According to a survey from Keyfactor, 97% of organisations face difficulties securing IoT and connected devices with findings indicate that leveraging PKI effectively can be key to solving IoT security problems.

Keyfactor has released the findings from an independent survey and analysis that examines the state of IoT security for both manufacturers and end users. The report (www.keyfactor.com/state-of-iot-security-report-2023) reveals concerns and challenges modern businesses face when establishing digital trust in today’s connected world, and shows nearly all organisations (97%) are struggling to secure their IoT and connected products to some degree.

The survey also found that 98% of organisations experienced certificate outages in the past 12 months, costing an average of over $2.25m.

“Organisations worldwide are under mounting pressure to ensure their IoT and connected devices are protected while navigating an increasingly complex digital landscape that requires complete trust,” said Ellen Boehm, senior vice president at Keyfactor. “The results of this survey demonstrate the importance of identity-first security for those who manufacture IoT devices and those who deploy and operate them in their environment to establish digital trust at scale. Most organisations implement PKI in their IoT security strategy, which is a huge step in the right direction. However, it’s clear that with 97% of organisations facing IoT security challenges, security teams are struggling to leverage their tools efficiently. Ensuring that IoT device security is managed throughout its lifecycle will go a long way in both eliminating costly certificate outages and enhancing the long-term viability of IoT within the enterprise.”

The costly outages organisations have faced in the past year are not the only expense of inefficient IoT security. The report found that 89% of respondents’ organisations that operate and use IoT and connected products have been hit by cyber attacks at an average cost of $250,000. Furthermore, in the past three years, 69% of organisations have seen an increase in cyber attacks on their IoT devices. The March attack on Amazon’s Ring that exfiltrated sensitive customer data such as recorded footage and credit card numbers is an example of the increase in IoT attacks.

“Many IoT security strategies fail to prevent and protect against IoT-targeted cyber attacks because organisations lack the proper education and support needed to fully understand the task at hand,” said Boehm. “Over half of respondents agree that their organisation doesn’t have the proper awareness and expertise to prepare for IoT device cyber attacks, spotlighting the need for more guidance to fully secure their devices. Organisations can’t protect against what they cannot understand.”

In the past three years, respondents reported a 20% average increase in the number of IoT and connected products used by organisations. Most organisations (88%) agree improvements are needed in the security of IoT and connected products in use within their organisation, with over a third (37%) of respondents reporting that significant improvement is needed and 60% reporting that some improvement is needed. When it comes to specific strategies, four in ten organisations report that they strongly agree they would benefit from using a PKI to issue digital identities on the IoT and IIoT devices in their environment.

While budgets for IoT device security are increasing year over year, with an anticipated increase of 45% in the next five years, half (52%) of that budget is at risk of being diverted to cover the cost of successful cyber breaches on IoT and connected products.

Organisations and manufacturers are split on who is responsible for IoT security. Of the respondents surveyed, 48% believed that the manufacturer of IoT or connected devices should be at least mostly responsible for cyber breaches on their products.

The study was conducted by Vanson Bourne on behalf of Keyfactor with responses from 1200 IoT and connected product professionals across North America, Emea and Apac. All respondents had some responsibility or knowledge of IoT or connected products within their organisation, and included OEMs and those who are using and operating connected devices within their organisation.

Keyfactor (keyfactor.com) brings digital trust to the hyper-connected world with identity-first security for every machine and human. By simplifying PKI, automating certificate lifecycle management, and securing every device, workload and thing, Keyfactor helps organisations establish digital trust at scale, and then maintain it.