The Cyber Threats I Find Hiding in Places Nobody Checks

The Cyber Threats I Find Hiding in Places Nobody Checks

Most of the online safety advice I give people is about the obvious stuff, the emails, the texts, the checkout pages. But some of the biggest risks I find when I actually sit down and audit someone's setup aren't in their inbox at all. They're sitting quietly in places nobody thinks to check, a router nobody's logged into in years, a smart device nobody remembers connecting, a browser extension installed for a five minute task and never removed. None of these announce themselves the way a scam text does. They just sit there, working exactly as intended, until they're not. Here are the five places I check first, and why each one matters more than it looks.

The Router Sitting There With Firmware From Two Years Ago

Your router is the single device every other device in your home connects through, and it's also the one nearly everyone forgets exists once it's plugged in and working. Manufacturers regularly release firmware updates that patch genuine security holes, but unlike your phone or laptop, a router rarely nags you to install them. I make a point of logging into mine every few months through its admin page and checking for a firmware update, and I've been surprised more than once by how long it had been sitting on an outdated version. I also check that the admin password isn't still the default one printed on the sticker underneath the router, because that single unchanged password is one of the more common ways an outside device ends up quietly attached to a home network without anyone noticing.

The Smart Devices I Forgot I Even Set Up

I did an audit of my own home network recently and found a smart plug I'd set up over a year ago for a lamp that had since been given away, still connected, still receiving whatever updates its manufacturer bothered to push, if any. Every smart device on your network, a doorbell camera, a speaker, a thermostat, a plug, is a small computer with its own software, and cheaper ones often stop receiving security updates well before you'd think to replace them. I now do a proper walk through of my router's connected devices list every so often and ask myself honestly whether I still know what each one is and whether I still use it. Anything I don't recognise or don't need gets removed from the network entirely, not just switched off.

The Browser Extensions I Installed Once and Never Looked At Again

I'm as guilty of this as anyone. A browser extension gets installed for one specific task, a PDF converter, a coupon finder, a screenshot tool, and then it just stays there indefinitely, quietly running with whatever permissions it asked for when you installed it. Extensions can read and sometimes modify every page you visit depending on what you granted them, and ownership of a popular extension can change hands without most users ever noticing, sometimes to less scrupulous hands than the original developer. I go through my browser's extensions list every few months now and remove anything I can't immediately explain the purpose of. If I genuinely need it again later, reinstalling takes thirty seconds, which is a small price for not carrying around software I've stopped paying attention to. I run the same VPN, NordVPN, across the devices where I do this kind of cleanup, mainly because it makes me stop and think about what's actually connecting to what on my network in the first place.

The Old Accounts I Never Actually Closed

Every account you've ever created and stopped using is still sitting somewhere with your email address, and quite possibly an old password, attached to it. I used to think an account I'd abandoned couldn't really hurt me since I wasn't using it anymore, but that's backwards, an inactive account you've forgotten still gets caught up in data breaches the same as an active one, and if you reused a password anywhere, that breach becomes a problem for accounts you do still care about. I've started keeping a running list in my password manager of services I've genuinely finished with, and closing them properly rather than just walking away, which is also part of what actually pushed me toward using a proper password manager instead of trying to remember which passwords I'd recycled where.

The One Network I Finally Split In Two

This is the change that made the biggest practical difference for me. Most home routers let you set up a separate guest network, and for a long time I never bothered, reasoning that everyone connecting was someone I trusted anyway. The problem isn't trust, it's that every device on the same network can, in principle, see and interact with every other device on it, which means a smart device with weak security sitting on the same network as your laptop and your banking app isn't actually isolated from either. I set up a separate guest network specifically for smart home devices and visitors, keeping my own laptop and phone on the main one, and it took about ten minutes to configure. It's the kind of change that costs nothing and quietly closes off a path I'd genuinely never thought about before.

None of these five things are dramatic on their own, and none of them will show up as a scam warning or a suspicious email. That's exactly why they're worth checking. An outdated router, a forgotten smart plug, a browser extension nobody's looked at in years, an old account still sitting there with your details attached, and one network doing the job of two, that's the audit I'd actually recommend running through your own home once, and then again every few months after. It's also worth knowing what a VPN does and doesn't cover here, since I still correct people who assume it handles gaps that only a firmware update or a proper account clear-out actually closes. If you want a second source alongside mine, the NCSC has its own guidance on securing your home network and devices, and my free Safety Toolkit covers the rest of what I'd recommend if you want to work through your wider setup properly.