Walk past the printer on the way to the kitchen and you are walking past a server.
“And it’s sitting out in the middle of your floor, with walk-up access to it, and it’s got all these capabilities.”
Jim LaRoe, at 34:24
Jim LaRoe is the founder and chief executive of Symphion, a Dallas company that has been in business since 1999 and that he calls the world leader in print fleet cybersecurity. Symphion protects fleets from 300 printers to more than 30,000, a lot of them in large health systems, and it got there by accident, from a database it built for a credit card outage. Jim was an engineer first and a trial lawyer second, and he talks about printers the way a good litigator talks about evidence: what is in the room, who touched it last, and who is responsible. We published this on May 5, 2026, and the show notes were 42 words. This page is the rest of it: one in five endpoints, the outage that started the company, what a printer actually holds, why nobody owns its security, the contract that redlined the security out, the technician’s reset, ten years of strangers printing to the world’s printers (Jim’s memory folds several of them into one, and the record makes his point stronger), a default password anyone can work out, what the standards already say, the tray-empty event in your SIEM, the cameras that are next, the supply chain, the assessment, AI as gasoline, a trial lawyer’s path into security, and what Symphion did after we hit stop. There are four things to try along the way: a quiz, a scorecard for whether your fleet has a program or a hope, a calculator for how many of your printers are sitting at factory defaults today, and a timeline you can filter.
One in five endpoints
I asked Jim the question I ask most guests who sell to big companies: who buys this, and is it the regulated industries? His answer started somewhere else.
“That’s a great question. One of the, you know, complacency is the enemy of cybersecurity, right? Across all the industries, 20% of their endpoints are typically printers.”
Jim LaRoe, at 5:23
I said “Wow,” and he kept going.
“And 99% of those are unprotected, sitting at factory defaults with a published administrator password on the network, all the ports open. Then you’ve got 360, all it takes is one of them to compromise the enterprise.”
Jim LaRoe, at 5:35
Both numbers are Jim’s, from a company that sees large fleets from the inside every day, and he offers them as what Symphion finds rather than as a census. The independent data points the same way. Quocirca, which has surveyed print security for years, asked 400 IT decision makers in the UK, France, Germany and the US for its Print Security Landscape 2026, and 67% of them said they “have had a print-related data loss in the past year, up from 56% in 2025,” while 81% “expect print security spend to increase in the next 12 months” (Quocirca). Losses are going up and budgets are following them, which is the moment a program gets funded.
What makes one printer worth an attacker’s time is what it touches. Jim described a “360-degree threat landscape” on every device:
“They receive, transmit, process, and store the most sensitive data of the enterprise, and they offer lateral movement, from our red hat guys that are out there doing ethical work, ethical hacking.”
Jim LaRoe, at 5:35
They store credentials for the email system, the file server and the directory, “and oftentimes that administrator, godlike privileged level, stored in the printer. So they’re like a gold mine of data and access and lateral movement capability for the bad guys, you know, both internal and external.” That last part matters. A printer is not only an internet problem. Anybody who can walk up to it or reach it on the network can try the same doors. Our companion post, How One Unsecured Printer Becomes Your Weakest Link, walks the attack path one step at a time.
The credit card outage that started it
Symphion did not set out to secure printers. In 1999 an alpha customer in the Dallas and Fort Worth Metroplex needed what it called a configuration manager database, because of a very specific bad day.
“they had an incident where somebody took down a server for maintenance, and it was really integral to their credit card processing worldwide, so they couldn’t process credit cards for about four hours on a Saturday two weeks before Christmas.”
Jim LaRoe, at 2:23
Nobody had a shared map of which infrastructure ran which application, so Symphion built one, a CMDB, kept the intellectual property, and then built agentless scanning to “fill that up and keep it filled.” Then it launched a managed CMDB service, software it makes and people it deploys to run it remotely, which went over well with the large IT outsourcers who have to report every asset, configuration and version to their customers, especially in healthcare. One of the big printer manufacturers asked Symphion to sell the service to its own customers, and in 2015, by Jim’s account, Symphion got into printers. He walked into what he called “this alternative universe of the printer endpoints, and how it’s grown for almost 40 years outside of IT and IS. And it’s really a forgotten endpoint from a cybersecurity standpoint.”
The rest of the company followed from that discovery. Printers are “IoT devices with disparate operating systems and different manufacturers’ hidden entry point API accesses with their own software,” so Symphion wrote software that controls the security settings across every make, model, brand, age and firmware version, and put it inside a managed service. The CMDB origin is the useful part for everyone else. The first problem Jim found in print fleets was the same one his first customer had at Christmas: nobody could say what was there.
If you want the longer version of the business model, Louella Fernandes of Quocirca interviewed Jim about print fleet cybersecurity as a service in March 2025.
A server in the middle of the floor
I told Jim that endpoint security, in my head, means laptops: employees, contractors, interns. Printers, at a startup, get filed under good problems to have. His answer is the reason this episode exists. Printers came out of analog, and the belief that everything is getting digitized away hasn’t come true. In a hospital, printers are tier one application support for admissions, discharge, the pharmacy and the labs, and “you can’t process patients without the printers.” One health system Symphion works with has more than 30,000 printers and 150,000 other IoT endpoints.
For forty years the manufacturers competed by adding business features, and every feature is a service: a giant hard drive, FTP, fax, email, a web server, “all sorts of servers built into it, all these ports and capabilities open.” The security features to harden all of it are there too. They are just off when the device lands on the network.
“They’re this sleeping dog over there that’s lying, waiting for something to happen.”
Jim LaRoe, at 7:00
The credentials are the part to remember. To scan to email, a printer logs in to the mail system. To scan to a folder, it logs in to the file server. To look up a name, it logs in to the directory. Researchers at Rapid7 have shown how that turns into a way in, with an attack called a pass-back. In February 2025 they disclosed two on the Xerox VersaLink C7025: change the directory server’s address in the printer’s settings, trigger a lookup, and the printer hands its stored credentials to the attacker’s machine. Rapid7 wrote that this “would allow them to capture credentials for Windows Active Directory,” after which “they could then move laterally within an organization’s environment” (Rapid7). In June it disclosed the same class of flaw on a Konica Minolta bizhub, with a plain requirement: “This attack requires access to the MFP printer admin account” (Rapid7). On a printer at factory defaults, that account’s password is published.
Jim added one more habit that would never pass review on a laptop:
“I mean, these devices are set to phone home back to the manufacturer on the network most of the time, for updates and things. Like, when would you ever do that with a [desktop]?”
Jim LaRoe, at 12:12
Nobody would allow unmonitored traffic off the network from a product manufacturer unless it was sanctioned, he said, and it happens on printers every day. Later he gave the analogy that opens this page. A printer is a server with server-class capabilities and a hard drive. If it were in the data center you would protect it physically, monitor its communications and assign it system administrators. “But you don’t.”
Nobody owns the printer
If printers are servers, why isn’t IT running them like servers? Because, Jim said, IT never had them. The endpoint grew up owned by supply chain and procurement, “not by IT, like your PCs, your laptops.” Information security has its hands full, is “blamed for everything, responsible for everything,” and is not sleeping at night. So the printer “has grown up in its own fiefdom, outside of IT’s purview and outside of information security.”
Around it sits an industry that is good at what it is paid to do. Jim put the managed print services business at forty billion dollars a year, supplying the devices, the toner, the paper and the break-fix. “They don’t have a line item for security of the devices. They haven’t had a line item.” So the security team does the reasonable thing with the tools it has. It runs the vulnerability scanner built for desktops, “your Rapid7, Qualys, Tenable, something like that,” against the printers, finds the outward vulnerabilities, and says, “Mr. IT, Mr. CIO, go fix it.” Then everyone discovers there is no budget for the fix and an awkward conversation with the people in procurement who have run the fleet for years.
“So the first thing they need to do is find an owner for it that’s willing to sponsor it, set a policy, and then enforce it. So it’s easier said than done, but that’s kind of where we’re at in that market.”
Jim LaRoe, at 7:00
This is the cheapest fix on the page, and it is the one most companies skip. At a startup, the owner can be one engineer with the authority to say what a device must look like before it gets an address on the network. Whether that person is on staff, fractional, or a partner team is the choice we walked through in In-House, On-Demand, or YOLO?, and a virtual chief information security officer is often the one who writes the printer policy for the first time. Symphion’s own line, from a June 2026 release, is the best summary of the problem: “Everybody owns part of printer and connected IoT operations, but nobody owns their security” (PR Newswire).
Redlined out of the contract
Jim told two stories back to back, and they belong together. The first was a call with a big hospital system and its chief information security officer. The print fleet had about 15,000 printers, “15 to 16,000. That’s a big difference, right?” A partner was selling the system a five-year managed print contract worth millions, and the security team said it had to include security: how would anyone harden, monitor and patch all those brands, models and locations? The partner brought in Symphion, and the call went well. Then the contract went to procurement.
“The GPO, the group purchasing organization that’s in charge of that, redlines the security out. And the CISO has no juice on that, because the supply chain has owned it.”
Jim LaRoe, at 12:12
The second story is the one in the episode title, and he told it in one breath.
“You know, big system, 11,000 devices, hacked through a printer. We love you, Symphion. We want to go with you. Well, we’re going to wait two years for a managed print service contract to be negotiated to include you in on that, before we do a single thing.”
Jim LaRoe, at 12:12
Jim doesn’t name the organization, and nothing on the tape says what was taken or how the attacker got from the printer to the rest of the network. What he is describing is a timing problem, and it is a common one. The security fix is cheap, the contract is expensive, and the contract sets the calendar. Other customers, he said, loved the whole program but could only buy the inventory and password pieces of it.
Both stories end the same way: the contract decided the security. The practical lesson for anyone about to sign one is to put the security in the document before procurement sees it, with named controls, reporting and remediation times, the same way a buyer’s security exhibit puts obligations on you. A contract that says “secure” without saying how is how a feature ends up enabled but not enforced.
The technician resets it to factory
The best story about configuration in this episode has no attacker in it. Jim was walking through what Symphion checks in an assessment, the electronic settings and then the processes around them, and he got to the one habit that undoes everything else.
“In the print industry, the human behavior is, when somebody works on a device, they reset it back to factory. So they could have the best configuration on the planet Earth, and a technician who’s been trained in doing this for even five, ten years, they’re going to reset it back to factory defaults after they work on it. And how long does it take you to discover that?”
Jim LaRoe, at 22:27
That is the printer’s version of clicking a link in an email, and it is nobody’s fault. The technician is doing the job well, and a clean reset is the fastest way to a working device. The question is the one Jim asked: how long until you know? Symphion’s answer is within hours, with “[a] standing change order [to] remediate the same day,” and the same logic covers the device nobody told security about. “Our software discovers [a] device on [a] subnet within an hour.”
New devices are the other half of it. Every fleet runs what the industry calls the IMACD process, the install, move, add, change and delete work of an IT shop, and Jim’s version on the tape is “the install, you know, move around device, add, delete process.” His point was about what falls through it.
“The big problem that these big fleets have is they have newly added devices that aren’t configured or patched or under the purview of the program.”
Jim LaRoe, at 22:27
Printers get swapped in and out. They are not in a data center with system administrators, and they don’t have a user assigned the way a laptop does, so a spare can sit on the network unconfigured for months. Sometimes it is there “because the network drop doesn’t communicate with the security group.” A program that only checks a printer when it is installed will always be behind.
Hardening, then, is not a project. It is a state you check for, every day, on every device, which is the whole difference between a scan and a program. The calculator further down turns your fleet size, service visits and time to discovery into the number of printers sitting at factory defaults on an average day.
Ten years of printing to strangers
Jim reached back a decade for the evidence that this is not theoretical.
“Ten years ago, there were highly published hacks, where hacktivists went out there, and they found, like, one of them found 800,000 unprotected printers in the United States, and sent out some anti-Semitic stuff to all the universities across the country, to 150,000 of them, to print.”
Jim LaRoe, at 16:12
“And then there was another one, where Cybernews did a pick, twenty-eight thousand of them, and printed out how-to-protect-your-printer manuals on that.” Every number he gave is real, and they come from at least four different events. The record is better than his version, because it shows the same thing happening again and again.
- March 2016. Andrew Auernheimer, the troll known as weev, sent an anti-Semitic flier to printers across the United States and claimed it reached about 20,000 of them, many at colleges and universities, over port 9100, the raw printing port. A Shodan search by Motherboard that week found more than 14,000 printers at US colleges and universities open to anyone (Motherboard).
- February 2017. A teenager calling himself Stackoverflowin said he sent a printout to about 150,000 printers telling their owners the printer was “part of a flaming botnet,” through the printing ports, LPD, IPP and 9100 (Motherboard). The 150,000 is his.
- November 2018. A hacker calling himself TheHackerGiraffe found printers with Shodan, used the open-source Printer Exploitation Toolkit, and printed a message telling people to subscribe to PewDiePie on 50,000 of them. He told Engadget he thought about 800,000 printers were exploitable (Engadget).
- August 2020. Cybernews found more than 800,000 printers with network printing enabled and reachable from the internet, picked 50,000, and printed a short guide to securing printers on 27,944 of them (Cybernews). This is the one Jim named, and his number is right.
- November 2021. Receipt printers at businesses around the world started printing an antiwork manifesto that opened “ARE YOU BEING UNDERPAID?” (Motherboard). GreyNoise first saw the traffic on November 24 and counted more than 60 source addresses in about a week, with the cause in one sentence: “Printers, when exposed to the Internet over port 9100, will print any plaintext received” (GreyNoise).
The 2018 one is the version most people remember, because it was funny for about a day.
Apparently someone is hacking unsecure work printers all over the world and printing this message. This is not a meme.
Dr Grandayy (@grandayy) · November 30, 2018
The joke had been around for years by then. When the 150,000-printer story reached Hacker News in February 2017, one reader summed up the whole category in seven words.
"The "S" in IoT stands for security :)"
milesf, on Hacker News, under "UK Teen Hacked 150,000 Printers," February 2017
The research community took it seriously the same year. At the IEEE Symposium on Security and Privacy in 2017, Jens Müller, Vladislav Mladenov, Juraj Somorovsky and Jörg Schwenk of Ruhr University Bochum tested 20 printer models from different vendors and found every one of them vulnerable to at least one attack, from simple denial of service to pulling print jobs and system files off the device, and released the Printer Exploitation Toolkit as open source (Ruhr University Bochum). That is the same toolkit TheHackerGiraffe used a year later. Open tools cut both ways, and the good way is simple: the checks an attacker would run are the checks a penetration test that includes your printers runs first, with permission.
The 2021 wave got the reaction a lot of engineers had to all of them.
Someone is targeting network-attached receipt printers on the public internet and just printing copies of the r/antiwork manifesto and this is glorious
Matthew Garrett (@mjg59) · November 29, 2021
None of these needed a zero day. Each one needed a printer that would accept a job from anyone, and a list of where to find them. Jim’s conclusion was about what comes next: “They didn’t even need AI back then. And now it’s off the chain.”
A default password anyone can work out
Three times on the tape Jim described the administrator password on a printer as published. On a lot of models, he said, it is something “like 0123456, published on the internet at default.” In June 2025 researchers showed a worse version, where the password is unique to each device and still easy to get.
Rapid7 disclosed eight vulnerabilities affecting 748 printer and multifunction models across five vendors, 689 of them from Brother, plus 46 from Fujifilm Business Innovation, 6 from Konica Minolta, 5 from Ricoh and 2 from Toshiba. The critical one, CVE-2024-51978, rated 9.8, is in how the default administrator password is made: during manufacturing, a procedure “transforms a serial number into a default password.” Anyone who learns the serial number can work out the password, and a second flaw, CVE-2024-51977, leaks the serial number to an unauthenticated attacker over the web interface or IPP, with PJL and SNMP as fallbacks. The fix is the hard part. Rapid7 reported that Brother “has indicated that this vulnerability cannot be fully remediated in firmware,” because the password comes from the factory, so only devices made after a change to the manufacturing process are fully fixed (Rapid7).
Hundreds of Brother printer models have an unpatchable security flaw
The Verge (@verge) · June 30, 2025
Put this next to the pass-back research earlier on the page and Jim’s whole argument is in one chain: a default administrator password, the settings page it unlocks, and the directory credentials the printer hands over. The good news is that the defender’s version of the chain is short. Changing the administrator password to a unique one on every device, and keeping it changed after every service visit, breaks it at the first link.
What the standards already say
I asked Jim whether there is an ISO standard or another prescriptive framework that makes a big organization get its printers audited. “Yes and no,” he said, and started with the vulnerabilities.
“They don’t self-report that much, and there’s a dearth of CVEs on the printers. It’s just what the printer manufacturers decide they’re going to do, right?”
Jim LaRoe, at 26:43
Printers don’t have the competitive disclosure culture of other endpoints, he said, and so the scanner has less to find. That is changing because researchers are looking harder. The Brother disclosure alone added eight CVEs across five vendors, and every pass-back above has a CVE of its own. The guidance has been there longer. “NIST came out in 2015 with an IR, I think it’s IR 8023. It was a standard just for replication devices, okay?” He has it right: NIST Interagency Report 8023, Risk Management for Replication Devices, published in February 2015, covers copiers, printers, scanners and multifunction devices (NIST). Jim’s read is that later NIST guidance folded it into its general controls without naming printers. The Defense Information Systems Agency also keeps a Security Technical Implementation Guide for multifunction devices and network printers, the checklist the Department of Defense applies to its own (DISA STIG), and Symphion builds both into its program.
“There are others out there, but, man, it’s, this is blocking and tackling. I mean, it’s just like, inventory, okay, passwords, shut down the unused ports and protocols of communications.”
Jim LaRoe, at 26:43
Then come the parts that make printers different. Certificates have to be updated and stored, and “we’re narrowing the time limit on certificates now, because they’ve got to be changed.” For publicly trusted certificates that is literal: the CA/Browser Forum’s 2025 ballot cut the maximum validity to 200 days from March 15, 2026, then 100 days in 2027 and 47 days in 2029 (DNSimple). Most printers use internal certificates, but the direction is the same, and a fleet that renews by hand will fall behind. Firmware notes are thin, because one update can cover the scanner, the sorter, the operating system or security, and people keep printers long after the manufacturer stops making firmware for them. The result is a category Jim described in one line: “unpatched, unsupported, end-of-life devices sitting out there, with no users, no systems looking at it, no DLP, no nothing.” They are not segmented, and they are trusted, because they have to reach the email system, the file server and the directory to do their jobs. “They’re right there inside your most, like, trusted inner space.”
He ended the answer on why there are so few printer breach statistics. “Nobody’s talking about root cause now, man.” Companies rarely publish how they were breached unless they are blaming someone, so he can’t tell anyone the odds of being hacked through a printer, only that the doors are open. That is also why the controls above are worth doing without waiting for a statistic. They are cheap, they are built in, and every one of them closes a door that has already been used.
My tray is full
When Symphion first got into printers, customers asked the obvious question: can you connect this to my SIEM, the security information and event management system? Symphion talked to IBM about QRadar and others, turned logging on, and found the problem every security team finds.
“the logs are filled on a printer with non-security events, you know, just tons of non-security events that are like, my tray is full or empty.”
Jim LaRoe, at 34:24
Even when the one security event is in there, someone has to find it, open a help desk ticket, and wait for a service vendor to send a truck to the device. “What’s the time limit on that, man?” Symphion’s answer is to watch the configuration instead of the log: “We see it happen, we remediate it back, standing change control.” The lesson travels. Send your SIEM the handful of printer events that matter, an administrator login, a configuration change, a firmware change, a device nobody has seen before, and leave the paper trays out of it. Alan Braithwaite of RunReveal made the same case about all logs on episode 50, and our 24/7 monitoring and response is built around exactly that short list: new arrivals, configuration drift and outbound traffic that should not exist.
Jim also put the cost side plainly. Against the cost of the risk, the security is “nothing,” because a breach brings ransom, notification, lawsuits and regulators. “Just look at GDPR. Just look at CCPA. You steal private information, it’s expensive to recover from that.”
Cameras are next
Printers, in Jim’s phrase, are “the top of Mount Everest of complexity for IoT, Internet of Things devices,” forty years of features on a different operating system from each manufacturer. If you can run a program for printers, the rest of the building is easier, and Symphion is already “doing cameras, we’re doing power supplies, things like that, that are all hackable and entry points into the network out there as well.” When I asked what success looks like, he ended up at the cameras.
“How many IP cameras do you have on your network? You know, they have an administrator password that needs to be hardened. They communicate via old, arcane SNMP versions that are unhardenable.”
Jim LaRoe, at 31:38
SNMP, the Simple Network Management Protocol, is how a lot of devices report status, and its older versions authenticate with a community string sent in the clear. Version 3 added user-based authentication and encryption in 2002 (RFC 3414), and plenty of devices are still set up with the older versions. Then Jim cited a ranking: Becker’s Healthcare, he said, reported that “the number one and two IoT endpoints getting hacked in healthcare systems are the cameras and the printers.” We could not find that Becker’s article, and we did find published research that matches it. In April 2023, Armis analyzed the devices it monitors in clinical environments and ranked IP cameras as the riskiest IoT device, with 56% carrying critical severity unpatched CVEs, and printers second, with 37% carrying unpatched CVEs and 30% critical (Armis).
His fix for all of it is the least exotic advice in security, and that is a compliment.
“Let’s just use the built-in features. Each manufacturer has incredible features built into devices to protect them. They’re just not being used, and they have to be programmatically enabled.”
Jim LaRoe, at 31:38
No traffic sniffer, no new appliance. “It takes work to set that stuff up. You got to do some work.” The whole class of forgotten devices, and a 30-day program sized for a startup, is in our companion post, IoT Device Security.
Everybody uses printers
I said what I believe about this: you are only as secure as your weakest link, and printers sneak in with the best intentions in the world, even at a small private practice or a dental office that needs to print patient information. Jim widened it to the supply chain.
“Not just the vendors, like the HVAC vendor at Target or something like that, but you got all the vendors, and it’s all the way into the supply chain, and everybody uses printers.”
Jim LaRoe, at 30:56
The Target reference is the classic one. In 2014 Brian Krebs reported that the attackers behind Target’s breach first got in with network credentials stolen from its heating, ventilation and air conditioning contractor (Krebs on Security). Jim’s point is that the confidential information supply chain is bigger than the vendors with network access. It includes “your lawyers, you got your accountants,” everybody who handles the data, and every one of them has a printer. The big push on supply chain at the Department of Defense and in financial services is where this lands first. A defense supplier working toward CMMC Level 2 has to account for the printer in the office as much as the laptops, and a practice under HIPAA has the same printer holding the same patient records.
Measure before you cut
Not every customer believes the risk is there. Some have, in Jim’s words, “the hard case board member that can’t believe that our printers are at risk,” and for them Symphion built an assessment.
“we do electronic assessment, process assessment, give them a board-ready report in plain English that shows them the risk, you know, scoring for how bad it is.”
Jim LaRoe, at 21:17
I said it sounded like measuring before you cut. “Yeah, it’s, we’ll fail everybody.” The assessment has twenty points. Ten are electronic, checked on a 500-device swath of the fleet: the passwords inside the device, the encryption of the hard drive, the USB port for walk-up access, the configuration ports. Ten are about process, how the fleet handles installs and changes, the CMDB, and how a reset gets caught. The second offering is the light version for the same reluctant customers, an evergreen inventory, life cycle management of every device, plus full password management, “settings for timeout, lockout, all that kind of stuff that is not being done,” at a lower price point “[to] try to stimulate the complacency movement.” Symphion announced both, the Enterprise Assessment and a lighter package it calls PFCSAAS Lite, in a release dated December 8, 2025 (PR Newswire).
The plain English report is the part to copy, even if you never buy one. A board doesn’t need port numbers. It needs the fraction of devices at defaults, who owns them and the date it will be fixed, which is the same shape as the security slide your board deck is missing.
Gasoline on a raging fire
The printer problem is old, and Jim thinks the timing just changed. The hacks of a decade ago didn’t need AI, and now attackers have it. “It’s like putting gasoline on a raging fire already, because you’ve got these vulnerabilities sitting there that are wide open.” The people Symphion talks to on the offensive side already know where to start.
“They’re like, man, if I want to fail somebody, I go after the printers every time.”
Jim LaRoe, at 16:12
“AI is just going to make everything happen that what’s going to happen anyway is going to happen much more quickly.”
Jim LaRoe, at 17:25
That is a sober way to say it. AI doesn’t create the open door, it shortens the time between someone listing the doors and someone walking through one. Jesse Anglen made the attacker’s version of the same argument on episode 106, and our post on AI agents on both sides of the breach covers the defender’s. Jim’s answer was modest on purpose: “let’s put at least speed bumps in for what’s going on with the AI.” The printers are essential, numerous and risky. “We can’t just ignore them, you know, continue to ignore them. It’s just going to be our downfall to do that.” The defender’s speed bump is the same kind of automation, every device checked every hour, so the window an attacker can find keeps closing.
An engineer who went to the dark side
I asked Jim about his proudest day as an entrepreneur. “No, we’re still looking forward to the proudest days.” Every day brings successes and challenges, he said, and the work is building processes, adapting them, hiring smart people and empowering them. Was Symphion bootstrapped?
“You know, we’re making money, man. And we’ve been in business 25 years. We’re a very profitable company.”
Jim LaRoe, at 18:20
They did go through an accelerator in Austin, Capital Factory, a few years back, and talked to some of the printer manufacturers about investing, but the terms weren’t right. The best thing the accelerator gave them was an introduction to the Small Business Innovation Research program, and Symphion won two. The public record shows two Air Force Phase I awards in 2021, each for $49,723 and both naming James LaRoe as principal investigator, one for print fleet cybersecurity and one for critical infrastructure cybersecurity (Print Fleet Cybersecurity, Critical Infrastructure Cybersecurity). Jim said the chief information security officer of one of the armed forces was ready to take them straight to the third stage, until a new chief technology officer arrived with a different approach, and that the work meant adapting the technology and process to the government’s multiple layers of confidentiality. “But we, yeah, we won two of them, man.”
Before any of it, he was a lawyer. “Lawyer. Trial lawyer. Trial lawyer.” I guessed he must be brutal in negotiations, and he deflected: he is an engineer by training. “Yeah, I engineered first and then went to the dark side.” I have a lot of friends who made that move, because the logic of computer science carries over to law well. Jim’s version was about people: the hard part is “figuring out the human piece of it, you know, the complacency piece in cybersecurity.”
The history you don’t know
My last question was the one I ask everyone: if you could meet your younger self, what would you say? Jim has four children, two sons and two daughters, and gives them that advice all the time. For himself, maybe get on this risk sooner, “but it’s, it’s gotta marinate.” We are the sum of our experiences, he said, in an industry that is always focused on the latest technology, “especially out where you are.” Then he reached for Truman.
“The only thing new in the world is the history you don’t already know.”
Jim LaRoe, at 38:48
The usual version of the line is shorter, “The only thing new in the world is the history you don’t know,” as the Christian Science Monitor collected it among Truman’s aphorisms (Christian Science Monitor). Jim’s point survives either way. The printer has a long history, and it is not new that it is a risk. What changed, he said, is that Symphion decided to talk about the risk more, because its partners approach it differently and customers need to know how easy it is to fix.
“You can’t eliminate the bad stuff, but you can sure mitigate it, and with some basic steps.”
Jim LaRoe, at 38:48
I told him I loved how he put that, that it is so easy to fix. “It is.” Then the line that ends the conversation: “It’s an easy, it’s an easy button.”
What happened after the tape
Five weeks after the episode aired, on June 9, 2026, Symphion announced the Symphion Managed Endpoint Cybersecurity Operations Program for Printers and Connected IoT, which reads like the conversation turned into a service: an inventory refreshed every hour, drift detection twice a day, and remediation the same day. Its release carried the ownership line quoted earlier, and one more: “Organizations don’t need more tools or staffing burdens” (PR Newswire). At the end of July, Jim posted the test that the scorecard below is built on.
Most orgs say, “we do what we can” on their printers and connected IoT like cameras.
Jim LaRoe · July 29, 2026
Very few have a real, governed control.
Quick test:
Can your printer protection and governance program be described clearly in one breath?
A real program can always answer:
What’s in scope
What “protected” means
How do you know devices are in that state
Who is accountable when they are not
If the answer is a tool name or a contract clause, it isn’t a program.
It’s hope.
In October he sat down with Cyber Insurance News for a longer version of the same argument, including the service reset that undoes the hardening and the pass-back attacks that turn a printer into a credential leak.
“If the answer is a tool name or a contract clause, it isn’t a program. It’s hope.” That is the episode in two sentences, three months after it aired.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Jim actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
Across industries, what share of enterprise endpoints are printers, by Jim's count?
- About 5 percent
- About 20 percent
- About half
b. "Across all the industries, 20% of their endpoints are typically printers." And 99% of those, he said, sit at factory defaults. Transcript, 5:23.
-
What does a printer technician usually do after working on a device?
- Installs the latest firmware
- Files a change ticket with security
- Resets it back to factory defaults
c. "when somebody works on a device, they reset it back to factory." Even after the best configuration on the planet. Transcript, 22:27.
-
Who took the security out of a health system's five-year managed print contract?
- The group purchasing organization
- The chief information security officer
- The printer manufacturer
a. "The GPO, the group purchasing organization that's in charge of that, redlines the security out." Transcript, 12:12.
-
Which NIST publication did Jim cite as the standard written just for printers and copiers?
- NIST SP 800-53
- NIST IR 8023
- The NIST Cybersecurity Framework
b. "NIST came out in 2015 with an IR, I think it's IR 8023." It is Risk Management for Replication Devices, February 2015. Transcript, 26:43.
-
Which two IoT endpoints did Jim say are hacked most in healthcare systems?
- Infusion pumps and badge readers
- Thermostats and smart TVs
- Cameras and printers
c. "the number one and two IoT endpoints getting hacked in healthcare systems are the cameras and the printers." Armis's 2023 ranking matches. Transcript, 31:38.
-
What did Jim do before he became an entrepreneur?
- He was a trial lawyer, and an engineer before that
- He ran a printer dealership
- He was an Air Force officer
a. "Lawyer. Trial lawyer. Trial lawyer." He was an engineer by training before that. Transcript, 20:52.
Is your print fleet a program or a hope?
Jim’s test is whether your printer program can be described clearly in one breath: what is in scope, what protected means, how you know the devices are in that state, and who is accountable when they are not. This scorecard asks eight questions about the fleet you have today, in the order the episode raises them, and tells you whether you have hope, part of a program, or the whole thing.
Scorecard · eight questions
Is your print fleet a program or a hope?
Answer for every printer and multifunction device on your network, including the spares, the ones at the front desk and the ones a landlord or a vendor plugged in. Answer for how things run today, not the policy.
-
Can you say how many printers you have, where they are, and what firmware they run?
- No, or only roughly
- A list that gets updated when someone remembers
- An inventory that refreshes itself, at least daily, and catches new devices
Jim's first customer, in 1999, had the same problem with servers. A health system that thinks it has "15 to 16,000" printers has a finding before the scan starts.
-
Who owns the security of the printers?
- Nobody, or the managed print vendor
- IT, informally
- A named person with a written policy and the authority to enforce it
"find an owner for it that's willing to sponsor it, set a policy, and then enforce it." A virtual chief information security officer can hold it until you hire one.
-
What is the administrator password on your printers right now?
- The factory default, or nobody knows
- Changed, but the same on every device
- Unique per device, stored in a password manager, and checked
On hundreds of Brother models the default can be worked out from the serial number. Changing it breaks the whole chain.
-
Which services are open on the printers?
- Whatever shipped: web, FTP, telnet, raw printing on 9100
- Some closed on newer devices
- Only what you use, on every device, and nothing reachable from the internet
Every mass print job of the last ten years used a printer that accepted jobs from anyone, most often on port 9100. Five of them, with sources.
-
When a technician resets a printer to factory defaults, how long until you know?
- We would not know
- At the next scan, weeks or months later
- Within hours, with a standing change to fix it the same day
"And how long does it take you to discover that?" The calculator below turns your answer into printers sitting open on an average day.
-
How are firmware updates and end-of-life printers handled?
- Updated when something breaks, and old models stay until they die
- Some models patched, unsupported ones still in service
- Patched on a schedule, and unsupported models retired on a date
"unpatched, unsupported, end-of-life devices sitting out there" are the ones nobody is watching. Retiring them is a security control.
-
What account does the printer use for scan-to-email, scan-to-folder and directory lookups?
- A privileged account, even a domain administrator
- A shared service account with broad access
- A dedicated least-privilege account for each function, rotated
A pass-back attack hands over whatever account the printer uses. Rapid7's advice is to keep privileged domain accounts out of it.
-
Does your managed print contract say who secures the devices, and how?
- There is no security line item
- Security is mentioned, not measured
- Named controls, reporting and remediation times are in the contract
Security redlined out of a five-year contract stays out for five years. Write it in before procurement does, like a security exhibit.
Nobody can say exactly how many printers there are, the administrator passwords are whatever shipped, and a reset would go unnoticed until the next scan. That is the fleet Jim says he finds almost every time, and the fix starts this week: name an owner, find every device, and change every administrator password to a unique one.
There is an owner and an inventory, but the checks happen at installation or at the next scan, so service visits and spares reopen the doors in between. Add a daily configuration check, close the services you don't use, move scan-to-email and the directory to least-privilege accounts, and put the controls in the next contract.
What is in scope, what protected means, how you know, and who is accountable, all answered. Keep it that way: check after every service visit, retire unsupported models on a date, and extend the same program to the cameras and the rest of the building.
How many printers are open today?
Jim’s question about the technician’s reset was “how long does it take you to discover that?” This calculator answers it for your fleet: how many printers go back to factory defaults in a year, how many are sitting at defaults on an average day while you wait for the next scan, and how much of that goes away when the check runs all day. Change the numbers to yours.
Calculator
How many printers are open today?
A fleet, how often a technician works on each device, how often that ends in a factory reset, and how long a reset device waits before someone notices.
With 2000 printers, 2 service visits each a year and 50 percent of visits ending in a factory reset, about 2,000 printers a year go back to their defaults. If it takes 90 days to notice, about 493.2 printers are sitting at factory defaults on an average day, 180,000 printer-days a year. Catching a reset within 12 hours brings that to about 2.7, roughly 180 times fewer.
The average day count is resets a year times the days each one stays open, divided by 365. It assumes resets are spread evenly through the year and that a printer at defaults is open until it is found. The 2,000 printers, two visits a year, 50 percent reset rate and 90-day wait are placeholders, not research. Jim's account is that technicians reset after they work on a device, so use your own service records. Symphion says it finds a reset within hours, and its June 2026 program checks for drift twice a day.
A quarter century of printers on one line
Everything on this page sits on one timeline, from the credit card outage that started Symphion to the week this page was written. Filter it by thread.
Timeline · 1999 to 2026
A quarter century of printers on one line
Filter by thread. Dates are from the public record except where marked as Jim's own account on the tape.
- A credit card outage
A server taken down for maintenance stops card processing for four hours two weeks before Christmas, and Symphion builds a CMDB.
- Target, through the HVAC contractor
The attackers' first credentials came from a heating and air conditioning vendor (Krebs on Security).
- NIST IR 8023
Risk Management for Replication Devices, the report Jim cites (NIST).
- Into printers
A printer manufacturer asks Symphion to sell its managed CMDB to its customers, and "a forgotten endpoint" appears.
- Fliers to about 20,000 printers
Anti-Semitic fliers, many at colleges, over port 9100, by the sender's claim (Motherboard).
- About 150,000 printers
Stackoverflowin's printout calls each printer "part of a flaming botnet" (Motherboard).
- Twenty models, twenty vulnerable
Ruhr University Bochum at IEEE Security and Privacy, and the Printer Exploitation Toolkit (RUB).
- Subscribe to PewDiePie
About 50,000 printers, found with Shodan, by the sender's claim (Engadget).
- 27,944 security guides
Cybernews finds more than 800,000 exposed printers and prints a how-to on 27,944 (Cybernews).
- Two Air Force SBIR awards
Phase I, $49,723 each, print fleet and critical infrastructure cybersecurity (Inknowvation).
- Receipt printers start talking
Antiwork manifestos over port 9100 from more than 60 addresses (GreyNoise).
- Cameras first, printers second
Armis ranks the riskiest IoT devices in clinical environments (Business Wire).
- Pass-back on a Xerox
Change the directory server, capture Active Directory credentials (Rapid7).
- Print fleet cybersecurity as a service
Jim with Louella Fernandes of Quocirca (YouTube).
- 748 models, one serial number away
Eight vulnerabilities, five vendors, a default password Brother can't fully fix in firmware (Rapid7).
- The assessment and the light version
The Symphion Enterprise Assessment and PFCSAAS Lite (PR Newswire).
- Losses up to 67%
Quocirca's Print Security Landscape 2026, from 56% a year earlier (Quocirca).
- 200-day certificates
The first step of the CA/Browser Forum schedule that ends at 47 days in 2029 (DNSimple).
- Episode 94 airs
This conversation. "It's an easy, it's an easy button."
- A managed operations program
Inventory every hour, drift checks twice a day, remediation the same day (PR Newswire).
- "It's hope."
Jim's one-breath test for a printer program (LinkedIn).
- The printer is a door
Jim on Cyber Insurance News (YouTube).
What to do this week
Four things, in the order Jim would do them.
- Name the owner, then count. Write down one person who owns printer security, with the authority to set and enforce the policy. Then find every printer, copier and multifunction device on every subnet and compare the list with what you think you have. Every gap is a finding, and so is every spare nobody told security about.
- Change every administrator password. Make it unique per device and keep it in your password manager. Close the services you don’t use, from FTP and telnet to raw printing, and make sure no printer accepts jobs from the internet.
- Catch the reset. After every service visit, check the configuration. Better, check every device every day, and send your SIEM only the events that matter: administrator logins, configuration and firmware changes, and devices you have never seen before.
- Write it into the contract. At the next managed print renewal, put named controls, reporting and remediation times in the document before procurement sees it, and move scan-to-email, scan-to-folder and the directory lookup to least-privilege accounts.