What Are Two Major Concerns Regarding IoT Devices? Security and Privacy

The two major concerns regarding IoT devices are security and privacy. Security, because many devices ship with weak passwords, unpatched software and open network services that attackers can take over. Privacy, because the devices collect data about people, places and behaviour, often more than users realise, and send it to cloud services they do not control.

Key takeaways

• If you are answering a quiz or exam question, the two answers are security and privacy.
• Security risks come from default or shared passwords, missing updates, exposed services and devices that cannot be monitored.
• Privacy risks come from collecting too much data, unclear consent, weak encryption in transit and data flowing to third parties.
• Regulation is catching up: the EU Cyber Resilience Act's reporting duties apply from 11 September 2026 and its main obligations from 11 December 2027.
• The UK has required unique or user-set passwords on consumer connectable products since 29 April 2024.
• For organisations, the practical fixes are an inventory, network segmentation, an update policy and buying from vendors who publish a vulnerability process.

Why is security a major concern for IoT devices?

IoT devices are small computers that sit on your network, often for years, with little attention. That makes them attractive targets. A compromised camera, sensor or controller can be used to spy, to move deeper into the network, or as part of a botnet that attacks others.

The usual weak points are:

• Default and shared passwords. The same factory password on every unit is the easiest way in. Botnets scan the internet for exactly these.
• No updates, or no way to install them. Many devices never receive firmware fixes, or need manual updates nobody performs.
• Exposed services. Telnet, unauthenticated web interfaces or debug ports left open on the network or even the internet.
• Weak device identity. Devices that cannot prove who they are make it hard to stop a fake device joining the network.
• Little or no logging. If the device cannot report what it is doing, you will not notice when it is misused.

NIST's IoT device cybersecurity capability core baseline (NIST IR 8259A) turns these weak points into a checklist of capabilities a device should have: a unique identity, configurable settings, data protection, controlled access to interfaces, secure software updates and the ability to report its own security state. It is a useful buying requirement even for organisations that are not in the US.

Why is privacy a major concern for IoT devices?

IoT devices are built to observe. A smart meter shows when a home is empty. A wearable tracks health and location. A building sensor shows who is in which room. Combined, this data says a lot about individuals.

• Collecting more than needed. Devices often gather data "just in case", which goes against the data minimisation principle in GDPR.
• Unclear consent. People affected by the device, such as visitors, employees or tenants, are often not the ones who agreed to the terms.
• Data in transit. Unencrypted traffic between the device, app and cloud can be intercepted.
• Third-party sharing. Vendors may pass data to analytics or advertising partners, sometimes outside the EU.
• Retention. Data stored for years in a vendor cloud is a breach waiting to happen.

In the EU, if IoT data relates to an identifiable person it is personal data, and GDPR applies in full: lawful basis, transparency, minimisation, security and, for high-risk processing, a data protection impact assessment.

How do IoT security and privacy risks differ?

The two overlap. A security breach is often also a privacy breach, because the attacker gets the data. For devices in industrial settings, see our comparison of OT and IoT security.

What do new laws require from IoT devices?

The EU Cyber Resilience Act sets mandatory cybersecurity requirements for products with digital elements, covering design, development and maintenance. Manufacturers must also handle vulnerabilities during the product's lifecycle, and compliant products carry the CE marking. According to the European Commission, the act entered into force on 10 December 2024, reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027.

In the UK, the Product Security and Telecommunications Infrastructure (PSTI) regime came into effect on 29 April 2024. Among other things, passwords on consumer connectable products must be unique per product or set by the user.

For organisations covered by NIS2, connected devices are part of the network and information systems you must protect, so they belong in your risk assessment and asset inventory.

Are there other concerns besides security and privacy?

Yes. Beyond the two main ones, organisations deploying IoT also deal with:

• Interoperability. Devices use different protocols and platforms, which makes integration and central management harder.
• Lifecycle and vendor support. Devices outlive their support period. Ask how long updates are guaranteed.
• Scale and management. Thousands of devices need provisioning, monitoring and decommissioning processes.
• Safety. When devices control physical processes, a fault or attack can cause physical harm, not only data loss.

How can organisations reduce IoT security and privacy risks?

1. Keep an inventory. You cannot protect devices you do not know about. Include model, firmware version, owner and network location.
2. Change or remove default credentials before a device goes live, and use certificates for device identity where the platform supports it.
3. Segment the network. Put IoT devices on separate VLANs or networks with only the connections they need.
4. Patch on a schedule. Track firmware releases and replace devices that no longer receive updates.
5. Minimise data. Collect only what the use case needs, encrypt it in transit and at rest, and set retention limits.
6. Monitor traffic. Unusual destinations or volumes are often the first sign of a compromised device.
7. Test before you trust. A focused IoT penetration test finds weak interfaces before an attacker does.
8. Buy carefully. Prefer vendors with a published vulnerability disclosure process, a stated support period and CRA readiness.

How Opsio helps

Opsio designs and builds connected solutions through our IoT development services, with security and data protection in the architecture from the start. For devices already in use, our managed security services and 24/7 SOC monitor network traffic and alert on suspicious behaviour.

Frequently asked questions

What are two major concerns regarding IoT devices? (Select two.)

Security and privacy. Security covers attackers taking control of devices or using them to reach other systems. Privacy covers how much personal data devices collect and who can access it.

What is the biggest security risk of IoT devices?

Weak or default credentials combined with missing updates. Together they let automated attacks take over large numbers of devices with little effort, which is why both the UK PSTI regime and the EU Cyber Resilience Act address them.

Does GDPR apply to IoT data?

Yes, whenever the data relates to an identified or identifiable person. Location, usage patterns and audio or video from devices are often personal data, so GDPR's principles and security duties apply.

How do you secure IoT devices at home or in a small office?

Change default passwords, turn on automatic updates, put devices on a guest or separate network, switch off features you do not use and replace devices the vendor no longer supports.