The numbers that define IoT security in 2026
Before anything else, six data points that frame the scale of what this article covers:
| Metric | Figure | Source |
|---|---|---|
| IoT devices connected globally | 21.1 billion (end 2025) → 39 billion by 2030 | IoT Analytics State of IoT 2025 |
| Devices pre-infected by BadBox 2.0 | 10 million+ | Google/Human Security/Trend Micro |
| Peak DDoS from Aisuru botnet | 29.7 Tbps (Q3 2025) | Cloudflare DDoS Threat Report |
| Rise in ransomware targeting OT systems | 46% in 2025 | Nozomi Networks |
| CEOs citing AI as top IoT cybercrime risk | 87% | WEF Global Cybersecurity Outlook 2026 |
| EU CRA 24-hour reporting deadline | September 11, 2026 | EU Regulation 2024/2847 |
These are not projections. They are documented events and verified regulatory dates. This article covers what each one means, what is actively changing, and what organizations should be doing about it right now.
What is actually different about IoT security in 2026 vs prior years
The phrase “IoT security is getting worse” has been used so many times it has lost meaning. In 2026, the data supports something more specific: this is a genuine inflection point, not incremental change. Three structural shifts define why.
Shift 1: Botnet attack scale has increased sixfold in thirteen months.
The trajectory is not gradual. Cloudflare mitigated a Mirai-based DDoS attack peaking at 5.6 Tbps in October 2024, sourced from 13,000 compromised devices. By Q3 2025, the Aisuru botnet pushed that record to 29.7 Tbps from an estimated 300,000 to 700,000 hijacked routers, DVRs, and IP cameras. Microsoft Azure absorbed a separate Aisuru flood peaking at 15.72 Tbps in October 2025. By early 2026, authorities confirmed the combined Aisuru and Kimwolf botnets had compromised more than 3 million devices globally.
This is not a gradual increase. It is exponential escalation. The infrastructure attackers are building from compromised IoT devices now represents a genuinely novel threat capability — one that did not exist at this scale two years ago.
Shift 2: Supply chain has become the primary attack entry point.
Historically, IoT devices were compromised after reaching the end user — through default credentials, unpatched firmware, or network intrusion. BadBox 2.0 changed this model fundamentally. More than 10 million Android-based smart TVs, digital projectors, in-car infotainment systems, and digital picture frames arrived pre-infected with malware installed at the factory. The manufacturer’s own distribution network became the malware delivery mechanism.
The implication for every organization that procures IoT devices: “it came from a reputable supplier” is no longer sufficient assurance. The threat is now upstream of the purchase.
Shift 3: Nation-state actors are treating IoT as strategic infrastructure.
State-sponsored threat groups are not using IoT devices primarily as botnet recruits. IOCONTROL, attributed to an Iranian advanced persistent threat group, targeted critical infrastructure IoT and operational technology systems in the United States and Israel throughout 2025. Raptor Train, linked to the Chinese state-aligned group Flax Typhoon, operated undetected for four years across compromised IoT devices. The purpose was persistent access and intelligence collection — not disruptive attacks.
The strategic implication: IoT devices in sensitive locations — manufacturing facilities, utilities, healthcare systems, government networks — are now targets for nation-state pre-positioning, not just opportunistic botnet recruitment.
The 40% figure that should reset every security team’s assumptions.
Forescout’s 2026 threat telemetry found that 40% of the riskiest device types in 2026 were not on any organization’s risk list a year ago. The threat surface is not just growing — it is changing shape faster than most security programs can track.
The six IoT threats making headlines in 2026
Aisuru and TurboMirai — the botnet that broke DDoS records
Aisuru is the most consequential IoT botnet active in 2026. Built on the Mirai framework but substantially evolved, it uses AI-assisted targeting for automated reconnaissance across global IoT device populations and “precision flooding” — real-time adaptation of DDoS traffic patterns to evade mitigation measures as they are deployed.
The scale achieved is without precedent. Cloudflare recorded the 29.7 Tbps peak in Q3 2025. Aisuru hyper-volumetric attacks surged 54% quarter over quarter, averaging 14 per day in that period. Cloudflare blocked 8.3 million DDoS attacks in Q3 2025 alone — 170% of the entire full-year 2024 total. Attacks above 1 Tbps increased 227% quarter over quarter.
In March 2026, an international law enforcement operation involving German and Canadian authorities, in coordination with major cybersecurity firms, disrupted the Aisuru, Kimwolf, JackSkid, and Mossad botnets. The disruption was significant but did not eliminate the underlying infrastructure or recruitment mechanisms. Kimwolf — essentially Aisuru’s Android-focused successor — had grown to over two million infected hosts by January 2026 before the operation.
The IoT devices powering Aisuru are overwhelmingly consumer-grade: home routers, IP cameras, DVRs, and network-attached storage devices running outdated firmware with unchanged default credentials. The average North American household now absorbs 29 attempted IoT attacks per day.
BadBox 2.0 — the supply chain attack that changed procurement
Google, in partnership with Human Security and Trend Micro, disclosed BadBox 2.0 in 2025: the largest known botnet of internet-connected TVs ever documented. More than 10 million smart TVs, digital projectors, in-car infotainment systems, and digital picture frames had been compromised with pre-installed malware before leaving the factory.
The attack mechanism is distinct from every other threat on this list. BadBox 2.0 did not exploit a vulnerability after the device reached the consumer. The firmware was infected during manufacturing. The device shipped compromised. Standard security advice — change default credentials, update firmware immediately — does not protect against a threat that predates the purchase.
The devices targeted were primarily low-cost Android-based products from Asia-based manufacturers with limited supply chain oversight. Affected categories included budget streaming boxes sold through major e-commerce platforms, digital photo frames, and aftermarket vehicle infotainment systems.
IOCONTROL — state-sponsored critical infrastructure targeting
IOCONTROL is a cyberweapon attributed to an Iranian advanced persistent threat actor. Throughout 2025, it was deployed against critical infrastructure IoT and operational technology systems in the United States and Israel, including fuel management systems, water treatment facilities, and industrial control environments.
The significance of IOCONTROL is not its technical sophistication — it is what its target set reveals. Nation-state actors are specifically seeking persistent access to the IoT and OT systems that underpin physical infrastructure. The objective is pre-positioning: the ability to disrupt or manipulate physical systems during a future conflict or crisis, not immediate disruption.
This represents a fundamentally different threat model from financially motivated cybercrime. Organizations operating critical infrastructure IoT must now account for adversaries with strategic objectives, long dwell times, and the patience to remain undetected for years.
KadNap — the 2026 edge device campaign
Identified in March 2026 by Black Lotus Labs, the threat research unit at Lumen Technologies, KadNap infiltrated more than 14,000 edge devices — the majority of them Asus routers. Unlike traditional botnets that use compromised devices to launch direct attacks, KadNap’s primary function is enlisting infected devices in the Doppelgänger proxy service, providing threat actors with infrastructure for anonymous DDoS campaigns that cannot be traced back to the actual attack origin.
This represents an evolution in how compromised IoT devices are monetized. The device is not the weapon — it is the anonymization layer for other attacks.
ShadowV2 — Mirai’s 2026 iteration
The Mirai botnet was disrupted in 2016 and its source code released publicly. That release seeded an entire generation of descendants. ShadowV2 is among the most active Mirai-based variants operating in 2026, targeting IoT devices across industries with a focus on Android TVs and streaming devices with exposed Android Debug Bridge (ADB) services.
ADB is a developer tool that provides low-level device access. Consumer devices that ship with ADB exposed to the network — a common configuration error in budget Android TV hardware — give attackers essentially root-level control with minimal effort. ShadowV2 exploits this systematically.
Mars Hydro — the cloud-side failure
The Mars Hydro incident demonstrates that IoT security failures do not require a compromised device. A misconfiguration in Mars Hydro’s cloud infrastructure exposed a database containing 2.7 billion records of IoT device data — including network names, passwords, device identifiers, and IP addresses.
The lesson is architectural: IoT security must extend beyond the device itself to the cloud infrastructure that manages, updates, and communicates with it. A perfectly secured device connected to an insecure cloud backend is not a secured device.
How AI is reshaping IoT attacks — and what it demands from defense
The World Economic Forum’s 2026 Global Cybersecurity Outlook found that 87% of surveyed CEOs identified AI vulnerabilities as an increasing cybercrime risk for IoT — ahead of phishing (77%) and ransomware (54%). This ranking reflects something real: AI has changed the economics of IoT attack at a fundamental level.
AI as attack weapon. The Aisuru botnet’s most significant characteristic is not its scale — it is its adaptability. The botnet uses AI for automated reconnaissance that maps global IoT device populations at speed and “precision flooding” that adjusts its DDoS traffic patterns in real time as mitigation measures are deployed. When a defensive response is detected, the attack adapts. This removes the iterative human feedback loop that previously gave defenders a response window.
At a broader level, AI has collapsed the time between vulnerability discovery and mass exploitation. The window that once measured weeks — during which organizations could identify exposure and apply patches — is now measured in hours. AI-powered scanning identifies vulnerable device populations and deploys exploit code at machine speed. Human response cycles cannot keep pace with automated attack deployment.
AI as the only viable defense. This creates a specific architectural requirement for IoT defense. Raptor Train, the nation-state IoT campaign linked to Flax Typhoon, operated undetected for four years. It generated no signature-matching traffic. Traditional signature-based detection — matching observed traffic against libraries of known attack patterns — would never have caught it.
The only detection method that works against AI-adapted attacks and long-dwell compromises is behavioral baseline monitoring: establishing what normal communication looks like for each IoT device on a network, and alerting when observed behavior deviates from that baseline. This approach catches compromised devices based on what they are doing, not based on whether their traffic matches a known attack signature.
Organizations relying exclusively on signature-based IoT security tools are structurally unable to detect AI-adapted attacks. The architecture shift — from signature detection to behavioral anomaly detection — is the most important security design decision for IoT in 2026.
Supply chain compromise: the threat that starts before you buy
BadBox 2.0 is not an isolated incident. It is the clearest documented example of a trend that security researchers have tracked across multiple investigations: the IoT supply chain as a malware distribution channel.
The standard consumer and enterprise security framework assumes a clean starting point. A new device is purchased from a legitimate retailer, configured with secure credentials, updated to the latest firmware, and placed on a segmented network. This framework addresses threats that emerge after deployment. It has no answer for a threat that predates the purchase.
This is why supply chain compromise is architecturally different from every other IoT threat category. No amount of post-deployment hardening resolves a pre-infection. No network segmentation prevents a device from phoning home to command-and-control infrastructure if it was designed to do so from the factory.
The concern for 2026 and beyond extends beyond consumer devices. As governments push Secure-by-Design requirements and introduce labeling regimes like the US Cyber Trust Mark, sophisticated attackers may respond by moving further upstream in the supply chain — targeting component-level firmware, third-party software libraries embedded in devices, or the software development environments of manufacturers themselves. Early signals of this pattern appeared in Asia-based camera and router supply chain disruptions in 2024 and 2025.
What this means for procurement decisions.
The practical response to supply chain risk requires changing the procurement question from “Is this device from a reputable supplier?” to “Can this supplier provide a Software Bill of Materials, firmware signing evidence, and a documented vulnerability management process?”
SBOM (Software Bill of Materials) requirements — mandating that manufacturers document every software component in a device — are central to both the EU Cyber Resilience Act and US government guidance. Without an SBOM, an organization cannot know whether a newly purchased device contains components with known exploited vulnerabilities. The EU CRA makes SBOM a legal requirement for the EU market. Organizations operating outside the EU that have not yet adopted SBOM requirements should treat it as a procurement standard regardless of regulatory jurisdiction.
| Industry | Primary IoT Risk | Key Attack Vector | Regulatory Exposure | 2026 Severity |
|---|---|---|---|---|
| Healthcare | IoMT device exploitation | KEV-laden medical devices | FDA MDR, EU CRA | Critical |
| Manufacturing | OT/IT boundary attacks | Industrial sensor firmware | CMMC, EU CRA | Critical |
| Critical Infrastructure | Nation-state pre-positioning | Edge device firmware | CISA CPG 2.0 | Critical |
| Smart Cities / Public Administration | Device sprawl, poor inventory | Default credentials, EOL devices | ENISA NIS2, CRA | High |
| Financial Services | Data exfiltration via IoT pivot | Camera and building system compromise | DORA, PCI-DSS | High |
| Consumer / Retail | Botnet recruitment | Budget device default credentials | UK PSTI, US Cyber Trust Mark | Medium–High |
Healthcare (IoMT). The numbers from healthcare IoT are alarming in their specificity. Asimily’s 2025 IoMT analysis found that 99% of hospitals manage devices with Known Exploited Vulnerabilities listed in CISA’s KEV catalog. 96% of those KEVs are directly linked to active ransomware campaigns. The average medical device carries 6.2 unpatched vulnerabilities. These are not legacy systems in storage — they are active patient care devices.
The regulatory response is tightening. The FDA now requires cybersecurity documentation as part of the medical device approval process. The EU’s Medical Device Regulation ties security controls to market authorization. Healthcare organizations face simultaneous pressure from patient safety risk, ransomware operators who have identified the sector as high-value, and regulators who are no longer treating IoMT security as optional.
Manufacturing. Manufacturing is the most-targeted industry for IoT and OT attacks according to both IBM X-Force and ENISA data. Industrial IoT attacks increased 75% in two years according to Verizon DBIR. Dragos recorded 1,693 industrial-targeted ransomware attacks in 2025. The OT/IoT boundary — where industrial sensors and control systems connect to enterprise IT networks — is the primary attack entry point. In many manufacturing environments, this boundary is not segmented at all: IoT sensors connect directly to networks that also carry business data, email, and external connectivity.
Critical infrastructure. CISA’s February 2026 directive ordered all Federal Civilian Executive Branch agencies to strengthen asset lifecycle management for edge network devices and remove those that no longer receive security updates from original equipment manufacturers within 12 to 18 months. The agency specifically identified state-sponsored threat actors using end-of-life edge devices as “a preferred access pathway for breaking into target networks.”
Forescout’s 2026 data found that routers and switches — the most common edge devices in critical infrastructure environments — now average 32 vulnerabilities per device and account for 34% of the most critical vulnerabilities in enterprise networks.
IoT security regulations in 2026 — the exact deadlines that matter
The regulatory environment for IoT security has changed more in the past 24 months than in the previous decade. Understanding which obligations are active now versus pending is operationally important — the consequences of confusing them are significant.
EU Cyber Resilience Act — the September 11, 2026 deadline.
The Cyber Resilience Act (EU Regulation 2024/2847) entered into force on December 10, 2024. June 11, 2026 was the first formal milestone — the date by which EU member states were required to designate conformity assessment bodies under the regulation.
The September 11, 2026 deadline is the one that requires immediate operational preparation. From that date, manufacturers of any hardware or software product with digital elements placed on the EU market must file an early warning notification with ENISA within 24 hours of detecting an actively exploited vulnerability. A full notification must follow within 72 hours.
Non-compliance carries penalties of up to €15 million or 2.5% of global annual turnover, whichever is higher. This applies to manufacturers based outside the EU if their products reach the EU market. It applies retroactively to products already on the market, not only to new releases.
The full CRA compliance regime — CE-marking, conformity assessment, documentation of design and development processes — does not apply until December 11, 2027. But the 24-hour reporting obligation in September 2026 requires infrastructure that cannot be built in days: a complete product inventory, SBOM documentation for every product on the EU market, real-time vulnerability monitoring capable of detecting active exploitation, and an internal escalation and notification pipeline that can execute within 24 hours of detection.
Organizations that have not begun this preparation are already behind. The 24-hour clock cannot be met by organizations that do not know what software components are in their products.
UK Product Security and Telecommunications Infrastructure Act.
The UK PSTI Act came into force on April 29, 2024. It is active and being enforced. The Act bans default universal passwords on consumer IoT devices — a device that ships with “admin/admin” or any credential that is the same across multiple units is non-compliant. Penalties reach up to £10 million. The UK’s Office for Product Safety and Standards has enforcement authority.
US Cyber Trust Mark.
The FCC published a public notice establishing the US Cyber Trust Mark on April 13, 2026, administered by the ioXt Alliance. The Mark is a voluntary labeling regime for consumer IoT devices, certifying that a device meets minimum cybersecurity standards. It is not yet mandatory.
The practical significance is purchasing pressure. Enterprise procurement teams, government buyers, and security-conscious consumers will increasingly require Trust Mark certification as a purchasing condition. Manufacturers that achieve certification early will have a procurement advantage; those that do not will face increasing friction as the labeling regime gains adoption. Watch for the first federal government procurement requirements explicitly referencing Trust Mark certification in H2 2026.
CISA CPG 2.0
The Cybersecurity Performance Goals 2.0, published by CISA, unifies IT, IoT, and OT security objectives for US critical infrastructure organizations. Unlike the EU CRA, CPG 2.0 is not a legally binding regulation — but for organizations in sectors CISA oversees, it represents the de facto standard against which security posture will be evaluated in the event of an incident or federal audit.
What to watch — the emerging global regulatory floor
Singapore’s IoT Cyber Security Guide, Australia’s proposed mandatory IoT security standards, and Canada’s Bill C-26 (Critical Cyber Systems Protection Act) all signal that the EU and UK regulatory moves are the leading edge of a global convergence, not outliers. Organizations that design their IoT security programs to meet EU CRA requirements will be well-positioned for the regulatory standards that follow in other jurisdictions.
What to watch for the rest of 2026
Watch 1: Post-quantum cryptography and the IoT hardware replacement problem.
NIST finalized its post-quantum cryptography standards in 2024. Most IoT devices currently deployed are incapable of running PQC algorithms on their existing hardware — the computational requirements exceed what constrained IoT processors can handle. The transition from current cryptographic standards to PQC will require hardware replacement at a scale that has no precedent in IoT history. It will not happen through firmware updates alone.
2026 is when procurement teams need to begin asking manufacturers the right questions: does this device support PQC algorithm updates? What is the hardware lifecycle? What is the manufacturer’s PQC transition roadmap? These questions do not yet have widely available answers — but the organizations that are asking them now will be better positioned than those who discover the problem at the deadline.
Watch 2: First EU CRA enforcement actions.
September 11 activates the 24-hour reporting obligation. The first enforcement actions from EU national competent authorities are likely to follow in Q4 2026 or Q1 2027. These early cases will establish the practical interpretation of the regulation: how aggressively authorities enforce the 24-hour window, what constitutes “actively exploited” for reporting purposes, and what penalties look like for first-time non-compliance.
Manufacturers and importers selling into the EU market should monitor these enforcement actions closely — they will define the practical risk landscape more precisely than the regulation’s text alone.
Watch 3: AI attack automation proliferating to lower-sophistication actors.
Aisuru’s AI-adapted DDoS capability is currently the domain of sophisticated threat actors. The tools, techniques, and infrastructure that enable AI-driven attack automation follow a consistent historical pattern: they begin as advanced-actor capabilities and become available to lower-sophistication actors within 12 to 18 months as the tools commoditize.
By H2 2026, watch for AI-enabled IoT botnet campaigns from actors who lack the sophistication to have built Aisuru but can now access comparable capabilities through cybercrime-as-a-service offerings.
Watch 4: OT/IoT ransomware convergence.
The 46% surge in OT ransomware in 2025 is not the ceiling — it is the beginning of a trend line. Ransomware operators have identified the OT/IoT boundary as the highest-value target in industrial environments: disrupting physical operations creates more acute payment pressure than encrypting business data. Watch for ransomware operators building specific capability around the IoT-to-OT pivot — using compromised IoT sensors as the initial access vector for attacks that ultimately target industrial control systems.
Watch 5: Trust Mark washing.
As the US Cyber Trust Mark gains purchasing traction, a secondary concern emerges: certification that does not reflect actual security posture. This pattern has appeared in every voluntary security labeling regime that has achieved market significance — organizations pursue the label with minimal substantive security improvement, relying on the certification process being less rigorous than the label implies. Watch for early documented cases of Cyber Trust Mark certified devices with significant vulnerabilities, and the regulatory response they prompt.
Six IoT security actions specific to 2026 — not generic advice
Each action below is tied to a specific 2026 incident. This is not a generic checklist. It is a direct response to documented events.
Action 1 — Complete device inventory before anything else.
Why now: Forescout 2026 found that 40% of the riskiest device types were unknown to security teams a year ago. You cannot protect what you cannot see, and the threat surface is changing faster than manual inventory processes can track.
How:Deploy automated network discovery tools that continuously identify connected devices — Forescout, Armis, and Claroty are purpose-built for this. Prioritize finding devices that registered on the network without IT awareness: shadow IoT brought in by individual departments or teams, consumer devices connected to corporate networks, and devices deployed years ago that have since been removed from asset registries but remain physically connected.
Action 2 — Add supply chain assessment to every IoT procurement process.
Why now: BadBox 2.0 proved that a device can arrive compromised from the factory. No post-deployment security measure addresses a pre-installed backdoor.
How: Before purchasing any IoT device — particularly budget Android-based devices, consumer-grade network hardware, or devices from manufacturers without established security track records — require a Software Bill of Materials, evidence of firmware signing, and documentation of the manufacturer’s vulnerability disclosure and patching process. For high-value deployments, consider pre-purchase security assessment by a qualified vendor before deployment.
Action 3 — Implement behavioral monitoring alongside signature-based detection.
Why now: Raptor Train operated undetected for four years. Signature-based tools will never catch a threat that generates no known-malicious traffic signatures. AI-adapted attacks are specifically designed to evade signature detection.
How: Establish baseline communication profiles for every IoT device on the network — what it normally connects to, when, and how much traffic it generates. Alert on deviations. This approach is not a replacement for signature-based tools — it is a necessary complement. Tools that support this approach in IoT environments include Darktrace, Vectra AI, and Cisco Secure Network Analytics.
Action 4 — Prepare EU CRA 24-hour reporting infrastructure before September 11.
Why now: The deadline is fixed with no extensions. Non-compliance carries penalties of up to €15 million. More practically: organizations that cannot meet the 24-hour reporting window on September 11 cannot comply, and the preparation required — SBOM documentation, real-time vulnerability monitoring, internal escalation pipelines — cannot be built in days.
How: If your organization manufactures or imports connected products into the EU market, immediately audit your product inventory for CRA scope, generate or verify SBOMs for all in-scope products, implement vulnerability monitoring capable of detecting active exploitation across your product portfolio, and establish the internal escalation chain that can execute a notification within 24 hours.
Action 5 — Verify that your segmentation actually works under test conditions.
Why now: Cisco’s 2025 Segmentation Report found that 79% of security leaders report having network segmentation in place. Almost none had segmentation that worked when tested under realistic conditions. Assumed segmentation is not actual segmentation.
How: Commission a segmentation validation exercise — either internally or through a third-party penetration testing firm — that specifically tests lateral movement from a compromised IoT device to core enterprise systems. The test should simulate realistic attack paths, not just verify that VLANs are configured. Document the findings and remediate gaps before they are discovered by an attacker.
Action 6 — Audit and change default credentials across every IoT device.
Why now: Nozomi Networks’ July 2025 analysis of real-world OT environments found that brute-forcing default credentials remains the top botnet recruitment technique in 2026. 7.36% of all detected attacks are brute-force attempts; another 5.27% directly exploit default credentials for lateral movement. Despite years of awareness campaigns, this vector remains highly effective because organizations consistently fail to complete the credential change process across their entire IoT inventory.
How: Run your device inventory output against a default credential database for every identified device model. Prioritize public-internet-facing devices, then devices on networks adjacent to OT systems, then all remaining devices. Document completion. This action is unglamorous and time-consuming — and it closes one of the most consistently exploited attack vectors in IoT security.
Frequently asked questions — IoT security news 2026
What are the biggest IoT security threats in 2026?
The most critical active threats include the Aisuru/TurboMirai botnet (which achieved 29.7 Tbps DDoS capability and was disrupted in March 2026 but not eliminated), the BadBox 2.0 supply chain compromise affecting 10 million+ pre-infected devices, the IOCONTROL Iranian APT campaign against critical infrastructure, KadNap’s 2026 Asus router campaign, the ShadowV2 Mirai variant, and the Mars Hydro cloud misconfiguration that exposed 2.7 billion device records.
What is the EU Cyber Resilience Act for IoT?
The EU Cyber Resilience Act (Regulation EU 2024/2847) is European law requiring manufacturers of hardware and software products with digital elements — including IoT devices — to meet cybersecurity standards as a condition of EU market access. The most immediate obligation is the September 11, 2026 reporting deadline: manufacturers must notify ENISA within 24 hours of detecting an actively exploited vulnerability. Full compliance including CE-marking is required by December 11, 2027. Non-compliance penalties reach €15 million or 2.5% of global annual turnover.
What was BadBox 2.0?
BadBox 2.0 was the largest known botnet of internet-connected TVs ever documented, disclosed by Google, Human Security, and Trend Micro in 2025. More than 10 million smart TVs, digital projectors, in-car infotainment systems, and digital picture frames were compromised with malware pre-installed during manufacturing — before they reached retailers or consumers. The infection could not be remediated through standard post-purchase security practices because it was embedded in the device firmware at the factory level.
How many IoT devices are connected globally in 2026?
The global connected IoT device population reached 21.1 billion at the end of 2025, growing 14% year-over-year, according to IoT Analytics. The installed base is on a 13.2% compound annual growth rate trajectory toward 39 billion devices by 2030. The attack surface is scaling faster than security budgets and staffing in most organizations.
What is the US Cyber Trust Mark?
The US Cyber Trust Mark is a voluntary IoT security labeling program established by the FCC and administered by the ioXt Alliance, with a public notice issued on April 13, 2026. Consumer IoT devices that meet defined cybersecurity standards can carry the Mark, signaling to buyers that the device meets a minimum security baseline. It is not currently mandatory, but enterprise procurement policies and government purchasing requirements are expected to reference it increasingly.
Which industries face the highest IoT security risk in 2026?
Healthcare (99% of hospitals run devices with Known Exploited Vulnerabilities), manufacturing (#1 most-targeted industry, industrial IoT attacks up 75% in two years), and critical infrastructure (subject to nation-state targeting via IOCONTROL and end-of-life edge device exploitation) face the most severe risk. Smart cities and public administration, financial services, and consumer/retail follow at elevated but lower severity levels.
How does AI affect IoT security attacks?
AI affects IoT attacks in two primary ways. On the offense side, automated reconnaissance maps global IoT device populations at speed, and real-time adaptive DDoS (as demonstrated by Aisuru) adjusts attack patterns to evade mitigation measures as they are deployed. On the defense side, AI-powered behavioral monitoring is now the primary method for detecting compromised IoT devices — because AI-adapted attacks generate no signature-matching traffic, traditional signature-based detection cannot catch them.
What is a Mirai botnet variant?
Mirai was IoT malware whose source code was publicly released in 2016 after being used in a record-breaking DDoS attack. Because the source code is public, threat actors have built hundreds of variants. In 2026, active Mirai-based variants include Aisuru/TurboMirai, Kimwolf, Eleven11bot, ShadowV2, and others. They share Mirai’s core architecture — scanning for vulnerable IoT devices, logging in with default credentials, and enrolling devices in a botnet — but have added capabilities including AI adaptation, broader protocol support, and more sophisticated evasion techniques.
How do I secure IoT devices on my network?
The most impactful steps in order of priority: (1) Complete a device inventory — you cannot protect what you cannot see. (2) Change default credentials on every device. (3) Network-segment IoT devices into dedicated VLANs isolated from core enterprise systems, and verify that segmentation works under test conditions. (4) Enable behavioral monitoring to detect compromised devices that generate no known-malicious signatures. (5) Apply firmware updates and establish a patching cadence. (6) For any device that cannot be patched or segmented, evaluate whether it should remain on the network.
What is an SBOM in IoT security?
An SBOM — Software Bill of Materials — is a machine-readable inventory of every software component in a device or application: libraries, dependencies, operating system components, and their versions. For IoT security, SBOMs enable organizations to quickly identify whether a newly disclosed vulnerability affects any device in their environment. The EU CRA mandates SBOMs for products on the EU market. The US government has required SBOMs for software supplied to federal agencies since 2021. In the context of supply chain security, SBOMs are the foundational document that makes it possible to detect BadBox-style pre-infections and components with known exploited vulnerabilities.
The single most important IoT security decision in 2026
Every organization managing IoT devices faces the same structural choice in 2026: continue with security architectures designed for a threat landscape that no longer exists, or adapt to the landscape that does.
The threat landscape of 2024 assumed attackers would need to exploit known vulnerabilities after a device was deployed. The threat landscape of 2026 includes devices compromised at the factory, AI-adapted attacks that no signature library can catch, and nation-state actors with the patience to spend four years in a compromised network without generating a detectable alert.
Each of these threats has a specific defensive response. Supply chain attacks require procurement-level security assessment. AI-adapted attacks require behavioral anomaly detection. Nation-state persistence requires the same behavioral monitoring that catches long-dwell compromises.
What none of them can be addressed by is the security architecture most organizations built five years ago. The tools exist. The frameworks exist. The regulatory requirements are now arriving. The question for every IT manager, CISO, and business owner reading this is whether the adaptation happens proactively — or in response to an incident that made it unavoidable.
Related reading: BadBox 2.0 — IoT supply chain attack explained · EU Cyber Resilience Act compliance guide · Healthcare IoT and IoMT security 2026 · How to secure IoT devices on your network · OT ransomware trends and risk 2026 · US Cyber Trust Mark for IoT buyers
Sources: Vectra AI IoT Security 2026 · Asimily IoT Cybersecurity Breaches 2026 · Swif IoT Security Statistics 2026 · Stingrai IoT Attack Statistics 2026 · Dexpose IoT Hacking Statistics 2026 · IT Pro IoT attacks 2026 · SecurityWeek Aisuru/Kimwolf disruption · TechTimes EU CRA September 2026 · Mend.io EU CRA compliance guide · Keysight EU CRA countdown · Cloudflare Q3 2025 DDoS Threat Report · Nozomi Networks OT/IoT Security Report 2025 · WEF Global Cybersecurity Outlook 2026 · Forescout threat telemetry 2026 · CISA edge device directive February 2026
