Secure IoT lifecycle: vulnerability disclosure, support periods and end of life
In short: IoT security does not end at the factory gate. Makers need a way to receive and fix vulnerability reports, a clear promise of how long updates will last, and a plan for end of life. Owners need to track support dates and decommission devices safely, wiping data and revoking credentials.
Security across the whole life
An IoT product may stay in service for five, ten or twenty years. Over that time new vulnerabilities will be found in its code and in the libraries it uses. A product that was secure on launch day becomes insecure if nobody looks after it. The lifecycle view asks two questions: how does the maker keep the product safe while it is supported, and what happens when support ends?
Coordinated vulnerability disclosure
Coordinated vulnerability disclosure (CVD) is the agreed way for security researchers to report a flaw privately so the maker can fix it before details become public. It needs:
- A published contact, such as a web page and a
security.txtfile (RFC 9116) athttps://example.com/.well-known/security.txt. - A policy that explains what to report, expected response times and a promise not to take legal action against good-faith researchers.
- An internal team, often called a PSIRT (product security incident response team), that triages and fixes reports.
ISO/IEC 29147 describes how to receive reports and publish advisories, and ISO/IEC 30111 describes the internal handling process. Many makers also become a CNA (CVE Numbering Authority) so they can assign CVE identifiers to their own products.
# https://example.com/.well-known/security.txt
Contact: mailto:security@example.com
Expires: 2027-12-31T23:59:00.000Z
Policy: https://example.com/security/disclosure-policy
Preferred-Languages: enSupport periods
A support period is how long the maker promises to provide security updates. Under the UK PSTI regime it must be stated for consumer products at the point of sale, and the EU Cyber Resilience Act also requires a defined support period. For buyers, it is a key procurement question: a cheap camera with one year of updates may cost more in risk than a dearer one with seven.
| Stage | Maker's job | Owner's job |
|---|---|---|
| Supported | Monitor components (using an SBOM), fix and release updates, publish advisories | Apply updates, track inventory and versions |
| End of support announced | Give notice, publish the final version and any known issues | Plan replacement, budget, add compensating controls |
| End of life | Optionally publish a way to keep devices usable locally, such as disabling cloud reliance | Isolate or retire devices; do not leave them exposed |
End of life and decommissioning
Unsupported devices are a growing risk: botnets regularly target routers and recorders that will never receive another patch. When a device leaves service, follow a short, repeatable procedure.
- Record the device in your asset inventory as being retired.
- Revoke or delete its certificates, API keys and cloud registrations so they cannot be reused.
- Remove Wi-Fi and network credentials from it with a factory reset, and change any shared secrets it knew.
- Wipe or destroy storage that held recordings or personal data.
- Remove firewall rules, DHCP reservations and NAC entries that existed for it.
- Recycle it responsibly under local e-waste rules.
Tip: if you cannot replace an end-of-life device yet, apply compensating controls: tight segmentation, no internet access, extra monitoring and a dated plan to replace it. Record this as an accepted risk with an owner.
Practice
What is the purpose of a security.txt file?
Why does an SBOM help a maker during the support period?
Name two steps when decommissioning a networked camera.
Key takeaways
- Security must be managed for the whole product life, not only at launch.
- Coordinated disclosure needs a published contact, a policy and a PSIRT.
- Buyers should know the support period before purchase.
- End-of-life devices need isolation or replacement, not neglect.
- Decommissioning revokes credentials, wipes data and removes network access.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.