The Expanding Attack Surface
By 2026, an estimated 18.8 billion IoT devices are connected worldwide. Smart cameras, thermostats, medical monitors, industrial sensors, and connected vehicles have woven themselves into the fabric of daily life and critical infrastructure. But each new device added to a network is a potential entry point for attackers — and the vast majority ship with security as an afterthought.
Unlike traditional IT assets — servers, laptops, and phones that receive regular patches and run endpoint protection — IoT devices typically run stripped-down firmware, lack update mechanisms, use default credentials, and communicate over protocols with little or no encryption. This asymmetry creates a perfect storm: the number of targets is exploding while the per-device security posture is declining.
Why IoT Devices Are Uniquely Vulnerable
1. Default and Hardcoded Credentials
Many IoT devices ship with factory-default usernames and passwords that are publicly documented. The Mirai botnet — one of the most destructive DDoS attacks in history — was built entirely by scanning the internet for devices using a list of just 62 default credential pairs. Mirai’s descendants and rivals — variants like Okiru, the older Gafgyt (BASHLITE) family, and the vigilante botnet Hajime — continue to infect hundreds of thousands of devices annually.
2. Infrequent or Impossible Updates
A vulnerability in your laptop's browser gets patched within days. A vulnerability in a smart lightbulb may never be patched. Many IoT manufacturers have no OTA (over-the-air) update mechanism, and even those that do often rely on users to manually initiate updates — something that almost never happens. This means that known, published vulnerabilities remain exploitable for the entire lifetime of the device.
3. Invisible Network Behavior
Most network monitoring tools are designed around IT endpoints — computers and servers running standard operating systems. IoT devices communicate in patterns that are alien to these tools: periodic telemetry beacons, MQTT pub/sub messaging, CoAP requests, and UPnP discovery. Without IoT-specific monitoring, compromised devices can exfiltrate data or participate in botnets completely unnoticed.
4. Lateral Movement Gateway
Attackers rarely target IoT devices for their own sake. A compromised smart camera or thermostat serves as a beachhead — a foothold inside the network from which to pivot to higher-value targets like file servers, databases, and domain controllers. Because IoT devices sit on the same flat network as critical assets in most deployments, a single compromised sensor can lead to a full enterprise breach.
Real-World Impact
The consequences of IoT insecurity are not theoretical. They have manifested in increasingly severe incidents:
- Mirai Botnet (2016): Compromised approximately 600,000 IoT devices, launching DDoS attacks that took down major internet services including Twitter, Netflix, and GitHub. Peak attack volume exceeded 1.2 Tbps.
- VPNFilter (2018): A nation-state malware campaign infected over 500,000 routers and NAS devices across 54 countries, capable of intercepting traffic, stealing credentials, and bricking devices on command.
- Verkada Camera Breach (2021): Attackers gained access to 150,000+ security cameras across hospitals, prisons, schools, and Tesla factories through a single exposed administrative credential.
- Water Treatment Attack (2021): An attacker remotely accessed a water treatment plant in Oldsmar, Florida and attempted to increase sodium hydroxide (lye) levels to potentially poisonous concentrations.
- Hospital IoT Attacks (2020–2024): Connected medical devices — infusion pumps, patient monitors, and imaging systems — have been repeatedly exploited to gain access to hospital networks, with ransomware incidents directly impacting patient care.
The Detection Gap
Traditional security approaches fail against IoT threats for a fundamental reason: they rely on installing software on the endpoint. You cannot install an antivirus agent on a smart thermostat. You cannot run an EDR (Endpoint Detection and Response) agent on a network-connected pressure sensor. The endpoint-centric model that protects laptops and servers simply does not apply.
This leaves network-level monitoring as the primary defense. But conventional network monitoring (SIEM, IDS/IPS) relies on signature-based detection — matching traffic against known attack patterns. This approach has two critical weaknesses:
- Signature lag: New IoT malware families appear faster than signatures can be written. By the time a signature is published, the botnet has already grown.
- Encrypted C2: Modern IoT malware increasingly uses TLS-encrypted command-and-control channels, making payload-based detection impossible.
Behavioral Anomaly Detection: A Better Approach
The most promising approach to IoT security shifts the question from "does this traffic match a known attack?" to "does this device's behavior look normal?"
Every IoT device has a characteristic behavioral fingerprint: the servers it contacts, the frequency and volume of its traffic, the protocols it uses, and the times of day it is active. A smart thermostat that reports temperature to a cloud API every 5 minutes has a very different profile from one that suddenly starts scanning internal IP addresses or sending encrypted traffic to an unknown server in Eastern Europe.
Behavioral anomaly detection learns each device's normal pattern from benign traffic alone — no malware samples required. When behavior deviates significantly from the learned baseline, an alert is raised. This approach catches zero-day attacks, novel malware, and insider threats that signature-based systems miss entirely.
This is exactly the approach behind Vigilo
Our Vigilo anomaly detection prototype uses a ~1.3M parameter Mamba-2 state-space model to learn per-device behavioral baselines from benign Zeek connection logs only. On the IoT-23 lab dataset (20 malware families), it detected 75% of infected devices at 1% false positive rate — catching loud attacks (port scans, DDoS, noisy botnets) while running entirely on CPU. Field validation on real home/enterprise networks is ongoing.
Best Practices for IoT Security
Network Segmentation
Place IoT devices on isolated VLANs, separated from critical business systems. If a smart camera is compromised, it should not be able to reach your file server.
Change Default Credentials
Before deploying any IoT device, change the default username and password. Use unique, strong credentials for each device. This single step would have prevented Mirai entirely.
Monitor Traffic Behaviorally
Deploy behavioral anomaly detection that learns normal device patterns and alerts on deviations. Signature-based IDS alone is insufficient for IoT threats.
Disable Unnecessary Services
Many IoT devices run Telnet, SSH, UPnP, and other services that are rarely needed. Disable everything that is not required for the device's function.
Maintain a Device Inventory
You cannot protect what you cannot see. Maintain an up-to-date inventory of every connected device on your network, including firmware versions and last-patched dates.
Enforce Firmware Updates
Prioritize devices from manufacturers that provide regular firmware updates and have a documented vulnerability disclosure process. Replace devices that have reached end-of-life.
The Future of IoT Security
The IoT security landscape is evolving in several important directions:
On-device AI: Lightweight machine learning models that run on network appliances or edge hosts can detect anomalies from connection metadata without sending sensitive traffic to the cloud. This is the approach behind Vigilo — a ~1.3M parameter model that runs on CPU and keeps analysis local (currently a v0.1.0 open-source prototype).
Per-device baselining: Rather than training a single "normal" model for all devices, the future is per-asset learning where each device's own early-life behavior becomes its baseline. This eliminates the need for a library of device-type signatures and works with any manufacturer's equipment.
Regulatory pressure: The EU Cyber Resilience Act (CRA), effective 2027, will require IoT manufacturers to provide security patches for the expected lifetime of their products and prohibit default passwords. Similar regulations are advancing in the US (IoT Cybersecurity Improvement Act) and UK (PSTI Act, effective 2024). These regulations will force a long-overdue improvement in baseline device security.
Zero-trust architecture: The zero-trust model — "never trust, always verify" — is being extended to IoT environments, where every device communication is authenticated and authorized regardless of network location. This fundamentally changes the security posture from perimeter defense to continuous verification.
Conclusion
IoT security is not a niche concern — it is a fundamental challenge that affects every organization and home with connected devices. The combination of exploding device counts, poor baseline security, and the inability to install traditional endpoint protection creates a threat landscape that demands new approaches.
Behavioral anomaly detection, network segmentation, and on-device AI represent the most promising path forward. At Rebel Studios, we are building these solutions with Vigilo — proving that effective IoT anomaly detection is possible with lightweight models, local processing, and no cloud dependency.
The question is not whether your IoT devices will be targeted. The question is whether you will detect it when they are.