What is IoT?
IoT (Internet of Things) is the network of physical devices equipped with sensors, software and a network connection, so that they can independently collect data, exchange it and respond to commands, usually via a gateway or directly over the internet with cloud platforms. Think of smart thermostats, wearables, connected cars, smart doorbells and occupancy sensors in offices. According to market analyst IoT Analytics, there were around 18.5 billion connected IoT devices worldwide at the end of 2024, with growth expected to roughly 39 billion by 2030.
The term was coined in 1999 by Kevin Ashton, then at Procter & Gamble, in a presentation about RFID in the supply chain. The idea is older: in 1982 Carnegie Mellon University connected a soft drinks vending machine to the ARPANET so that stock and temperature could be checked remotely. For IT/OT professionals, IoT matters because the same technology, in a more robust form, underpins the Industrial Internet of Things and increasingly ends up, often unnoticed, on the OT network.
🧠 How does an IoT system work?
Almost every IoT system consists of four layers. Reference architectures such as ISO/IEC 30141 elaborate on this, but the core is the same everywhere:
| Layer | Function | Examples |
|---|---|---|
| Device | Measuring, switching and local processing | Sensors, actuators, embedded microcontrollers |
| Connectivity | Transporting data to a gateway or the internet | Wi-Fi, Bluetooth, Zigbee, LoRaWAN, NB-IoT, LTE-M, 5G |
| Edge / gateway | Translating protocols, filtering and buffering data | Smart home hub, edge device, edge computing |
| Platform and application | Storing, analysing, visualising and sending commands back | Cloud platform, app, dashboard, digital twin |
A defining trait of IoT is that devices are often severely constrained in processing power, memory and energy. RFC 7228 (2014) divides these constrained devices into three classes: class 0 has far less than 10 KiB of RAM and 100 KiB of flash, class 1 about 10 KiB of RAM and 100 KiB of flash, and class 2 about 50 KiB of RAM and 250 KiB of flash. That explains why IoT relies on its own lightweight protocols instead of heavy web protocols, and why on-device security is often limited.
📡 Which protocols and networks does IoT use?
IoT communication has two layers: the network (radio or cable) and the messaging protocol on top of it.
| Technology | Type | Typical range and use |
|---|---|---|
| Wi-Fi | Wireless LAN | Tens of metres; cameras, smart speakers, mains-powered devices |
| Bluetooth Low Energy | Personal area network | A few to tens of metres; wearables, beacons, device commissioning |
| Zigbee and Thread | Mesh network, 2.4 GHz | Home and building; lighting, switches, battery-powered sensors |
| LoRaWAN | LPWAN, 868 MHz in Europe | Kilometres; meter readings, parking and environmental sensors |
| NB-IoT and LTE-M | Cellular LPWAN (3GPP Release 13) | National coverage over the mobile network; battery life up to around ten years |
| MQTT | Publish/subscribe via a broker | Lightweight messaging protocol; MQTT 5.0 has been an OASIS standard since 2019 |
| CoAP | REST-like over UDP (RFC 7252, 2014) | For the smallest, most constrained devices |
| AMQP | Enterprise messaging | Linking platforms with IT systems |
In the consumer market, the Matter standard aims to end the fragmentation. Matter 1.0 was published on 4 October 2022, is maintained by the Connectivity Standards Alliance and runs over Wi-Fi, Ethernet and Thread, using Bluetooth Low Energy to commission new devices. In industry, MQTT Sparkplug B plays a similar role: a fixed topic structure and payload so that devices from different vendors understand each other.
🔁 What is the difference between IoT and IIoT?
IIoT is the industrial variant of IoT. It connects machines, sensors, controllers and production lines in order to monitor and optimise processes and predict maintenance. The technology is similar, but the requirements differ sharply.
| Feature | IoT (consumer and building) | IIoT (industry) |
|---|---|---|
| Target audience | Consumers, offices, smart cities | Manufacturing, energy, water, logistics |
| Primary goal | Comfort, convenience, insight | Availability, efficiency, safety |
| Impact of failure | Inconvenient | Lost production or an unsafe situation |
| Reliability | Often best effort | High availability and predictable real-time behaviour |
| Service life | A few years | Often 10 to 20 years |
| Protocols | Wi-Fi, Bluetooth, Zigbee, Matter | Modbus, OPC UA, MQTT, ProfiNET |
| Security | Often limited, managed via app and cloud | Segmentation, zones, Zero Trust, controlled data flows to IT |
| Example | Thermostat you control from an app | Vibration sensor on a pump whose data predicts a failure |
IIoT is IoT in an industrial OT context, with much higher demands on reliability, service life and safety.
🏭 Where is IoT used?
| Domain | Examples |
|---|---|
| Consumer | Smart lighting, smart doorbells, fitness trackers, robot vacuum cleaners |
| Buildings | Temperature, CO₂ and occupancy sensors linked to building automation and HVAC |
| Mobility | Connected cars, vehicle tracking, EV charging points |
| Agriculture | Soil moisture and weather sensors, irrigation, livestock monitoring |
| Healthcare | Medical wearables for heart rate, blood sugar or fall detection |
| Industry (IIoT) | Condition monitoring, predictive maintenance, energy monitoring |
In industry, IoT feeds data to SCADA, MES, a historian or a Unified Namespace, supporting real-time monitoring and remote maintenance. It thereby bridges traditional OT and IT applications such as analytics and AI, which is what OT convergence looks like in practice.
🔐 Why is IoT a security risk?
IoT devices are cheap, numerous and often hard to manage. The best-known illustration is the Mirai botnet, discovered in August 2016. Mirai tried a list of more than sixty default username and password combinations to log in to cameras and routers, and used the hijacked devices for DDoS attacks, including one on DNS provider Dyn on 21 October 2016 that made major websites unreachable for hours.
The most common weaknesses:
- Default passwords - identical factory passwords on thousands of devices
- No updates - firmware is not supported at all, or only briefly, so vulnerabilities stay open
- Unencrypted communication - data and commands sent without TLS or authentication
- Shadow IoT - a smart TV, camera or energy meter that joins the network without IT or OT knowing and becomes a rogue device
- Cloud dependency - the device stops working when the vendor’s cloud goes down
The European standard ETSI EN 303 645 (version 3.1.3, September 2024) sets out thirteen groups of baseline security provisions for consumer IoT. The first three are regarded as the minimum: no universal default passwords, a way to report vulnerabilities, and keeping software updated.
⚖️ Which European rules apply to IoT devices?
| Rule | What it means for IoT | Date |
|---|---|---|
| Radio Equipment Directive + EN 18031 | Cybersecurity requirements for wireless, internet-connected devices, such as no universal default passwords | Mandatory since 1 August 2025 |
| Cyber Resilience Act | Security by design, security updates during the support period, reporting of actively exploited vulnerabilities | Reporting since 11 September 2026; full application from 11 December 2027 |
| Data Act | Users gain access to the data generated by their connected products | Applies since 12 September 2025; design obligation since 12 September 2026 |
| GDPR (AVG) | Protection of personal data collected by IoT devices | Since 2018 |
Outside the EU, the United Kingdom’s PSTI regime has applied since 29 April 2024, with three baseline requirements in line with ETSI EN 303 645: unique or user-defined passwords, a point of contact for reporting vulnerabilities, and a published minimum period during which security updates will be provided. If you deploy IoT at an essential or important entity in the Netherlands, the duty of care under the Dutch Cybersecurity Act (Cbw) applies as well.
🔧 How do you deploy IoT safely alongside OT?
A practical approach for organisations adding IoT devices to buildings or production environments:
- Take inventory - map every connected device, including building systems and meters; an asset inventory is the foundation.
- Set procurement requirements - ask for unique passwords, a published support period, a vulnerability reporting point and conformity with EN 18031 or the CRA.
- Separate networks - place IoT in its own VLAN or zone, never flat on the same network as PLCs; see network segmentation.
- Restrict data flows - allow devices to connect outbound only to known brokers or cloud addresses; block inbound traffic.
- Manage the lifecycle - plan patch management, change default settings at commissioning and replace devices when support ends.
- Monitor - use network monitoring to detect new devices or devices that communicate abnormally.
❓ Frequently asked questions
What does IoT stand for?
IoT stands for Internet of Things. The term was coined in 1999 by Kevin Ashton. IoT covers all physical devices that use sensors and a network connection to exchange data independently.
Does an IoT device always need internet access?
No, an IoT device does not have to be connected to the internet itself. Many IoT devices talk to a gateway over Zigbee, Bluetooth or LoRaWAN, which forwards the data or processes it locally. More and more systems, such as Matter, are deliberately designed to work without the cloud as well.
What is the difference between IoT and M2M?
M2M (machine-to-machine) is the older term for direct communication between devices, often over a dedicated link such as a cellular data connection with a SIM card. IoT is broader: it connects devices to internet platforms, apps and analytics. M2M can be seen as a forerunner and part of IoT.
Why are IoT devices often insecure?
IoT devices are often insecure because of default passwords, missing updates and limited processing power for encryption. The Mirai botnet exploited exactly those weaknesses in 2016. European rules such as the Radio Equipment Directive and the Cyber Resilience Act now require manufacturers to provide better baseline security.
Can an IoT device be connected to the OT network?
An IoT device should not sit unseparated on the OT network, because it can give attackers an extra way in. Place IoT in its own network segment with strict firewall rules and allow only the data flows you need. Industrial sensors that are part of the process fall under the OT security policy and IEC 62443.
What is the difference between IoT and Industry 4.0?
IoT is a technology: connected devices that exchange data. Industry 4.0 is a broader vision of the digital factory, bringing together IIoT, data analytics, automation and the integration of IT and OT. IoT is therefore one of the building blocks of Industry 4.0.
📌 In summary
IoT equips physical devices with sensors and a network connection so that they collect and exchange data on their own, from the smart thermostat at home to the vibration sensor on a pump.
With an estimated 18.5 billion devices, IoT is everywhere, but default passwords, missing updates and shadow IoT also make it a major security risk. European rules such as EN 18031, the Cyber Resilience Act and the Data Act now set requirements for security and data access. The Industrial Internet of Things goes a step further, bringing this technology to the industrial OT environment with stricter demands on reliability and segmentation.