Topic starter
11/07/2026 2:02 pm
TL;DR: IoT security maturity still depends on reliable identity, lifecycle ownership, and revocation, according to GlobalSign. Connected fleets stay hard to govern when passwords, firmware, and standards drift without enforceable trust controls.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Wird die IoT-Sicherheit im Jahr 2026 endlich erwachsen?”.
Key questions
Q: Why does lifecycle accountability matter so much for IoT security?
A: IoT risk persists because devices remain in the field for years, while ownership is often split across manufacturers, resellers, and operators.
Q: How do security teams know IoT traffic controls are working?
A: They should be able to show that devices only contact approved destinations, that unexpected DNS behaviour is investigated, and that inter-device communication is limited to explicit operational needs.
Q: What breaks when IoT certificates are not lifecycle-managed?
A: When IoT certificates are not lifecycle-managed, devices can keep trusted access long after business ownership, vendor relationships, or security intent has changed.
Practitioner guidance
- Standardise certificate-based device onboarding Require every IoT device class to authenticate with a cryptographic identity before joining production networks, and reject deployments that rely on shared passwords or defaults.
- Build a single device lifecycle owner model Assign one accountable owner for provisioning, certificate renewal, firmware validation, revocation, and retirement so no stage of the device lifecycle is left ambiguous.
- Use hardware-backed trust for high-risk fleets Deploy TPMs or secure elements where devices must authenticate autonomously, then pair them with managed certificate services for key protection and scale.
Bottom line: IoT security maturity is now a governance question because devices need reliable identity, lifecycle ownership, and revocation, not just harder defaults.
Glossary terms: Machine Identity, Certificate Lifecycle Management, Hardware-backed Trust, Vendor offboarding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 38 minutes ago by NHI Mgmt Group
11/07/2026 2:11 pm
IoT security maturity is really machine identity maturity. The article is right to move the discussion away from isolated device hardening and toward authenticated trust across the lifecycle. In identity terms, IoT devices behave like non-human identities that must be issued, validated, rotated, and revoked, or they become unmanaged trust objects. The practitioner conclusion is straightforward: if the device cannot be reliably identified, the fleet cannot be reliably governed.
A question worth separating out:
Q: When should organisations prioritise PKI over blockchain for IoT and industrial systems?
A: Organisations should prioritise PKI when the main requirement is proving device identity, encrypting communications, and enforcing access control across large fleets of connected assets. That matters in IoT and industrial environments where operators need unique identities, certificate lifecycle management, and policy-based trust. Blockchain is not a substitute for authentication, encryption, or identity binding in those scenarios.
👉 Read our full editorial: IoT security maturity still hinges on identity and lifecycle control