40,000 Exposed Security Cameras: A Wake-Up Call for Houston Business Security

Four comfortable beliefs the Bitsight numbers quietly break.

The danger with an exposed camera is not one clever feature - it is the set of assumptions that let it sit unsecured in the first place.

Most owners do not ignore their cameras out of carelessness. They reason their way into it: a camera feels like an appliance, the router feels like a wall, and the footage feels too boring to steal. Each of those beliefs is wrong in a way attackers count on.

40,000 cameras, a heavy Texas footprint, and industries a Houston owner will recognize.

Bitsight TRACE identified over 40,000 security cameras streaming live footage to the open internet, with the United States holding roughly 14,000 of them and Texas ranking among the most affected states.

The scan covered cameras running on HTTP and RTSP, the two protocols most consumer and professional systems use. Japan followed the United States with about 7,000 exposed devices, with meaningful counts in Austria, Czechia, and South Korea. Inside the United States, California, Texas, Georgia, and New York carried the highest concentrations - which puts Houston-area businesses squarely in the affected group, not on the sidelines of someone else's problem.

Set aside residential devices on telecom networks and the business picture sharpens. The technology sector was the most exposed at 28.4%, followed by media and entertainment at 19.6%, utilities at 11.9%, business services at 10.7%, and education at 10.6%. Those are not exotic verticals. A Houston engineering firm, a Gulf-Coast utility contractor, or a Cypress logistics office runs the same kinds of cameras on the same kinds of networks.

• Corporate offices where cameras face whiteboards and screens showing confidential work - remote "shoulder surfing" without setting foot on site.
• Manufacturing floors where a live feed hands competitors a view of proprietary processes and layout.
• Server rooms and IT closets where a camera helps an attacker map physical access and security blind spots.
• Healthcare settings where exposed patient-area cameras create HIPAA exposure on top of the privacy harm.

The camera is the way in - the footage is a side effect.

An internet-facing camera with weak or no authentication is a live, unmonitored device on your network, and that makes it useful to an attacker in ways that have nothing to do with what it films.

This is where the privacy framing does real harm - it makes the problem sound smaller than it is. A camera is a computer. Once an attacker controls it, they have a beachhead. The Mirai botnet made that concrete in 2016 when it pulled roughly 600,000 IoT devices, cameras included, into attacks that knocked large parts of the internet offline. That playbook did not retire. The Akira ransomware group has already used an exposed webcam to slip past endpoint protection and deploy ransomware inside a network, and exposed cameras and recorders keep showing up as muscle in denial-of-service attacks.

The U.S. Department of Homeland Security has warned that exposed cameras, particularly certain foreign-manufactured models, can be used for espionage and infrastructure mapping. On the criminal side, Bitsight noted dark-web forums trading camera IP addresses and access methods. The common thread is that the device itself is the prize. In 35 years around this work, the pattern is consistent: the breach almost never starts at the thing you were guarding. It starts at the thing you forgot was even on the network.

Getting in is not the hard part attackers worry about. Bitsight found many cameras needed only a browser, the right IP, and knowledge of common URL patterns - no exploit at all. Some HTTP cameras leak still images through alternate API endpoints even when the main login looks locked, and RTSP streams often live at predictable URLs anyone can guess. The barrier is low by design, because these devices were built for easy remote viewing, not for surviving on the public internet.

Treat every camera like the networked computer it is.

Securing cameras is not about better footage - it is about network hygiene: keep the device off the open internet, off the flat office LAN, and under active management.

• Take cameras off the public internet. Do not port-forward or expose a camera directly. If you need remote viewing, reach it through a VPN or the vendor's authenticated cloud, never a raw public IP.
• Segment cameras onto their own VLAN. IoT devices belong on an isolated network segment that cannot reach your servers, workstations, or accounting data. Segmentation turns a compromised camera into a dead end instead of a pivot.
• Change every default credential and enforce real passwords. Default and blank passwords are how most of the 40,000 got exposed. Set unique, strong credentials and disable unused accounts and services on the device.
• Patch camera firmware on a schedule. Cameras run firmware that ships with vulnerabilities and rarely updates itself. Track models, apply vendor updates, and retire devices the manufacturer no longer supports.
• Monitor for the device, not just the footage. Watch for unexpected outbound connections and traffic from camera VLANs - a camera phoning home to an unfamiliar host is often the first sign it has been recruited.

None of this requires ripping out your cameras. It requires treating them as endpoints that need the same authentication, patching, segmentation, and monitoring as any other computer on the network. That shift - from "it's just a camera" to "it's a networked computer we manage" - is the whole fix.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, with security that treats every connected device - cameras included - as part of your attack surface.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Exposed cameras are a clean example of where managed, device-aware security pays off:

• Network security assessments. We find the cameras, sensors, and forgotten devices reachable from the internet - and close the exposure.
• IoT segmentation and access control. We put cameras on isolated VLANs behind VPN-only remote access, so a compromised device cannot reach your core systems.
• Firmware and patch management. We track device models and keep firmware current, retiring gear the vendor no longer supports.
• 24/7 monitoring and incident response. We watch for the odd outbound traffic that signals a device has been recruited, and contain it fast.

If your business in Houston or Katy runs cameras, badge readers, or any other connected gear, the question is not whether they are on your network - it is whether anyone is managing them. That is doubly true for a manufacturing plant floor or a Gulf-Coast utility operation, where a camera can look straight at proprietary work. If you are not certain what is exposed, talk to CinchOps and we will find out before someone else does.