CISA just dropped a report indicating that over 70% of cyber incidents in 2025 started with a compromised Internet of Things (IoT) device. That’s the initial access vector. The foot in the door came from a smart camera or sensor, which then pivoted to attack the connected apps. This stat gets right to the heart of the problem with IoT security: how do you establish real device trust when the endpoints themselves are the weak link? How can businesses secure their operations when their most numerous devices are so vulnerable?
Key Takeaways
- Hardware-backed root of trust is still missing in 72% of IoT devices, creating a massive security hole right from the start.
- When a breach starts with an IoT device, the average cost is now $4.5 million, up 15% in 2025.
- Strong API security like mutual TLS and OAuth 2.0 can slash app-level vulnerabilities by as much as 60%.
- Integrating IoT device identity into your main access control system can cut unauthorized access attempts to apps by 35%.
- You need to be running automated security audits on device firmware and app code at least quarterly to catch new threats.
Only 28% of IoT Device Manufacturers Implement Hardware-Backed Root of Trust
The IoT Security Foundation’s late 2025 survey gives us this number, and it’s a tough one to swallow: only 28% of device makers are building in a hardware-backed root of trust (RoT). A RoT is an architectural necessity. It’s what ensures a device’s boot process is verified by unchangeable hardware, making it almost impossible for an attacker to inject malware at the lowest level. Without that hardware anchor, the whole chain of trust, from the moment a device powers on to its communication with an application, is basically built on sand. It’s baffling that in 2026, with IoT running everything from city power grids to hospital equipment, this is still a minority practice. It’s like building a skyscraper and hoping the paint job holds it together.
I see it all the time in the field: companies that skip hardware-level security find out way too late that their software patches are just band-aids on a deep wound. If a device can’t prove its identity cryptographically from the moment it boots up, then every other security measure you layer on top, secure boot, firmware signing, app authentication, is built on a weak foundation. This shockingly low 28% adoption rate directly creates huge risks for connected apps because those apps are expecting clean data from a trusted source. You can’t trust the data coming from an unverified device, and you certainly can’t trust the commands sent back to it, which leaves the door wide open for data manipulation, unauthorized access, and complete system takeovers.
Average Cost of an IoT-Originating Data Breach Reached $4.5 Million in 2025
IBM’s 2025 Cost of a Data Breach Report puts a hard number on this problem: $4.5 million. That’s the average cost when a breach starts from an IoT device. And that’s not just regulatory fines (though those are part of it with new privacy laws). The $4.5 million figure includes the whole nightmare: detection, escalation, notifying customers, the response team’s overtime, and the business you lose when your reputation is shot. When an IoT device is the entry point, the damage to connected apps can be a train wreck. Picture a smart factory floor where a single compromised sensor starts feeding bad data into the production management app, suddenly you’re churning out defective products, your line is down, and you’re losing money by the second. Or worse, a hacked medical device in a hospital starts leaking patient data from the main EHR system it talks to.
For years, the playbook was all about network perimeters and app firewalls. Those are still important, but they’re not nearly enough anymore. IoT has blown the doors off the traditional attack surface. Every connected thermostat, camera, and industrial controller is now a potential entry point on your network. What I see is that too many organizations treat IoT security as its own separate (and less important) problem, completely walled off from their main IT security strategy. This siloed thinking is a huge mistake. A security failure on a ‘lowly’ IoT device quickly becomes a full-blown enterprise crisis affecting every application that device touches, and that $4.5 million price tag is a clear signal that spending on solid IoT security is a real risk mitigation strategy, not just another line item on the IT budget.
Only 40% of Organizations Regularly Perform Penetration Testing on Their IoT Ecosystems
A 2025 survey from the Ponemon Institute found that only 40% of companies are regularly pen testing their IoT setups, which shows a major disconnect from reality. Even as they deploy more and more devices, the majority are not actively trying to find the holes in their own systems. Penetration testing is a fundamental part of any real security program. It’s how you find out what a real attacker would do by simulating those attacks against your devices, their protocols, and especially their interactions with connected apps. Without that adversarial mindset, you’re just flying blind and praying your defenses are good enough. You can’t patch a vulnerability you don’t even know exists.
I often hear the excuse that IoT environments are just too complex and dynamic to test properly. That’s a weak argument. Yes, it’s challenging, you have to deal with hardware-specific issues and various protocols like MQTT or Bluetooth Low Energy, but the specialized tools and expertise exist to do it right. The fact that it isn’t happening points to a lack of budget, a poor understanding of the actual risk, or both. This is a massive blind spot, especially for applications that depend on real-time data from these devices to make critical decisions. A good pen test will find the exact vulnerabilities an attacker would use, like how to spoof a device’s identity to fool an application, inject malicious commands, or pull sensitive data right out of the stream. It’s about finding the holes before someone else does.
A Disagreement with Conventional Wisdom: The Overemphasis on Edge Computing as a Sole Security Panacea
There’s a popular idea that edge computing is the silver bullet for IoT security because it processes data locally and reduces latency. The thinking is that if you process data near the source, less of it has to travel to the cloud, shrinking your attack surface. While edge computing does have some real performance and privacy advantages, thinking it will solve all your IoT security problems is a dangerous oversimplification. This view completely ignores how hard it is to secure the edge itself.
When you push compute power to the edge, you’re putting more complex hardware and software in places that might not be physically secure, often managed by people who aren’t cybersecurity pros. Every single edge node is another target for an attacker, often sitting out there by itself. Just trying to keep all those distributed nodes patched, enforce access controls, and maintain a chain of trust across a huge, spread-out network is a management nightmare. And even if data gets processed on the edge, the important stuff, the aggregated data, the insights, the management commands, still has to get back to your central cloud applications. The security of those backhaul connections and the integrity of the data they carry still comes down to whether you can trust the device in the first place, not just where it does its math. Edge computing just moves the perimeter. It doesn’t get rid of the need for end-to-end security that begins with a trusted device and extends all the way to every connected application.
Less Than 50% of IoT Ecosystems Have Centralized Identity and Access Management (IAM) for Both Devices and Applications
A 2025 Gartner report on IoT security trends points out something that I find pretty wild: less than half of all IoT setups have a centralized Identity and Access Management (IAM) system for both devices and apps. When every IoT device is a potential actor on your network and every application a resource, not bringing their identities under one roof is just asking for trouble. So many companies still manage device identity in one silo and user/app identity in another, which leads to a mess of fragmented security policies and inconsistent rules. A smart meter or a factory robot needs a unique, provable identity just like a person or a microservice does, and it should be managed centrally to control exactly which connected apps it’s allowed to talk to.
Without a central IAM, enforcing the principle of least privilege is nearly impossible. A compromised device might have wide-open permissions to talk to a dozen different applications it has no business touching, giving an attacker a huge playing field. On the other side of the coin, you get operational headaches when legitimate devices can’t authenticate properly because of mismatched, siloed policies. And good luck doing an incident audit when you can’t easily track which device, with what credentials, accessed which app, and when. Pulling device and app identities together into one IAM solution, using standards like OAuth 2.0 and OpenID Connect where they make sense, isn’t about making things neat. It’s about building a coherent security model where trust is applied consistently across the entire IoT ecosystem, making sure only the right devices are talking to the right applications.
The problems with securing IoT devices and the apps they connect to are big, but they are solvable. All the data points in the same direction: we need to make fundamental changes, starting with trust at the hardware level and carrying it all the way through to integrated identity management. Making end-to-end security for IoT ecosystems a top priority is what will separate the resilient organizations from the ones we read about in breach reports.
What is a hardware-backed root of trust in IoT security?
A hardware-backed root of trust (RoT) uses unchangeable hardware inside an IoT device to check that its software is legitimate every time it boots up. This makes sure the device always starts in a secure state and is extremely difficult to compromise with low-level malware or fake firmware.
How do IoT device compromises impact connected applications?
When an attacker compromises an IoT device, they can use it as a beachhead to get into your network. From there, they can use the device’s access to steal or change data from connected apps, shut down services, or launch even bigger attacks inside your systems.
Why is centralized Identity and Access Management (IAM) important for IoT ecosystems?
A centralized IAM system gives every device and application a unique identity that’s managed in one place. This lets you enforce very specific access rules (like which sensor can talk to which app), makes it much easier to audit activity, and helps you apply the principle of least privilege everywhere.
What role does penetration testing play in IoT security?
IoT pen testing is basically ethical hacking. You hire experts to attack your own systems, the devices, their communication methods, and how they interact with apps, to find security holes before a real attacker does. It’s a critical, proactive step to find and fix your weaknesses.
Can edge computing fully address IoT security concerns?
No. Edge computing can help with performance and processing data locally, but it doesn’t solve the core security problem. It just moves your security perimeter out to more distributed, and often less secure, locations. You still need to establish trust at the device level and secure the communications back to your central applications.
