Estimated reading time: 9 minutes
A technician services an office printer, then resets it to factory settings. Symphion CEO Jim LaRoe says many are trained to do exactly that. Any security hardening goes with the reset. On the CINI podcast, LaRoe explains why printers stay among the least protected devices on corporate networks. He also covers how attackers use them and what cyber insurance applications miss.
Get The Podcast Here
- YouTube
- Spotify
- Apple Podcasts
- Amazon Music
Printers make up about a fifth of the endpoints on a typical corporate network, Jim LaRoe said. By his count, almost none of them are protected.
LaRoe is CEO of Symphion, a Texas company that secures printer fleets as a managed service. Symphion sells that protection. It has a commercial stake in the problem.
Symphion puts the unprotected share of printers at 99%. LaRoe said the figure comes from “investigating and managing hundreds of thousands of printer endpoints” over almost a decade.
Outside testers keep finding the same problem. Rapid7 and Raxis pooled 136 penetration tests run between 2020 and 2025. In 121 of them, testers found multifunction printers with default credentials still enabled. In 97, they got admin-level access to the devices, Rapid7 reported. Rapid7 sells penetration testing. LaRoe said Symphion is recording a podcast series with the company.
Why Printer Security Gets Overlooked
LaRoe calls the printer “the Mount Everest” of the Internet of Things, its most mature device. The category also covers cameras, remote-controlled power supplies, hospital medicine pumps and building climate controls. Most run some version of Linux. Even devices of the same type differ.
Printers are “thought of as a low value endpoint,” LaRoe said. They are also mission critical. Doctors, lawyers and accountants scan, copy, email and print client data all day. The devices are “receiving, transmitting, processing, and storing the most sensitive data out there,” he said.
Ownership is part of the problem. Printers grew up outside IT. Hospitals often buy them through supply chain teams, “like rubber gloves and syringes,” LaRoe said. That leaves them outside normal IT security checks.
“It’s managed by somebody, but it’s not protected,” he said.
Printer Security And The Factory Default
Printers ship with their ports and protocols open, LaRoe said. A typical multifunction device carries its own web server, email server, FTP server, and fax server. Many phone home to the manufacturer for updates. Others report usage to a managed print provider for billing.
Manufacturers build hardening features into the devices. “But they’re not being used when they’re put on the network,” LaRoe said. The administrator password is the main gap.
Even a hardened printer can slide back. Service technicians are trained to reset devices to factory settings after a repair, LaRoe said. “I’m not saying they all do that,” he said. “But it’s something that’s been ingrained in behavior for a long time.”
A yearly review misses that drift. “Looking at it every year is not the same,” LaRoe said. “It’s not the same as continuous protection.” CINI’s Martin Hinton suggested that security is perishable. “That is exactly what it is,” LaRoe said.
Many companies cannot say how many printers they have. Some Symphion customers run fleets of more than 30,000. Devices get swapped for spares, added, and retired all the time. “It’s not like you go in the pantry and you’re gonna count the cans,” LaRoe said.
How One Printer Can Take Down A Company
The bigger risk is what a printer can reach, LaRoe said. A printer checks each user against the company’s credential system. For scan-to-email and scan-to-file, it often holds administrator access to the email and file servers too.
An attacker who controls the printer can make it “pass back credentials that the printer would normally access,” LaRoe said. That traffic “looks like normal communication.” Rapid7 has disclosed pass-back flaws in Konica Minolta and Xerox printers. Stolen credentials are already attackers’ favorite way in, Bitdefender’s incident responders say.
“We say one printer can take down a whole company. And it’s absolutely true,” LaRoe said.
AI adds speed. Printer flaws sit in the National Vulnerability Database as published CVEs. “Artificial intelligence knows all those,” LaRoe said. Most companies lack even the inventory needed to start patching, he said.
Why Printer Security Falls Between Teams
LaRoe blames the economics. Manufacturers compete on features. Managed print providers sell cost savings. “Security is not a cost elimination,” he said.
Managed print services keep printers running. They do not protect them, LaRoe said. Even when a provider hardens devices at installation, “they don’t come back to it.”
Security teams usually know about the risk. “Prioritizing it is another deal,” he said. Some companies write security terms into their five-year print contracts. LaRoe called that lip service unless the provider proves the controls work.
A real program has four steps, he said. You “implement the controls, prove that you’ve implemented the controls, monitor the controls for change, set them back.” Then you show it “in a risk register or in a board report.”
What Cyber Insurance Applications Miss On Printers
Cyber insurance applications ask about MFA and endpoint detection. LaRoe has not seen one ask about printers or other IoT devices. “We’re not dialed into the exact underwriting for everybody out there,” he added.
He expects that to change. “I believe they’re moving towards more granularity in underwriting,” he said. Graylog CMO Kimber Spradlin raised a similar gap for marketing tools on a recent CINI episode.
LaRoe also sees risk for policyholders. Some CISOs treat insurance as the backstop, he said. Yet “there’s underwriting after the claim too, lots of times.” Insurers can compare a claim with what the company said on its application. “The representations go to coverage,” LaRoe said. “I’m not vilifying the insurance companies at all.”
His questions for underwriters are short. “What’s your plan? How do you know it’s working and how do you prove it?” He would also ask how often the controls are refreshed and checked.
The controls he would look for:
- Unused ports and protocols closed.
- Admin passwords hardened and rotated every 90 days.
- Valid certificates, applied correctly.
- Firmware no more than one version behind.
- A current inventory that follows each device through its life.
Age matters too. LaRoe has seen 25-year-old printers still on corporate networks. Support for those models ended decades ago. They still print. They lack every protection a later firmware update would add.
LaRoe compared underwriting to a construction contract. The owner doesn’t dictate the builder’s methods. The owner sets the standard. “When it’s done, it better not fall down,” he said.
Printer Security In Hospitals
Healthcare shows the stakes. LaRoe walked through a routine scan appointment. Patients sign consent forms by hand. Staff print wristbands, specimen labels, and pharmacy labels. Nobody leaves without discharge papers.
“If they go down, they can’t process the patient care,” he said.
LaRoe recalled a 2018 webinar with Iliana Peters. She is a former senior HIPAA enforcement official at the HHS Office for Civil Rights. He asked her about HIPAA violations tied to unprotected printers. The most common gap, she told him, was the risk analysis. Customers ignored the warning, LaRoe said, “because they know they’re not going to get caught.”
The Cost Of Leaving Printers Unprotected
Symphion has modeled what an unprotected printer fleet costs. The model counts revenue lost in an outage, extra operating costs, and regulatory fines. It adds per-record data costs, third-party claims, class actions, and damage to reputation. By Symphion’s estimate, that bill runs “more than ten X” the cost of protection.
Companies rarely say when a breach started with a missed control. Asked why, LaRoe answered, “The lawyers.” Admitting the cause would be “leading with your chin in the prize fight,” he said. Companies say they are still investigating, “unless they’re trying to blame a vendor.”
Certificates, Zero Trust And A CISO’s Next Step
LaRoe sees zero trust as the best defense against AI-driven attacks. That means giving each printer a machine identity with a valid certificate. Certificate management tools often “stall on that last mile” at the printer, he said.
Customers are asking about shrinking certificate lifespans, LaRoe said. The maximum for publicly trusted TLS certificates fell to 200 days in March 2026. It is set to reach 47 days in March 2029. Microsoft is also moving Windows toward driverless printing, he said. Those connections need certificates too.
For a CISO this quarter, LaRoe starts with a warning about doing nothing. “You’re assuming risk whether you like it or not, right now,” he said. “And taking no action is assuming a lot of risk.”
FAQ – Printer Security
Why are printers a cybersecurity risk?
Printers handle sensitive documents and connect to email, file and credential systems. Many run with factory default settings. IT security teams often don’t monitor them.
How common are default printer passwords?
Rapid7 and Raxis reviewed 136 penetration tests from 2020 to 2025. Testers found printers with default credentials still enabled in 121 and got admin-level access in 97.
What is a printer pass-back attack?
An attacker who takes over a printer makes it hand over the credentials it uses for email, file and login systems. The traffic can look like normal printer activity.
Do cyber insurance applications ask about printers?
Symphion CEO Jim LaRoe says he has not seen one that does. Applications usually ask about MFA and endpoint detection on computers and servers.
What should underwriters ask about printer security?
LaRoe suggests three questions. What is the plan? How do you know it is working? How do you prove it? He also looks for closed ports, rotated admin passwords, valid certificates, current firmware and an accurate inventory.
Why do printers go back to factory defaults?
LaRoe says many service technicians are trained to reset devices to factory settings after a repair. That can wipe out earlier hardening.
Full Transcript
The transcript is machine-generated and lightly edited. It may contain errors. Please check the audio before quoting.
Related Cyber Insurance Posts
- AI Wrote This Ransomware Crew’s Tools. Stolen Passwords Got It In.
- One Click Can Cripple a Factory: Human Error Tops Cyber Risks in European Manufacturing(Opens in a new browser tab)
- World Password Day – The Digital Motto: “Loose Passwords Compromise Accounts”(Opens in a new browser tab)
- Retail Cybersecurity Gaps Revealed: 80% of UK Retailers Face Critical Risk, KYND Warns(Opens in a new browser tab)
- Omega Systems Expands Cybersecurity with Enterprise Password Management Solution(Opens in a new browser tab)