What Is the Internet of Things (IoT)? Examples, Risks and Security Basics

Your thermostat adjusts itself before you get home. A sensor in a warehouse warns that a freezer is warming up. A delivery truck reports its location every few seconds. A doorbell sends video to your phone. All of these are part of the internet of things, usually shortened to IoT.

IoT is now so common that most people don’t notice it. That’s exactly why it’s worth understanding. Every connected device brings convenience, and every 1 is also a small computer sitting on your network, collecting data and potentially open to attack.

This guide explains what IoT is in plain language, shows real examples at home and at work, and covers the security basics to check before you buy or connect anything.

What the internet of things means

The internet of things is the network of physical objects that have sensors, software and a network connection, so they can collect data, share it and be controlled remotely. The “things” can be almost anything: light bulbs, door locks, fitness trackers, medical monitors, factory machines, farm equipment, parking meters or shipping containers.

What makes something an IoT device isn’t how smart it is. It’s that it connects a physical object to the digital world. A regular thermostat measures temperature. A connected thermostat measures temperature, sends that reading to an app, receives commands from your phone and can follow a schedule you set from anywhere.

How IoT works

Most IoT systems have 4 parts:

1. The device and its sensors. These measure something, like temperature, motion, location, sound, light or vibration, or act on something, like a lock motor or a valve.
2. Connectivity. The device sends data over Wi-Fi, Bluetooth, Thread, Zigbee, cellular networks, or low-power wide-area networks built for sensors that send small amounts of data over long distances.
3. Processing. Data is processed in the cloud, on a local hub or on the device itself. Processing close to the device is called edge computing. Our guide to edge computing explains why it’s growing.
4. The app or dashboard. You see the data and control devices from a phone app, voice assistant or business dashboard, and set rules or automations.

In smart homes, the Matter standard from the Connectivity Standards Alliance is making devices from different brands work together across platforms like Apple Home, Google Home, Alexa and SmartThings.

IoT examples at home

Home IoT is what most people picture first:

• Smart speakers and displays that control other devices by voice.
• Smart plugs, bulbs and switches that run on schedules.
• Thermostats that learn routines and adjust when you’re away.
• Video doorbells and security cameras that send alerts and video. See our guide on how to choose a home security camera.
• Smart locks that let you grant temporary access.
• Leak and smoke sensors that alert your phone.
• Wearables like smartwatches and fitness trackers.
• Connected appliances and TVs that download updates and apps.

If you’re starting your own setup, our room-by-room smart home setup plan shows how to add devices without app sprawl.

IoT examples in business

For businesses, IoT is mostly about measuring things that were hard to measure before and acting on that data faster.

Want to go deeper by industry? See our guides to smart manufacturing and remote patient monitoring.

The risks: why IoT security matters

IoT devices are often cheap, always on and rarely updated. That makes them attractive targets.

Default and weak passwords. Devices that ship with the same default password, or let you keep a weak 1, are easy to break into. Attackers scan the internet for exactly these devices.

Botnets. Hijacked devices can be grouped into botnets that flood websites with traffic. In 2016, the Mirai botnet used large numbers of compromised IoT devices, such as cameras and routers, to launch major attacks, and the US government’s cybersecurity agency warned about it at the time.

Missing updates. Many devices get few or no security updates. When a flaw is found, it may never be fixed.

A path into your network. A compromised device can give attackers a foothold to reach laptops, phones or business systems on the same network. Malware on 1 device can spread to others.

Privacy. Cameras, microphones, location trackers and health devices collect sensitive data. Where that data goes, and who can see it, depends on the company.

Physical safety. Locks, garage doors, medical devices and industrial controls affect the real world. A security failure can mean a door left open to intruders or a stopped production line.

Key takeaway: Every IoT device is a computer on your network. Treat it like 1: change default passwords, keep it updated, keep it on a separate network where you can and only buy from makers that commit to security updates.

Security basics every buyer should check

Before you buy, and right after you connect, run through this checklist.

At home, the FTC recommends changing default router and device passwords, turning on wireless encryption, enabling two-factor authentication, keeping firmware and apps updated, and turning off features you don’t use, such as remote management.

For businesses, the US government’s own baseline is a useful buying guide. NIST’s IoT Device Cybersecurity Capability Core Baseline (NIST IR 8259A, May 2020) lists 6 capabilities devices should generally support: device identification, device configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness. Ask vendors how their devices meet each 1. It also helps to treat IoT as part of a zero trust security approach, where no device is trusted just because it’s on your network, and to segment devices onto their own network, as covered in how to secure business Wi-Fi.

Laws and labels to know

IoT security rules are tightening. A few to know:

• IoT Cybersecurity Improvement Act of 2020 (US). Signed December 4, 2020, it directs NIST to set security standards for IoT devices owned or controlled by federal agencies and limits agencies from buying devices that don’t comply.
• California SB-327. Effective January 1, 2020, it requires connected devices sold in California to have reasonable security features. A unique preprogrammed password per device, or forcing users to create new credentials before first use, meets part of that requirement.
• US Cyber Trust Mark. The FCC created this voluntary label for consumer IoT devices in 2024. After its first lead administrator withdrew, the FCC named ioXt Alliance as lead administrator in April 2026, so labeled products are still rolling out.
• UK PSTI regime. Since April 29, 2024, consumer connectable products sold in the UK must not use universal default passwords, must give a way to report security issues and must publish a minimum security update period.
• EU Cyber Resilience Act. It entered into force on December 10, 2024. Reporting duties for actively exploited vulnerabilities and severe incidents apply from September 11, 2026, and most other obligations apply from December 11, 2027. US companies that sell connected products in the EU are affected.

This is not legal advice. If you make or sell connected products, check the official sources and talk to qualified counsel.

Where to start

At home:

1. List every connected device you own, including TVs, printers and appliances.
2. Change any default passwords and turn on 2FA for each app account.
3. Turn on automatic updates.
4. Put smart devices on a guest or IoT network if your router supports it.
5. Unplug and reset devices you no longer use.

At a business:

1. Build an inventory of every connected device, including cameras, printers, sensors and building systems.
2. Assign an owner for each device type.
3. Segment IoT devices onto their own network.
4. Check each vendor’s update period and patch process.
5. Use NIST IR 8259A as a checklist for new purchases.

Conclusion

The internet of things is simply physical objects connected to the internet, and it’s already in most homes and businesses. The benefits are real: convenience, efficiency and data that used to be impossible to collect. So are the risks. Buy devices that commit to updates, change default passwords, turn on 2FA and keep IoT gear on its own network. Look up terms like Matter, edge computing or botnet in our glossary.

Sources

• NIST IR 8259A: IoT Device Cybersecurity Capability Core Baseline — the 6 baseline device security capabilities
• FTC Consumer Advice: Securing your internet-connected devices at home — home router and device security steps
• GOV.UK: The UK PSTI product security regime — April 29, 2024 start date and 3 security requirements
• European Commission: Cyber Resilience Act — entry into force and application dates
• California SB-327 bill text — connected device security requirements
• CISA: Heightened DDoS threat posed by Mirai and other botnets — 2016 IoT botnet alert