Topic starter
11/07/2026 1:54 pm
TL;DR: IoT security has lagged adoption for a decade because devices were prioritised for connectivity over resilience, and the result is a fragmented ecosystem of weak passwords, outdated firmware, and inconsistent lifecycle control, according to GlobalSign. Identity, certificates, and lifecycle governance now define whether connected devices can be trusted at scale.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “¿La seguridad del IoT finalmente madurará en 2026?”.
Key questions
Q: What breaks when bots and IoT devices are left out of identity governance?
A: When bots and IoT devices are excluded from identity governance, organisations lose visibility into non-human access, approvals, and privilege scope.
Q: Why does weak IoT device identity create risk in federal and enterprise environments?
A: Weak device identity creates risk because IoT systems are often integrated into larger systems of systems, where trust depends on reliable identification, access control, and data integrity.
Q: What are the signs that xIoT security controls are failing in practice?
A: Common warning signs include widespread password noncompliance, weak device-level hardening, and teams that cannot identify most connected devices.
Practitioner guidance
- Define a device identity lifecycle Assign ownership for device issuance, certificate renewal, revocation, and retirement across procurement, security, and operations so trust does not decay after deployment.
- Require cryptographic device authentication Use PKI-backed credentials and secure hardware for onboarding and ongoing verification rather than shared passwords or factory defaults.
- Segment operational IoT from general IT Isolate connected devices by function and risk so a compromised sensor or camera cannot be reused as a foothold into broader systems.
Bottom line: IoT security still fails at the same point: devices are connected faster than they are governed, authenticated, and retired.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:05 pm
IoT identity debt is now a governance problem, not a device problem: the industry spent a decade shipping connected products without a durable model for authentication, renewal, and retirement. That leaves organisations with fleets that can communicate but cannot be trusted over time. For identity programmes, the lesson is that device trust must be governed as a lifecycle, not as a one-time onboarding event.
A question worth separating out:
Q: How do organisations keep IoT trust visible across large device fleets?
A: Organisations keep IoT trust visible by inventorying all certificate-bearing devices, linking them to owners and systems, and reviewing their lifecycle status regularly. Visibility must include expiry dates, revocation status, and whether the device is still in active service, otherwise the fleet will contain trusted assets nobody can explain.
👉 Read our full editorial: IoT security maturity in 2026 still depends on identity and trust