Our homes are becoming more connected every year. Smart televisions, cameras, doorbells, thermostats, appliances, streaming devices, printers, gaming systems, and voice assistants may all share one Internet connection. Now add something much more valuable to that network: your employer's laptop. For millions of remote workers, the home network has become part of the extended cybersecurity attack surface. A vulnerable smart device may not directly compromise a business computer, but it can give an attacker a foothold from which to conduct reconnaissance, attempt exploitation, intercept poorly protected communications, or look for opportunities for lateral movement. IoT Devices Can Become Pivot Points Many Internet of Things, or IoT, devices are built for convenience and affordability. Security practices and manufacturer support can vary significantly. Common IoT threat vectors include: •Default or weak passwords •Unpatched firmware and known vulnerabilities •End-of-life devices no longer receiving security updates •Exposed router or device management interfaces •Insecure applications, APIs, or cloud services •Malicious software introduced through the supply chain •Poor network segmentation The FBI's BADBOX 2.0 warning demonstrated the supply-chain concern. Some consumer IoT devices were compromised with malicious software before purchase or became infected while downloading applications during setup. Compromised devices could then become part of botnets and residential proxy networks used for criminal activity. In March 2026, the FBI also reported AVrecon malware targeting routers and IoT devices and using compromised equipment as residential proxies. This highlights another problem: vulnerable and poorly maintained devices can remain useful to attackers long after being installed in a home. War Driving and Router Exposure War driving involves moving through an area while detecting or mapping wireless networks. Detecting a Wi-Fi network does not mean it can automatically be compromised, but weak passwords, outdated encryption, exposed management interfaces, or poor router configurations can increase risk. Attackers do not necessarily need