What is the Internet of Things (IoT)?

IoT in plain English

It used to be that only computers had a network connection. Today, things that nobody thinks of as computers are connected too: the camera at the factory gate, the temperature sensor in the cold storage room, the access control system at reception, or the air conditioning in the meeting room. Together, they form the Internet of Things.

At its core, each of these devices is a small computer with its own built-in software, the firmware. Think of a company as a house with many side entrances: the front door – servers and workstations – is usually well secured. The many small side doors, on the other hand, are easily forgotten. But an attacker only needs one open door.

The term IoT is used mainly for everyday, office, and building technology. Connected devices that control industrial processes usually belong to OT, the operational technology used in manufacturing and utilities. The boundaries are fluid; where the two overlap, people also speak of the industrial IoT.

How the Internet of Things works

A typical IoT system consists of several building blocks – and each of them can have a vulnerability:

1. The device: Sensors capture measurements, and actuators switch or move something. The circuit board often has maintenance interfaces through which the device can be accessed directly.
2. The firmware: It controls the device. Hard-coded passwords, outdated software libraries, or unprotected update functions are typical vulnerabilities.
3. The connection: Wi-Fi, Bluetooth, cellular networks, or special radio standards transmit the data – not always encrypted.
4. The cloud: Many devices send their data to the manufacturer’s servers and receive commands from there.
5. App and web interface: Users operate the device through them. If they are insecurely programmed, it may even be possible to control other people’s devices.

A practical example

Here’s a typical scenario: A logistics company has installed connected cameras in its warehouses. So that shift supervisors can keep an eye on things remotely, the cameras are directly accessible from the internet. At the same time, they sit on the same network as the office PCs and still use the manufacturer’s default password. During a penetration test – an authorized, simulated attack – the testing team finds the cameras using a search engine that specifically looks for connected devices. The team logs in with the default password and makes its way from the camera to the servers on the corporate network. Antivirus software wouldn’t have noticed a real attacker doing this – as a rule, it can’t even be installed on cameras. The company then changes the passwords, moves the cameras to a separate network segment, and allows remote access only through a secured gateway.

Why does this matter for businesses?

IoT devices are often the weakest link in the network. Many are shipped with default passwords, rarely receive updates, and run unnoticed for years. Security software usually can’t be installed on them, and they are often missing from inventory lists. Hijacked devices give attackers an entry point into the corporate network. Or they are linked together into botnets – networks of remote-controlled devices that attackers use, for example, to knock websites offline with floods of requests.

For manufacturers, there’s a second dimension: the Cyber Resilience Act sets binding, EU-wide security requirements for products with digital elements. They range from secure development and updates to reporting exploited vulnerabilities. The obligations apply in stages: the reporting obligations have applied since September 11, 2026, and most of the remaining requirements apply from December 11, 2027. Anyone who develops or sells connected devices should plan for them early.

How to protect your organization

• Keep an inventory: Record all connected devices – including cameras, printers, access control systems, and building technology.
• Change default passwords: Give each device its own strong password, and switch off features you don’t need.
• Separate networks: Place IoT devices in their own network segment that allows only the necessary connections (network segmentation).
• Keep devices off the open internet: Don’t make devices directly accessible from the internet. Remote access belongs behind a secured gateway such as a VPN.
• Plan updates: Install firmware updates regularly, and replace devices that no longer receive updates.
• Consider security when buying: Prefer manufacturers that commit to providing updates for a clearly stated period and fix vulnerabilities transparently.
• Have devices tested: Put critical devices and your own products through a penetration test – including firmware, app, and cloud connectivity.

How Rootsektor can help

Rootsektor tests connected devices holistically – from hardware interfaces and firmware to wireless connections, apps, and the cloud. Whether you operate IoT devices on your own network or develop connected products yourself, our penetration test for OT, ICS/SCADA & IoT shows where attackers could strike and how to close the gaps. We analyze firmware using methods from the field of Code Review & Reverse Engineering. You’ll receive a fixed-price quote after scoping via our Pentest Quote page.