IoT Security Flounders Amid Churning Risk

IoT security remains uneven as threat actors step up attacks on devices from medical gear to printers, even as a US government initiative lies in limbo and progress on curb measures is slow, according to Dark Reading’s September 29, 2025 report. The piece notes IoT devices are insecure from manufacture, often shipped with no vulnerability patches or guaranteed updates, and that attackers are increasingly able to gain distant control via botnets targeting routers and other connected devices.

It highlights ongoing efforts such as the US Cyber Trust Mark, a voluntary lab-testing and labeling scheme for IoT products, which faces delays amid concerns about its lead administrator UL Solutions and potential ties to China. In Europe, the Cyber Resilience Act is slated to cover IoT devices and set new security requirements, potentially influencing how products are marketed in the US if the programme progresses.

The discussion also emphasises practical steps for now, including supporting patching, auditing capabilities, and strengthening identity management, while stressing the need for enterprises to monitor for suspicious activity as the regulatory landscape evolves. According to Informa TechTarget, the broader goal is to align security expectations with IoT’s expansive use, even as the timing of formal adoption remains unclear.