Printers and vendors are overlooked security risks with regulatory consequences
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
The paperless office is one of the clearest examples of the impact that digital transformation has had on workflows. This includes industries, like law and finance, where physical records of compliance documents, market-sensitive data, and customer information must be retained.
Industry Consultant at Tungsten Automation.
Mishandling electronic and physical data can lead to heavy regulatory penalties, so companies take care to encrypt data in transit, enforce MFA, segment their networks, and sharpen endpoint detection.
These measures build a solid foundation of security. But what good is that wall when the weakest link sits in the corner of the office, quietly printing?
Most offices treat printers as passive output devices, disconnected from any threat. That assumption is out of date. HP found 57% of IT decision-makers rate print security as a low priority in their cybersecurity strategy, and 45% aren't confident their print environment meets compliance standards.
Whilst most print-related losses differ in complexity, they can be easily traced. Data leaks expose unencrypted hard drives and unpatched firmware, while print history can reveal when documents have been left sitting in the output tray.
Modern printers are networked endpoints with access to confidential cloud environments and increasingly, they're managed by third-party MPS vendors, widening the potential attack surface.
Managed Print Services are useful for fixing hardware gaps, but they can introduce new risks. When print jobs are routed through third-party cloud servers without end-to-end encryption, files in transit become exposed. Granting an external MPS vendor administrative network access creates backdoor entry where even if only the vendor is compromised, attackers can easily pivot into the corporate network.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Singapore saw this play out in 2025, when a ransomware attack on a printing vendor for Bank of China's Singapore branch exposed 11,200 customer names and account details. The incident is a clear example of how a print vendor can easily become the weakest link in an otherwise solid network.
Hybrid work adds another layer of complexity and few companies have clear governance for print behavior once it leaves the office. Office workers may have enterprise-grade tools, but remote workers don’t. Employees printing at home may be using unmanaged devices and unsecured Wi-Fi, offering little visibility into what's being printed or where it ends up.
When two-thirds of knowledge workers assume network printers are secure by default, the likelihood of a printer-related breach goes from a matter of if, to when.
For UK financial services firms, this creates an operational and regulatory risk. The FCA has no statutory cap on fines, and its expectations around data governance extends to how firms handle information physically, not only digitally.
