IoT challenges: security, privacy, interoperability, scale and lifetime
In short: IoT projects face linked challenges: weak device security, privacy risks, incompatible standards, the difficulty of managing huge fleets and devices that outlive their software support. Regulations and standards now push makers to fix the worst problems, but buyers and operators still need to plan for them.
Why IoT is hard
IoT brings the problems of ordinary IT into places that were never designed for computers, on hardware with little power or memory, at huge scale, for many years. The challenges below are linked: fixing one often helps another.
Security
Many devices have shipped with default or hard-coded passwords, open management services, unencrypted traffic and no way to update. Large botnets such as Mirai, first seen in 2016, grew by logging into exposed cameras and routers with factory credentials and using them for denial-of-service attacks. The lesson still holds: one weak default, copied across a product line, can be abused at internet scale. The UK Product Security and Telecommunications Infrastructure (PSTI) regime, in force since April 2024, now bans universal default passwords on consumer connected products and requires makers to publish a vulnerability reporting route and a minimum support period.
Privacy and interoperability
Privacy: devices in homes, cars and workplaces collect data about people, often continuously and without a screen to show what is happening. Owners may not know what is collected, where it goes or how long it is kept.
Interoperability: devices use many radios and protocols, from Wi-Fi and Bluetooth to Zigbee, LoRaWAN and proprietary systems. Products from different makers often cannot talk to each other, leading to lock-in and extra gateways. Standards such as Matter for smart homes and MQTT for messaging help, but no single standard covers every need.
Scale and lifetime
Scale turns simple tasks into big ones. Changing a password by hand is fine for five devices and impossible for fifty thousand. Large fleets need automated enrolment, monitoring and over-the-air updates.
Lifetime is a mismatch between hardware and software. A smart meter or building controller may stay in service for ten years or more, but the maker may stop issuing updates much sooner, or go out of business. Plan for end-of-life before you buy.
| Challenge | Practical response |
|---|---|
| Weak defaults | Unique credentials, disable unused services, choose vendors with a disclosure policy |
| Privacy | Data minimisation, clear notices, retention limits |
| Interoperability | Prefer open standards; use gateways to translate |
| Scale | Device management platform, automation, inventory |
| Lifetime | Check support period before purchase; segment or replace unsupported devices |
Tip: when buying IoT for an organisation, ask the supplier three questions: how long will this get security updates, how are updates delivered, and how do I report a vulnerability? Vague answers are a warning sign.
Practice
How did the Mirai botnet recruit devices?
What is an interoperability problem in IoT?
Why is device lifetime a security challenge?
Key takeaways
- IoT challenges are linked: security, privacy, interoperability, scale and lifetime.
- Default passwords and missing updates have enabled large botnets.
- UK PSTI rules ban universal default passwords on consumer connected products.
- Large fleets need automation; manual management does not scale.
- Check the support period before buying and plan for end-of-life.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.