IoT security gaps expose identity and access risks across devices

At a glance

What this is: This is a practical explainer on IoT security that argues connected devices fail when authentication, update discipline, and configuration hygiene are weak.

Why it matters: It matters because IAM, PAM, and NHI teams increasingly have to govern devices as identities with scoped access, lifecycle controls, and network blast radius.

Context

IoT security is the control layer that protects connected devices and the networks they sit on. In identity terms, every device that authenticates to a network or cloud service creates a trust relationship that has to be governed like any other non-human identity.

The article’s core point is that weak passwords, default settings, missing encryption, outdated firmware, and always-on connectivity turn ordinary devices into access paths. For IAM and NHI practitioners, the question is not whether these devices are “smart,” but whether they are inventoried, scoped, and maintained like managed identities.

Key questions

Q: What breaks when IoT devices rely on shared credentials or plain-text secrets?

A: Shared credentials and plain-text secrets undermine trust across the device fleet. They make it easier for attackers to reuse access, move laterally, and intercept telemetry or management traffic. In practice, this weakens identity assurance, complicates incident containment, and leaves organisations with limited ability to isolate a compromised device or prove which component was accessed.

Q: Why do insecure IoT devices create broader enterprise risk?

A: Because once connected devices are inside a trusted environment, they can be used as entry points, persistence platforms, or sources of false data. Weak passwords, poor patching, and unclear ownership turn a single device into a systemic exposure. The risk is amplified when devices support operational systems, where disruption can affect revenue, safety, or service continuity.

Q: What are the signs that IoT security is failing in production environments?

A: Common signs include devices that cannot be reliably patched, inconsistent authentication across models, unknown asset inventories, and traffic patterns that deviate from normal device behavior. If teams cannot tell which devices are genuine, current, and properly managed, the environment is already operating with weak trust and poor visibility.

Q: How should organisations implement device identity in IoT environments to reduce blast radius if one device is compromised?

A: Use a unique credential or digital certificate for every device, rather than shared passwords or static keys. That gives each device its own identity, limits lateral impact if one device is compromised, and supports secure authentication for messages, updates, and telemetry. It also makes revocation and targeted replacement more practical when a single device fails or is tampered with.

Technical breakdown

Why weak authentication turns IoT devices into access paths

IoT devices commonly ship with default credentials, weak passwords, or minimal authentication controls, which makes the device itself a viable entry point rather than just a data endpoint. Once a device is reachable over the internet or a shared home network, the attacker does not need to target the application layer first. They can abuse the device’s identity boundary, then move toward the network or cloud services it can reach. That makes password hygiene, passkeys where available, and multi-factor authentication part of device access governance, not just user authentication.

Practical implication: treat every IoT login as an identity boundary that needs unique credentials and removal of defaults.

How configuration drift expands the IoT attack surface

The article shows that unnecessary features, default settings, and out-of-date firmware all widen the attack surface. In practice, IoT devices behave like small, long-lived identities with broad permissions to sensors, cameras, microphones, or home networks, but little built-in lifecycle discipline. When features remain enabled by default, each one becomes another reachable service or management interface. When software is not updated, known vulnerabilities remain exploitable for longer than the device’s business value justifies. That is a lifecycle problem as much as a security problem.

Practical implication: inventory IoT features and firmware states the same way you would review non-human account scope and age.

Why cross-device compromise makes IoT a network governance issue

IoT risk is not confined to the compromised device. The article describes how one infected device can become a foothold for cross-device attacks or botnet activity, especially when multiple devices share the same network. That changes the governance model: the trust boundary is no longer the device alone, but the device plus the Wi-Fi network plus any connected work resources. In NHI terms, the device’s access scope can exceed what the owner thinks it has, because network adjacency creates implicit trust that was never explicitly granted.

Practical implication: segment IoT devices away from work systems and reduce implicit network trust between devices.

Threat narrative

Attacker objective: The attacker wants persistent access to the device or network path so they can steal data, spread malware, or use the device in abuse campaigns.

1. Entry occurs through weak authentication, default credentials, or exposed device services on an IoT device.
2. The attacker abuses the device’s network access or control plane to reach connected services, data, or adjacent devices.
3. Compromise expands through the same local network, enabling cross-device infection, botnet enrollment, or DDoS participation.
4. Impact includes unauthorized access, stolen data, degraded network availability, and device control loss.

Breaches seen in the wild

• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IoT devices function as non-human identities, not passive hardware. Each device creates a trust relationship, has credentials or a management interface, and can be abused as an access path if that identity is not governed. The discipline gap is not just device hardening but lifecycle control over how the device authenticates, what it can reach, and when it should be disconnected.

Weak authentication is the first broken assumption in IoT governance. The article’s repeated emphasis on strong, unique passwords and MFA shows that many devices still rely on account patterns that are too thin for internet-facing identity. If a device can be logged into with defaults or reused credentials, the attack surface is not accidental, it is structural.

IoT security becomes an identity blast-radius problem once devices share networks with work assets. Home and hybrid environments collapse the separation between personal devices and enterprise endpoints, so a compromised camera or thermostat can become a route into business systems. Practitioners should read IoT risk as lateral reach, not isolated device risk.

Configuration drift is the real lifecycle failure behind IoT exposure. Unused services, stale firmware, and unreviewed features create long-lived exposure that mirrors the NHI problem of unmanaged accounts and forgotten privileges. The practical lesson is that device inventory and maintenance must be treated as identity governance work, not only endpoint hygiene.

Device isolation, not just device security, is what limits downstream harm. Once an IoT device is compromised, the controlling question becomes how far that access can travel. The most defensible posture is to minimize shared trust, separate device networks from work resources, and make each connected device accountable for its own limited scope.

What this signals

IoT governance now sits inside identity governance. Every connected device has an access model, an owner, and a lifecycle, which means security teams need to think beyond endpoint protection and into scope, authentication, and removal of stale access. The control objective is to keep each device’s trust boundary narrow enough that compromise stays local.

Identity blast radius is the right lens for connected devices. A compromised smart camera or thermostat is rarely the end state. The larger risk is the network path it opens into adjacent devices, cloud accounts, or work assets, which is why segmentation and credential hygiene have to be managed together.

Device lifecycle discipline is the missing control in many IoT environments. Update cadence, feature review, and ownership assignment are often treated as maintenance tasks, but they are actually identity governance tasks for machine-connected assets. Teams that already manage service accounts and workload identities should apply the same discipline here.

For practitioners

• Inventory connected devices as managed identities Create a complete inventory of IoT devices, the accounts they use, and the services they can reach so each device has an owner and an access scope.
• Remove default and shared credentials Replace vendor defaults with unique credentials per device and per management interface, then disable any shared admin access that cannot be attributed to one device owner.
• Segment IoT devices away from work assets Place cameras, thermostats, wearables, and other connected devices on separate network segments so a compromise cannot easily reach business endpoints or sensitive services.
• Reduce exposed features and stale firmware Disable unused device functions, review management ports and services, and patch firmware on a schedule that reflects the device’s exposure to the internet or local network.
• Enable MFA where devices support it Turn on multi-factor authentication for device accounts and cloud consoles wherever the option exists, especially for cameras, home hubs, and remote management portals.

Key takeaways

• IoT devices create identity and access risk when they are treated as consumer gadgets instead of managed non-human identities.
• Weak authentication, stale firmware, and unnecessary features are the main reasons connected devices remain easy to abuse.
• The practical defence is to inventory devices, narrow their network reach, and govern their credentials and lifecycle as carefully as other identities.

Key terms

• IoT security: IoT security is the practice of protecting connected devices, their credentials, and the networks they join. It covers access control, patching, segmentation, and monitoring so a device cannot be used as an easy entry point into wider systems.
• Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
• Cross-Device Attack: A cross-device attack starts with one compromised connected device and then moves to others on the same network or trust domain. It matters in IoT because shared connectivity can turn a single weak device into a pathway for broader compromise.
• Endpoint Segmentation: Endpoint Segmentation is the practice of limiting communication between user devices and other assets to reduce attack spread. It is especially useful in remote and hybrid work environments, where unmanaged network conditions can make endpoints an easy path for ransomware and lateral movement.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.