Are smart home devices safe?

What counts as a smart home device?

A smart device is any everyday object that connects to the internet: a video doorbell, a security camera, a speaker you talk to, a thermostat, a baby monitor, a smart plug or a TV. Engineers call this the Internet of Things, or IoT.

The benefits are real: checking who is at the door from work, warming the house before you get home, or helping an older relative live independently. The question is not whether to avoid them entirely, but how to choose and use them wisely.

What are the real risks?

Most problems fall into a few groups:

• Weak default passwords. Some older devices shipped with the same simple password on every unit, such as "admin". Criminals scan the internet for exactly these.
• No more updates. Like phones, devices need security fixes. Cheap products may never receive any, and even good ones stop after a few years.
• Privacy. Cameras and microphones collect sensitive information, and that data is often stored in the maker's cloud.
• A doorway to your network. A poorly protected device on your home Wi-Fi could, in some cases, give an attacker a foothold to look at other devices.

It is worth keeping this in proportion. For most households, the bigger day-to-day risks are still scam messages and reused passwords. But a forgotten, never-updated camera is an easy target, and it is easy to fix.

The law is catching up

Governments have started setting minimum standards:

• United Kingdom: since 29 April 2024, makers of consumer smart devices sold in the UK must not use common or easily guessed default passwords, must publish a way to report security problems, and must say for how long the product will get security updates.
• European Union: under the Cyber Resilience Act, from 11 September 2026 makers must report actively exploited flaws and serious incidents affecting their products to the authorities, with an early warning within 24 hours. The main requirements, including secure design and ongoing updates, apply from 11 December 2027, and compliant products will carry the CE mark. The European Commission specifically mentions products such as door locks and baby monitors.
• United States: the Cyber Trust Mark is a voluntary label for smart devices tested by approved labs. In April 2026 the regulator, the FCC, appointed a new organisation to lead the scheme after the original administrator withdrew. Reports at the time did not say how many labelled products were on sale.

These rules mostly raise the floor rather than guarantee safety, and older devices bought before them are not covered in the same way.

How to choose a safer device

1. Check the update promise. In the UK, the support period should be stated. Prefer devices that promise several years of security updates.
2. Look for a known maker with a support page and a way to report security problems.
3. Be cautious with very cheap, unbranded cameras and monitors sold through marketplaces, especially if you cannot find who makes them.
4. Think about where it goes. Do you need a camera inside the house, or would one covering the front door do?

How to set up and live with it safely

• Change any default password and use a unique one. Our password generator can help.
• Turn on two-step sign-in for the app account that controls the device.
• Switch on automatic updates, and check the app now and then.
• Secure your router. It is the front door of your home network: change its admin password and keep it updated. Our Wi-Fi basics note explains how.
• Review privacy settings, such as how long recordings are kept and who in the household can view them.
• Retire devices that no longer get updates, and reset them to factory settings before selling or recycling.

Tip: Want the technical version? Our notes on VLANs explain how professionals separate smart devices onto their own network. Many home routers offer a simpler "guest network" that does a similar job.