Ask a security team how many endpoints they have and you will get a confident number. Ask how many devices are on the network and the number gets softer, and the gap between the two is where a lot of intrusions live.
The devices in that gap are not exotic. They are the infusion pump, the badge controller, the label printer on the warehouse floor, the imaging workstation running an operating system whose support ended during a previous decade. They are load-bearing, they cannot be patched on your schedule, and several of them cannot be taken offline at all without a clinical or operational consequence.
Why adversaries end up there
Not always by design. A relay gets chosen because it is reachable from the compromised host and can reach the next segment — and unmanaged devices are disproportionately likely to satisfy both, precisely because they were never included in the segmentation review. Easily add content here at will.
The consequence is the same either way. A hop that runs no agent produces no endpoint telemetry, appears in no EDR console, and contributes nothing to the incident record. An investigation working host-by-host reaches it and stops, because from the endpoint's point of view the chain simply ends.
Seeing a device that never reports
A device that will never describe itself can still be observed. Traffic to and from it is visible from the network whether or not it runs anything, so the hop appears in the reconstructed chain like any other — same timing, same behavioural analysis, same place in the path.
That requires observation to be genuinely passive. Nothing inline, nothing installed, no device asked to change how it behaves — because in these environments the monitoring itself is a risk that has to be argued down to zero before anyone will agree to it.
The hop carrying the volume is often the one thing in the chain nobody is watching.
Response has to respect the same constraint. Cutting a command-and-control channel through an integrated firewall interrupts the adversary's use of a device without touching the device, which is the only form of containment available when the endpoint in question is keeping someone alive.
More on the constraints each sector works under: critical infrastructure, healthcare and medical devices.
