What is the Internet of Things? Connected devices explained

The Internet of Things, or IoT, is the name for physical objects other than computers and phones that have sensors, a small processor and a network connection, so they can report what they measure and be controlled remotely. A smart thermostat, a fitness band, a factory vibration sensor and an electricity meter that reports itself are all part of it. What makes them a "thing" on the internet is that they collect data and act on the world without a person typing.

In short

• An IoT device senses something, sends the data over a network, usually to a company's cloud servers, and can act on commands that come back.
• Devices connect by Wi-Fi, Bluetooth, low-power mesh radios such as Zigbee and Thread, or cellular networks, chosen for range, power and cost.
• Cheap devices are often badly secured, and in 2016 the Mirai botnet turned hundreds of thousands of cameras and routers into a weapon.

What counts as the Internet of Things?

The term was coined in 1999 by Kevin Ashton, a British technologist then at Procter & Gamble, to describe tagging goods so computers could track them. It now covers almost any device that measures or does something physical and talks to a network. In homes that means smart speakers, doorbells with cameras, lights, locks, thermostats and baby monitors. In industry, the "industrial IoT," it means sensors on pumps and motors that warn before a part fails, trackers on shipping containers, soil-moisture probes on farms and smart electricity meters.

How many there are depends on what is counted. The research firm IoT Analytics, which counts connected devices and gateways but not every sensor behind them, estimated 18.5 billion in 2024 and expected 21.1 billion by the end of 2025, in its October 2025 update. Other firms, counting differently, give different totals.

The misconception to drop is that IoT is one network or one product. It is a pattern: a sensor, a small computer, a connection and, almost always, a service in the cloud that ties them together.

How does a smart device actually work?

Follow one reading from a smart thermostat to your phone and back.

1. Sense. A temperature sensor in the thermostat reads 19.5 °C. A microcontroller, a cheap computer on a single chip, reads it every minute or so.
2. Send. The thermostat sends a small, encrypted message over the home's Wi-Fi to the router, and from there across the internet to the maker's servers. Messages like this are often only a few hundred bytes, using lightweight protocols such as MQTT.
3. Store and decide. The maker's cloud service stores the reading, checks it against your schedule, and updates the app on your phone, which may be on a mobile network miles away.
4. Command. You tap 21 °C on your phone. The command goes from the phone to the cloud, and from the cloud back to the thermostat. That works because the thermostat keeps a connection open to the cloud from the inside, which a home router's firewall allows; a server outside could not easily start a connection to it.
5. Act. The thermostat switches on the heating. The whole loop usually takes a few seconds.

The cloud in the middle is what lets you reach a device from anywhere, and it is also its weak point. If the internet connection drops, many devices lose their smart features. If the company closes its servers, a device can stop working: when Google's Nest shut down the Revolv home hub's service in 2016, the hubs became useless. Some newer devices also work locally, so the basic functions keep going without the cloud.

How do IoT devices connect?

Each connection type trades range against battery life and cost.

Connection	Range	Power use	Typical uses
Wi-Fi	A home	High	Cameras, speakers, plugs that are always powered
Bluetooth Low Energy	A room	Very low	Fitness bands, trackers, devices set up from a phone
Zigbee, Thread	A home, by passing messages from device to device in a mesh	Very low	Sensors, lights, locks on small batteries; need a hub or border router
Cellular (LTE-M, NB-IoT, [[what-is-5g	5G]])	Wherever there is a mobile network	Low to medium
LoRaWAN	Several kilometers	Very low	Farm and city sensors sending small readings rarely

Many devices add satellite positioning, which GPS explains, to report where they are. To reduce the tangle of apps and hubs, the major smart-home companies backed a shared standard called Matter, released in 2022 by the Connectivity Standards Alliance, which runs over Wi-Fi, Thread and Ethernet and lets devices from different makers work together.

Why are IoT devices so often insecure?

Cheap devices are built to a price. Many ship with a default username and password that owners never change, run old software that is never updated, and sit on home networks for years. A camera bought for $30 may get no security fixes at all after the first year. And because they are always on and connected, compromised devices are useful to attackers: as a way into the home network, as spies through their cameras and microphones, or as an army for attacks on others. The general methods are in how hacking works.

Worked example: the Mirai botnet, 2016

Mirai showed how simple an IoT attack can be. As Cloudflare's retrospective, drawn from a USENIX Security 2017 paper, describes it, the program worked in a loop:

1. Scan. Each infected device tried random internet addresses, looking for devices that accepted remote logins over an old protocol called Telnet.
2. Guess. It tried a fixed list of 64 well-known default username and password pairs, such as admin and admin.
3. Infect. When a login worked, it reported the device to a server that loaded Mirai onto it. The new device started scanning too.
4. Attack. On command, every infected device flooded a chosen target with traffic at once.

The growth was fast. In September 2016, Mirai hit the security journalist Brian Krebs's site with about 623 gigabits a second and the French host OVH with over 1 terabit a second, then the largest attacks on public record. On 21 October 2016 it hit Dyn, a company that runs part of the internet's address-lookup system, DNS, and many large websites became unreachable for hours across parts of the US and Europe. At its peak in November 2016 it had infected over 600,000 devices, mostly home routers and cameras. After its code was published online, copies spread. Three young Americans behind it pleaded guilty to federal charges in 2017.

Nothing about Mirai was sophisticated. It needed only devices that let anyone log in with a factory password. That is why rules now target the basics. The United Kingdom's product security regime, in force since 29 April 2024, bans universal default passwords on consumer connected products, requires makers to publish how to report security flaws, and requires them to say how long they will provide security updates. In the United States, the National Institute of Standards and Technology set out baseline security steps for device makers in NIST IR 8259 in 2020.

What does this mean for the devices in your home?

A few habits cover most of the risk. Change any default password, and turn on automatic updates. Before buying, check how long the maker promises security updates. Put smart devices on a separate guest network if the router allows it, so a compromised plug can't reach your laptop. And ask whether a device needs to be online at all: a lamp that works with a switch can't be hacked through the internet.

Check yourself

• Without looking back, trace a smart thermostat's reading from the sensor to your phone, and a command back to the heater.
• Why does a battery-powered door sensor use Zigbee or Thread instead of Wi-Fi?
• What made the Mirai botnet possible, and what rule would have stopped it?

Sources

• State of IoT 2025: Number of connected IoT devices growing 14% to 21.1 billion globally — IoT Analytics, 2025
• Inside the infamous Mirai IoT Botnet: A Retrospective Analysis — Elie Bursztein, Cloudflare, 2017
• The UK Product Security and Telecommunications Infrastructure (Product Security) regime — UK Department for Science, Innovation and Technology, 2024
• NIST IR 8259: Foundational Cybersecurity Activities for IoT Device Manufacturers — National Institute of Standards and Technology, 2020
• Internet of things — Wikipedia