Topic starter
12/07/2026 12:14 pm
TL;DR: IoT device growth turns identity governance into the main control problem, with numbers projected to rise from 9.7 billion in 2020 to more than 29 billion by 2030, according to GlobalSign. Device trust has to be inventoried, authenticated, and retired cleanly or stale identities can undermine the whole fleet.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Was ist das Internet of Things: Definition und Anwendungsbeispiele”.
By the numbers:
- The article says IoT technology is spreading across 13 application areas, from smart homes to water management.
Key questions
Q: Why do IoT fleets create more machine identity risk than traditional endpoints?
A: IoT fleets create more machine identity risk because devices often stay in service for years while their certificates, firmware, and trust assumptions age much faster.
Q: What breaks when connected devices use weak authentication?
A: Attackers can impersonate devices, tamper with messages, suppress alarms, or move from one trusted system to another through a compromised trust relationship.
Q: How should organisations govern IoT devices as part of identity security?
A: Treat IoT devices as governed identities, not just endpoints.
Practitioner guidance
- Define a machine identity inventory for IoT fleets Track each connected device, its certificate or credential type, issuing authority, expiry, and owner so the estate is governable.
- Standardise authentication before broad deployment Require strong device authentication and reject default or shared credentials for new IoT rollouts, including test and pilot environments.
- Separate device trust from network presence Do not treat network connectivity as proof of legitimacy.
Bottom line: IoT security is becoming an identity governance challenge because every connected device introduces a trust relationship that must be managed.
Glossary terms: Machine Identity, IoT Authentication, Credential Rotation, Penetration Testing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
12/07/2026 12:28 pm
IoT security is fundamentally an identity governance problem at machine scale. The article focuses on encryption and authentication, but the deeper issue is that each device is a non-human identity with a trust relationship that must be proven and maintained. When device populations move into the tens of billions, governance based on static trust assumptions breaks down. Practitioners should manage IoT as a lifecycle of machine identities, not as a collection of isolated endpoints.
A question worth separating out:
Q: How do security teams know IoT traffic controls are working?
A: They should be able to show that devices only contact approved destinations, that unexpected DNS behaviour is investigated, and that inter-device communication is limited to explicit operational needs. If routine device chatter hides unreviewed outbound paths, the control is not working.
👉 Read our full editorial: IoT security gaps are widening as device populations scale