How Has IoT Security Changed Over the Past 5 Years?

IoT security has shown subtle improvements over the past five years, with new laws and applied best practices, but experts say progress remains insufficient. While IoT usage has expanded across industries to boost efficiency, the technology remains inherently insecure, leaving a treasure trove of internet-exposed data, and many devices still lack easy vulnerability patching updates or alerting for updates.

In 2018, California filed legislation to improve security for connected devices, and new rules banning default passwords and mandating vulnerability disclosure around update support have pressed manufacturers to act, alongside the EU’s Cyber Resilience Act of December 2024. The Mirai botnet wake‑up call has driven legislative responses, and recent devices released from 2024 onward are expected to show noticeable security improvements, according to experts.

However, attackers are now using IoT devices as edge entry points for ransomware and as pivots for espionage, with risks increasingly resembling those of general‑purpose computers. Overall, IoT risk has shifted from simple default passwords and botnets to systemic, higher‑impact failures, a view echoed by several security researchers.