduce the risk without a big budget
You don’t need a new platform — you need a program:
- Get an accurate inventory — make, model, firmware, location, owner. Most fleets are off by 5–10% on day one.
- Harden the admin interface on every device — replace default passwords, enforce a unique credential per device, lock down USB walk-up, disable FTP and Telnet.
- Manage configuration drift — a known-good profile per model, monitored, auto-remediated when a device drifts back to defaults after service.
- Patch firmware on a schedule — including end-of-life replacement.
- Watch certificates and outbound traffic — decide which vendor phone-home calls you actually want, and block the rest.
This is the same baseline the same discipline applies to cameras, badge readers, and every other forgotten IoT endpoint, and the same least-privilege thinking we apply to product and infrastructure security. The harder problem is putting an owner on the program — until someone has explicit authority over the fleet, printers stay parked at factory defaults. That ownership decision usually unblocks the rest.