Topic starter
11/07/2026 1:54 pm
TL;DR: IoT security still stalls where devices are connected faster than they are governed, authenticated, and retired, according to GlobalSign. Fleet-scale identity, certificates, and lifecycle controls decide whether connected devices can be trusted.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “¿La seguridad del IoT finalmente madurará en 2026?”.
Key questions
Q: Why does weak IoT device identity create risk in federal and enterprise environments?
A: Weak device identity creates risk because IoT systems are often integrated into larger systems of systems, where trust depends on reliable identification, access control, and data integrity.
Q: What are the signs that xIoT security controls are failing in practice?
A: Common warning signs include widespread password noncompliance, weak device-level hardening, and teams that cannot identify most connected devices.
Q: What breaks when bots and IoT devices are left out of identity governance?
A: When bots and IoT devices are excluded from identity governance, organisations lose visibility into non-human access, approvals, and privilege scope.
Practitioner guidance
- Define a device identity lifecycle Assign ownership for device issuance, certificate renewal, revocation, and retirement across procurement, security, and operations so trust does not decay after deployment.
- Require cryptographic device authentication Use PKI-backed credentials and secure hardware for onboarding and ongoing verification rather than shared passwords or factory defaults.
- Segment operational IoT from general IT Isolate connected devices by function and risk so a compromised sensor or camera cannot be reused as a foothold into broader systems.
Bottom line: IoT security still fails at the same point: devices are connected faster than they are governed, authenticated, and retired.
Glossary terms: Device Identity, pnPKI, Certificate Revocation List, IoT Lifecycle Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/07/2026 2:05 pm
IoT identity debt is now a governance problem, not a device problem: the industry spent a decade shipping connected products without a durable model for authentication, renewal, and retirement. That leaves organisations with fleets that can communicate but cannot be trusted over time. For identity programmes, the lesson is that device trust must be governed as a lifecycle, not as a one-time onboarding event.
A question worth separating out:
Q: How do organisations keep IoT trust visible across large device fleets?
A: Organisations keep IoT trust visible by inventorying all certificate-bearing devices, linking them to owners and systems, and reviewing their lifecycle status regularly. Visibility must include expiry dates, revocation status, and whether the device is still in active service, otherwise the fleet will contain trusted assets nobody can explain.
👉 Read our full editorial: IoT security maturity in 2026 still depends on identity and trust