Branch offices contain some of the most difficult devices to secure.
Employee laptops may support modern endpoint protection, frequent updates, and identity-based access. The same branch may also contain printers, cameras, scanners, building controls, point-of-sale systems, voice equipment, and legacy servers that were never designed for today's threat environment.
Many of these systems cannot run a security agent. Some use outdated operating systems or depend on software that cannot be upgraded without disrupting the business. Others are installed once and remain in service for years with limited monitoring.
They still connect to the network.
They communicate with local systems, external vendor services, cloud applications, and the internet. If compromised, they can provide an attacker with a path into other parts of the branch.
Protecting these devices requires a security model that does not begin with installing software on every endpoint. Branch office SASE provides that protection by enforcing policy at the gateway and other points through which the traffic already passes.
Why Legacy and IoT Devices Create a Different Security Problem
Legacy and IoT devices are not simply older versions of employee endpoints. They have different technical and operational constraints.
They Often Cannot Run Security Software
Traditional endpoint security assumes that an agent can be installed, updated, and managed on the device. That assumption does not hold for many embedded systems, appliances, and specialized devices.
A camera or printer may use a proprietary operating system. An industrial or building system may be certified for a specific software version. A legacy server may support a critical application that the business cannot replace immediately.
Agent-only security leaves these systems outside the enforcement model.
They May Be Difficult to Patch
Some devices receive infrequent updates. Others are no longer supported by the manufacturer. Even when patches are available, the organization may have narrow maintenance windows or depend on a third party to apply them.
This creates a longer period between the discovery of a vulnerability and its remediation. Network-level controls become essential during that period.
Their Communication Is Easy to Overlook
Many connected devices operate quietly in the background. They may contact a vendor cloud, download updates, send telemetry, or communicate with a local management server.
Because employees do not interact with them in the same way they use laptops and applications, unusual device traffic may remain unnoticed until it creates an operational or security problem.
They Can Enable Lateral Movement
A vulnerable device does not need to contain valuable data to be useful to an attacker. It can become an entry point, a persistence mechanism, or a bridge to more sensitive systems.
If printers, cameras, employee devices, guest networks, and local servers can communicate freely, compromising one system may expose many others.
They Cannot Always Be Replaced Quickly
"Upgrade the device" may be the correct long-term answer, but it is not always an immediate one.
Replacement may require new hardware, application changes, operational testing, regulatory approval, or capital budget. Security teams need a practical way to reduce risk while modernization proceeds.
Why Endpoint-Only SASE Leaves a Gap
Many SASE deployments focus on protecting users through an endpoint agent. That works well for managed laptops and mobile devices, but it does not cover everything connected to a branch network.
If a device cannot run the agent, the organization may have to rely on a separate firewall, send its traffic to a remote cloud enforcement point, or allow it to operate with limited inspection.
Local traffic presents another challenge. A camera communicating with a local server or a compromised device scanning other systems inside the branch may never reach a cloud-based security service.
Branch protection therefore needs two complementary forms of enforcement:
- Endpoint enforcement for managed users and devices
- Gateway enforcement for agentless, legacy, IoT, and shared branch traffic
This creates coverage around the connection even when protection cannot be installed on the device itself.
How Branch Office SASE Protects Legacy and IoT Devices
1. It Applies Security Without Installing an Agent
When the SASE security engine runs at the branch gateway, it can inspect traffic from systems that cannot support endpoint software.
The printer, camera, scanner, or legacy server does not need to understand SASE. Its traffic passes through an enforcement point where network and application policies can be applied.
This is particularly valuable for mixed environments. The same branch can use endpoint protection for employee devices and gateway-based controls for everything else, with both managed through a common security platform.
2. It Limits Devices to the Communication They Need
Many legacy and IoT systems have a narrow business purpose. A camera may need to reach a recording server and an approved update service. A printer may need to receive jobs from specific networks. A building controller may need to communicate with a management application.
Security policies can restrict devices or network segments to the destinations and services required for those functions.
This reduces unnecessary exposure. A device that does not need to initiate connections to employee systems, reach sensitive applications, or communicate broadly across the internet should not be allowed to do so.
3. It Creates Boundaries Inside the Branch
Segmentation prevents every device at a location from becoming part of one broadly trusted network.
Employee systems, guest traffic, cameras, printers, legacy servers, and operational devices can be separated according to their role and risk. Policies can control which segments may communicate and inspect the traffic that crosses those boundaries.
This helps contain a compromised device and makes lateral movement more difficult. An attacker who gains control of a camera should not automatically gain a path to an employee laptop or local business application.
4. It Inspects Traffic for Threats and Misuse
Access rules determine whether a connection should be permitted. Traffic inspection determines what happens within that connection.
Gateway-based protection can apply controls such as firewalling, application control, DNS security, intrusion prevention, web filtering, and TLS inspection where appropriate. It can identify suspicious destinations, exploit attempts, prohibited applications, and traffic that does not match the device's intended purpose.
This is important for devices that cannot detect threats themselves. The network becomes the place where their communication is evaluated.
5. It Protects Local Internet Breakout
Many IoT and legacy systems communicate directly with external services. Sending that traffic through a distant data center or SASE PoP adds routing complexity and creates a dependency on the remote inspection path.
When enforcement occurs at the branch, traffic can be inspected locally and then travel directly to its approved destination.
The organization retains visibility and control without backhauling branch traffic solely for security.
6. It Centralizes Policy Across Multiple Branches
The legacy and IoT problem becomes harder when every location contains a different mix of devices.
Centralized management allows security teams to establish a common baseline across branches while applying more specific policies where needed. For example, all branches may block known malicious destinations, while only locations with building systems receive policies for those networks and services.
Teams can manage distributed enforcement without signing in to a separate interface at every site.
7. It Supports Modernization Without Waiting for It
Branch office SASE does not repair unsupported operating systems or replace missing firmware updates. It provides compensating controls around systems that cannot yet be modernized.
Organizations can limit exposure, inspect communication, prevent unnecessary access, and reduce lateral movement while planning device replacement on a realistic schedule.
This avoids a false choice between accepting the current risk and completing an immediate architectural rip-and-replace.
Applying Protection to Common Branch Devices
| Device type | Common security concern | Branch SASE control |
|---|---|---|
| Printers and scanners | Broad network access and unmanaged outbound traffic | Restrict accessible networks and destinations; inspect traffic at the gateway |
| Cameras and physical-security devices | Weak firmware, exposed services, and vendor-cloud connections | Isolate the device network; allow only required services and destinations |
| Building and environmental controls | Long lifecycles and limited patching windows | Segment from employee networks; tightly control management access |
| Point-of-sale and transaction systems | Sensitive data and strict communication requirements | Limit connections to approved applications and inspect external traffic |
| Legacy servers | Unsupported operating systems and excessive network exposure | Restrict authorized sources and services, inspect inbound and outbound traffic |
| Voice and conferencing equipment | Internet exposure and dependence on real-time performance | Apply targeted policy locally without unnecessary backhaul |
The objective is not to treat every device identically. It is to give each class of system the minimum communication required for its purpose.
What Branch Office SASE Does and Does Not Solve
Branch office SASE can materially reduce the risk created by legacy and IoT systems. It can:
- Provide agentless traffic inspection
- Restrict devices to approved services and destinations
- Separate higher-risk systems from users and sensitive applications
- Detect and block suspicious network activity
- Improve visibility across multiple locations
- Apply consistent policy from a central console
It does not make an inherently vulnerable device secure. It does not replace patching, asset ownership, secure configuration, or a planned modernization program.
Its role is to reduce exposure and limit what can happen before, during, and after a device is compromised.
How Zenarmor Protects Legacy and IoT Traffic at the Branch
Zenarmor extends SASE enforcement to the branch gateway, allowing organizations to protect devices that cannot run endpoint software.
Through the Zenarmor SASE Anywhere Architecture™, inspection and enforcement can run on supported OPNsense, pfSense, Linux gateway, and OpenWrt/CPE platforms. Policies, configurations, visibility, and monitoring are centrally managed through Zenconsole™.
Gateway enforcement can apply NGFW and SSE controls to traffic from legacy systems, IoT devices, and other agentless equipment. Organizations can define policy boundaries between networks, inspect traffic leaving the branch, and control access to applications and external services.
Managed Windows, macOS, Linux, iOS, and Android endpoints can also receive local enforcement, extending protection when employees work beyond the branch. The gateway and endpoint models complement one another rather than leaving agentless devices outside the architecture.
Because inspection occurs locally, branch traffic does not need to be redirected to a vendor-operated PoP. Zenarmor's local inspection overhead is approximately 0.2 milliseconds, and the platform does not impose administrative bandwidth caps on protected traffic.
The result is centralized security operations with protection placed around the devices and connections that need it, even when an agent cannot be installed.
Protect the Device You Have While Planning for the Device You Need
Legacy and IoT systems will remain part of branch networks for years. Their limitations should not determine the security level of the entire location.
By placing enforcement at the branch gateway, organizations can protect agentless traffic, create boundaries between systems, inspect local and internet connections, and manage policy across all locations from one place.
Modernization is still important. Branch office SASE makes it possible to reduce risk while that modernization happens.
Protect Every Branch Device, With or Without an Agent
See how Zenarmor applies centrally managed security at branch gateways and endpoints to protect users, legacy systems, IoT devices, and local traffic.
