In 2016, a botnet called Mirai took down half the internet for a day by compromising 600,000 IoT devices — mostly cameras and routers secured with factory-default passwords like "admin/admin." In 2025, the threat surface has only grown. There are billions more connected devices, and most of them were built by teams who treated security as an afterthought rather than a design constraint.
The Threat Landscape
IoT security is fundamentally different from web application security. Web apps can be patched in minutes. A firmware vulnerability on a deployed IoT device might go unpatched for years — because there's no OTA update mechanism, because the manufacturer abandoned the product, or because the customer never installed the update. Attackers know this. They scan for known-vulnerable firmware versions at internet scale and weaponize them into botnets or use them as pivot points into corporate networks.
The Most Common Vulnerabilities
- ›Default or hardcoded credentials that are never changed after deployment
- ›Unencrypted MQTT or HTTP communication that exposes sensor data and commands
- ›No OTA (over-the-air) update mechanism, leaving vulnerabilities permanently unpatched
- ›Missing device authentication — any client can connect and send commands
- ›Weak or self-signed TLS certificates that are trivially bypassed
A Baseline Security Checklist
- ›Unique, generated credentials per device stored in secure hardware (TPM or secure element)
- ›TLS 1.2+ for all data in transit — no plaintext MQTT over public networks
- ›Cryptographically signed firmware updates with rollback protection
- ›Network segmentation isolating IoT devices from corporate IT infrastructure
- ›Regular firmware security audits before production deployment
Security in IoT isn't a feature you add at the end. It's an architecture decision you make on day one — and retrofitting it later costs ten times as much.
Written by Manas Garge
Founder & Data Engineer