IoT Security in 2026: Threats, Frameworks, and Best Practices

Introduction

Enterprises now face around 820,000 IoT attacks per day, a 46 percent rise from last year. One in three data breaches begins with an IoT device, and over half of devices have critical vulnerabilities. Unpatched firmware accounts for about 60 percent of incidents.

Global IoT connections continue to expand, with more than 25 billion devices expected in 2026. These include sensors, cameras, medical devices, and industrial controllers. Many were not designed for enterprise-level security. Common issues include unchanged default credentials, outdated firmware, and lack of visibility in standard IT tools.

IoT attacks are growing across sectors. Energy saw a 459 percent rise in attacks within a year. Healthcare breaches average $10 million per incident. Manufacturing and transport each account for about 20 percent of attacks. This article outlines the current threat landscape, key regulations, and practical security strategies for enterprises.

The Threat Landscape

1. Botnets and Large-Scale DDoS Attacks

Botnets remain a major risk. The Aisuru or TurboMirai botnet reached 29.7 Tbps DDoS capacity in 2025. Attackers scan the internet for weak devices such as routers with default credentials or outdated firmware. Once compromised, devices are used to launch attacks, relay commands, or carry out reconnaissance inside networks.

Routers are the most targeted devices. They represent over 75 percent of IoT attacks, with many containing critical vulnerabilities. Around 32 percent run unsupported firmware that will never receive updates.

2. Supply Chain Compromise

The BadBox 2.0 campaign infected over 10 million devices before they were sold. Malware was embedded directly into firmware. This type of attack is difficult to detect because the device appears normal during setup. Traditional checks cannot identify hidden malicious codes.

Verifying firmware signatures and using a Software Bill of Materials helps reduce this risk by confirming device integrity before deployment.

3. Targeted Attacks on Infrastructure

Critical infrastructure sectors face increasing targeted attacks. These are often linked to nation-state groups. Campaigns such as Volt Typhoon used compromised routers and IoT devices for long-term access to infrastructure networks. The aim is persistence and future disruption.

The risk is highest in environments where IT systems connect with operational technology such as industrial controls.

4. Ransomware via IoT Entry Points

Attackers now use IoT devices as entry points for ransomware. Devices like cameras or building systems provide access to internal networks. From there, attackers move laterally and deploy ransomware. This approach bypasses traditional endpoint defenses.

Healthcare, manufacturing, and logistics environments are frequently affected due to connected systems and shared networks.

Regulatory Frameworks

1. EU Cyber Resilience Act

The EU Cyber Resilience Act applies to all digital products sold in the EU.

Key requirements include:

• Secure-by-design development practices
• Vulnerability reporting within 24 hours starting September 11, 2026
• Mandatory Software Bill of Materials
• CE certification by December 2027

Penalties can reach €15 million or 2.5 percent of global revenue.

2. CISA Cybersecurity Performance Goals 2.0

CISA CPG 2.0 integrates IT, IoT, and OT security into a unified framework. It is widely used in critical sectors like energy and healthcare.

3. UK PSTI Act

The UK PSTI Act mandates:

• Unique default passwords or user-defined credentials
• Basic security standards for consumer IoT devices

This sets a baseline for enterprise procurement as well.

4. NIST and IEC Standards

• NIST SP 800-213 and CSF 2.0 provide guidance on IoT risk management
• IEC 62443 focuses on industrial IoT environments

These frameworks help organizations align security with operational requirements.

Best Practices for IoT Security

1. Maintain Device Inventory

A complete and updated inventory is essential. Many devices connect without IT oversight. Use automated discovery tools to identify and classify all devices based on risk and function.

2. Network Segmentation

Segment IoT devices into separate network zones. Limit communication between zones to only what is required. Micro-segmentation can restrict communication between individual devices.

3. Zero Trust Access Control

Every device must authenticate it before accessing resources. Trust should not depend on network location. Certificate-based authentication provides stronger identity verification.

4. Firmware Patch Management

Unpatched firmware is a major cause of breaches.

Organizations should:

• Require over-the-air updates
• Track vendor advisories
• Replace devices that no longer receive updates

5. Behavioral Monitoring

Many IoT devices cannot run endpoint software.

Network-based monitoring helps detect unusual behaviors such as unexpected outbound connections.

Integrate IoT alerts into the main security operations workflow.

6. Device Hardening

At deployment:

• Change default credentials
• Disable unused services
• Enable encryption
• Restrict physical access ports

Use standardized configuration practices for consistency.

7. Lifecycle Management

Devices should be securely decommissioned when no longer in use.

Steps include:

• Removing network access
• Resetting credentials
• Wiping stored data

Track end-of-support timelines and plan replacements.

8. Secure Procurement

Security starts before purchase.

Require vendors to provide:

• Firmware signing
• SBOM documentation
• Patch support commitments
• Secure credential practices

Avoid devices that do not meet these standards.

Tools Supporting IoT Security

Leading platforms include:

• Claroty for industrial IoT
• Nozomi Networks for monitoring and analytics
• Armis for agentless visibility
• Forescout for device compliance
• Microsoft Defender for IoT for integration with existing security systems

Conclusion

IoT security is now a core enterprise concern. With billions of connected devices and a high volume of attacks, it requires the same attention as endpoint and cloud security.

The main risks include botnets, supply chain compromise, targeted infrastructure attacks, and ransomware. These risks can be reduced through structured controls such as inventory, segmentation, monitoring, and patch management. Regulations are becoming stricter, with deadlines in 2026 and beyond.

Organizations that treat IoT security as a continuous operational effort will be in a stronger position to manage risks and protect their systems.

FAQs

1. Why are IoT devices often targeted by attackers?

IoT devices frequently lack strong security controls. Many use default credentials or outdated firmware, making them easy entry points.

2. What is the biggest IoT security risk in 2026?

Unpatched firmware remains the largest risk, followed by weak credentials and lack of visibility into device activity.

3. How does network segmentation improve IoT security?

Segmentation limits the ability of attackers to move across the network after compromising a device.

4. What is a Software Bill of Materials (SBOM)?

An SBOM lists all software components inside a device. It helps track vulnerabilities and manage risks.

5. Can IoT devices be protected without installing software on them?

Yes. Network-based monitoring can track device behavior and detect threats without installing agents.

6. What is Zero Trust in IoT security?

Zero Trust requires every device to verify its identity before accessing systems, regardless of its location.

7. How should organizations handle outdated IoT devices?

Devices that no longer receive security updates should be isolated and replaced as part of lifecycle planning.