IoT Adoption Stalls: Why the Hype Misses the Mark

Ken Munro at Pen Test Partners

If the Gartner hype cycle is an accurate gauge, the Internet of Things (IoT) is now entering the trough of disillusionment. Recent studies show that roughly 60% of pilot deployments fail to deliver on their promises. While isolated projects may stumble, the broader market has not yet saturated with devices to signal a peak; instead, the pace of new adoption is slowing.

Several factors undermine IoT’s growth. One major issue is the trend of adding connectivity to devices that simply do not need it. Take the “IoT fishtank” that monitored feeding, temperature and water quality. Ken Munro, partner at Pen Test Partners, notes that a casino that installed the tank lost 10 GB of data to a device located in Finland. This illustrates how poorly secured IoT endpoints can become backdoors into corporate networks, enabling credential theft and data exfiltration.

Longevity is another concern. Many organizations replace devices instead of updating firmware, casting doubt on the long‑term return on investment. Even when a device remains in service, the question remains: will the manufacturer provide ongoing support and security patches? Vulnerabilities that surface over time can leave devices exposed if manufacturers lack the resources or willingness to issue updates, or worse, withdraw support altogether.

Uncovered Vulnerabilities

Manufacturers struggle to protect their existing installed base. Shodan’s public database lists thousands of deployed IoT units—including Industrial Control Systems—alongside details such as IP addresses, operating systems, and software versions. Combined with the FCC’s release of schematics for upcoming devices, attackers can identify vulnerable models and exploit default credentials. In one incident, a technician publicly posted a “super password” list that gave daily login credentials for an entire year, underscoring the laxity in supply‑chain security and the ease with which confidential data can be compromised.

Faced with these risks, some vendors are turning to data monetization. Selling usage data to third parties may generate revenue but further erodes user privacy. For example, floor‑plan data from a smart vacuum cleaner could be sold on the dark web, or Building Management System (BMS) data could enable ransomware attacks on smart thermostats.

Path Forward

Some may argue that end‑users should shoulder more responsibility, yet many fail to reconfigure devices after installation. Even when changes are made, default PINs or passwords often remain weak—four or six digits can be cracked in hours. The root cause of the current lack of confidence is simply poor security design, and manufacturers must act.

Security best practices include: secure mobile‑app development, robust session management, end‑to‑end encryption for web services, rigorous implementation of wireless standards, disabling unused interfaces (serial/debug ports), employing obfuscation and secure key storage on the device, and ensuring firmware is encrypted and digitally signed. Until vendors prioritize these measures, IoT adoption will continue to falter. One high‑profile malware incident—particularly one targeting a ubiquitous interface such as port 80—could permanently dent market confidence. Building trust through industry‑wide standards or regulatory oversight is now essential.

Author: Ken Munro, Partner at Pen Test Partners