Topic starter
11/07/2026 2:02 pm
TL;DR: IoT security remains fragmented because weak passwords, outdated firmware, inconsistent standards, and unclear lifecycle accountability still leave devices exposed, while PKI, certificates, and hardware trust are becoming the foundation for scalable device authentication, secure updates, and revocation, according to GlobalSign. The critical shift is that IoT maturity is now an identity and governance problem, not just a device hardening problem.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Wird die IoT-Sicherheit im Jahr 2026 endlich erwachsen?”.
Key questions
Q: What breaks when IoT certificates are not lifecycle-managed?
A: When IoT certificates are not lifecycle-managed, devices can keep trusted access long after business ownership, vendor relationships, or security intent has changed.
Q: Why does lifecycle accountability matter so much for IoT security?
A: IoT risk persists because devices remain in the field for years, while ownership is often split across manufacturers, resellers, and operators.
Q: How do security teams know IoT traffic controls are working?
A: They should be able to show that devices only contact approved destinations, that unexpected DNS behaviour is investigated, and that inter-device communication is limited to explicit operational needs.
Practitioner guidance
- Standardise certificate-based device onboarding Require every IoT device class to authenticate with a cryptographic identity before joining production networks, and reject deployments that rely on shared passwords or defaults.
- Build a single device lifecycle owner model Assign one accountable owner for provisioning, certificate renewal, firmware validation, revocation, and retirement so no stage of the device lifecycle is left ambiguous.
- Use hardware-backed trust for high-risk fleets Deploy TPMs or secure elements where devices must authenticate autonomously, then pair them with managed certificate services for key protection and scale.
Bottom line: IoT security maturity is now a governance question because devices need reliable identity, lifecycle ownership, and revocation, not just harder defaults.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:11 pm
IoT security maturity is really machine identity maturity. The article is right to move the discussion away from isolated device hardening and toward authenticated trust across the lifecycle. In identity terms, IoT devices behave like non-human identities that must be issued, validated, rotated, and revoked, or they become unmanaged trust objects. The practitioner conclusion is straightforward: if the device cannot be reliably identified, the fleet cannot be reliably governed.
A question worth separating out:
Q: When should organisations prioritise PKI over blockchain for IoT and industrial systems?
A: Organisations should prioritise PKI when the main requirement is proving device identity, encrypting communications, and enforcing access control across large fleets of connected assets. That matters in IoT and industrial environments where operators need unique identities, certificate lifecycle management, and policy-based trust. Blockchain is not a substitute for authentication, encryption, or identity binding in those scenarios.
👉 Read our full editorial: IoT security maturity still hinges on identity and lifecycle control