Hundreds of French supermarkets had their refrigeration sabotaged, and the way in is still unconfirmed. It raises a security question: why do we guard systems by the data they hold, not by what they do? Equipment that acts often runs on shared, default, rarely changed passwords, and nobody owns the risk. Through real-life stories, learn three questions for any device: who knows the password, what can they do, who owns the risk?