Contact 
At i3Secure, we often see that cyber risk does not always come from the newest threat. Sometimes it comes from older technology that still works operationally, but has quietly fallen out of security support.
Recent reporting on “zombie tech” in UK networks is a timely reminder of this issue. Long-known weaknesses in internet-connected devices, including CCTV cameras, continue to be exploited at scale. One reported example involved a vulnerability in Hikvision IP cameras, which contributed to millions of attack attempts against UK networks.
The lesson is clear: attackers do not always need new techniques when old weaknesses are still available.
For UK organisations, this is not just a technical problem. It is an asset visibility, ownership and governance problem.
What is zombie tech?
Zombie tech refers to outdated, unsupported, forgotten or poorly managed technology that remains connected to a network.
It could include:
- CCTV cameras
- routers and firewalls
- printers and scanners
- access control systems
- old servers
- unsupported software
- internet-connected equipment
- devices installed by suppliers or facilities teams
The problem is that these devices may still appear to work. A camera still records. A printer still prints. A router still passes traffic. Because nothing looks broken, there may be little urgency to replace or review them.
But from a cyber security perspective, they can become weak points.
If a device is unsupported, it may no longer receive security updates. If default passwords were never changed, attackers may be able to gain access easily. If the device is exposed to the internet, it may be visible to automated scanning tools used by criminals.
Why this matters for SMEs and larger organisations
Zombie tech affects organisations of all sizes, but the challenge often looks different depending on scale.
For SMEs, zombie tech may be a router installed years ago, a camera system managed by a third party, or a piece of software that nobody wants to disturb because it still works. In smaller organisations, there may not always be a formal asset register or a clear owner for every device.
For larger organisations, the challenge is often complexity. Devices may sit across multiple sites, departments, subsidiaries or suppliers. Some may have been installed for operational reasons without being fully visible to IT or security teams.
In both cases, the core issue is the same: if you do not know what is connected, you cannot properly manage the risk.
How zombie tech links to Cyber Essentials
The issue links closely to Cyber Essentials.
Cyber Essentials is not just about passing an assessment. It is designed to help organisations reduce exposure to common, avoidable attacks by focusing on practical baseline controls.
Zombie tech often touches several of those controls, including:
- secure configuration
- security update management
- firewalls and internet gateways
- access control
- malware protection, where relevant
Unsupported devices, weak passwords and unmanaged internet-facing services are exactly the types of risks organisations should be looking to identify and reduce.
For organisations preparing for Cyber Essentials, an asset review is often a useful starting point. It helps answer basic but important questions: what do we have, who owns it, is it supported, and does it need to be connected?
Supplier systems can create the same risk
Zombie tech is not always inside your own organisation.
It may sit with a supplier, facilities provider, outsourced IT partner, managed service provider or another third party. If that technology connects to your systems, processes your data or supports your operations, it still matters to your risk profile.
This is increasingly important as organisations focus more on supply-chain assurance. A supplier may manage CCTV, access control, connectivity, hosting, software, maintenance or operational systems. If those systems are outdated or poorly secured, they can create exposure for your organisation.
That does not mean every supplier relationship needs to become overly complicated. It does mean organisations should ask proportionate questions, especially where suppliers have access to systems, networks, premises or sensitive data.
Practical questions to ask
A useful review does not need to start with complexity. It can begin with simple questions:
- What internet-facing devices do we have?
- Who owns each device or system?
- Is it still needed?
- Is it still supported by the manufacturer?
- When was it last patched?
- Are default passwords removed?
- Does it really need internet access?
- Is it separated from sensitive systems?
- Is it managed internally or by a supplier?
- Is the risk recorded and reviewed?
These questions help turn an unknown risk into something that can be understood, prioritised and managed.
What organisations should do next
The first step is visibility. Organisations need to understand what is connected to their networks and what sits exposed to the internet.
The second step is ownership. Every device or system should have a clear owner responsible for ensuring it is supported, patched and appropriately configured.
The third step is prioritisation. Not every issue carries the same level of risk. An unsupported device exposed to the internet is very different from an isolated device on a restricted network. The aim is to focus attention where the risk is highest.
Where devices cannot be patched, organisations should consider replacing them, isolating them or restricting access. Unsupported technology should not be treated as harmless simply because it still works.
Final thought
Zombie tech is not a glamorous cyber security topic, but it is one of the most practical.
Attackers do not always need to break through strong defences. Sometimes they simply find the forgotten device that nobody is managing.
At i3Secure, our focus is on helping organisations turn cyber risk into practical, manageable action. Zombie tech is a good example: the solution starts with visibility, ownership and prioritisation.
Once you know what is connected, what is unsupported and what matters most, you can make better decisions about patching, replacement, segmentation and assurance.
If you are unsure what legacy devices, supplier systems or internet-facing services may be increasing your exposure, i3Secure can help. We support organisations with practical cyber resilience reviews, Cyber Essentials readiness and supplier assurance, helping you understand where risk sits and what to prioritise next. Contact our team for specialist support.
