IoT Security Statistics: Attacks, Vulnerabilities, and Device Growth

There were 21.1 billion active IoT devices online at the end of 2025, and attackers treat every one as a way in. IoT malware attacks rose 124% in a single year, and the largest distributed denial-of-service attack ever recorded was fired from a botnet of just 13,000 hijacked devices. This is what the current IoT security statistics show, and what they mean for the networks businesses actually run.

What’s in This Report

IoT Device Growth: The Expanding Attack Surface

The core reason IoT security keeps getting harder is arithmetic. Every year there are more connected devices, and each one adds surface area an attacker can probe. IoT Analytics counted 21.1 billion active IoT devices worldwide at the end of 2025, a 14% increase over the year before, and it expects the base to keep climbing through the decade.

Put on a timeline, the growth curve is steep and shows no sign of flattening. The device base roughly doubles across the current decade.

Most of these devices were never designed with security as a priority. Cameras, sensors, printers, smart TVs, building controls, and medical equipment ship to do one job cheaply, and security is an afterthought bolted on later, if at all. That is why device growth translates so directly into risk: the population of internet-facing hardware is expanding far faster than the discipline of managing it. Businesses that already track laptops and servers often have no inventory at all of the connected devices sitting on the same network, which is exactly the visibility gap that turns a single weak camera into a doorway. Our connected-device management guides cover how to bring that inventory under control.

Source: IoT Analytics, Number of Connected IoT Devices

Get a free security audit of your connected devices

How Often IoT Devices Are Attacked

Attackers have noticed the growing device population, and the attack telemetry proves it. SonicWall, which monitors a global network of sensors, recorded a 124% year-over-year increase in IoT malware attacks, one of the sharpest jumps of any threat category it tracks. IP cameras were hit especially hard.

Routers sit at the center of the problem. Zscaler’s ThreatLabz research found that routers absorb more than 75% of observed IoT attacks, because a compromised router is both a botnet recruit and a foothold for moving deeper into a network. Manufacturing and transportation are the most-targeted sectors, each accounting for 20.2% of IoT malware attacks, or more than 40% combined.

For a wider view of how these attacks fit the overall threat landscape, see our broader cybersecurity statistics, and for the specific exposure smaller firms face, our data on attacks against small businesses.

Source: SonicWall 2025 Cyber Threat Report | Zscaler ThreatLabz Mobile, IoT, and OT Report

See how managed IT keeps device fleets patched and monitored

Botnets and Record-Breaking DDoS Attacks

The payoff for attackers who compromise IoT devices at scale is the botnet: a fleet of hijacked hardware that can be pointed at any target on command. Botnets are why a $30 camera matters to a business that has never heard of it, because that camera can help take down someone else’s network, or its own. The malware families behind these botnets are remarkably concentrated.

The record-setting attack is worth sitting with. In October 2024, Cloudflare blocked a 5.6 terabit-per-second DDoS attack that lasted only 80 seconds and originated from about 13,000 IoT devices running a Mirai variant. It broke the previous record, a 3.8 Tbps attack, set weeks earlier. In the fourth quarter of 2024 alone, the number of attacks exceeding 1 Tbps grew 1,885% over the prior quarter. Volume like that does not require a sophisticated adversary; it requires a lot of poorly secured devices, which the world now has in abundance.

For most businesses the risk runs in two directions. Their own devices can be conscripted into a botnet that attacks others, creating liability and bandwidth costs, and their own services can be knocked offline by a botnet aimed at them. Both scenarios point to the same defenses: keep devices patched, isolate them from critical systems, and have a recovery plan for when something does go down.

Source: Cloudflare DDoS Threat Report, Q4 2024

Build a backup and recovery plan for attack downtime

Where IoT Vulnerabilities Actually Live

Attack volume tells you how hard the door is being pushed. Vulnerability data tells you where the door is weakest. Forescout’s fifth annual Riskiest Connected Devices report, drawn from millions of devices, found that network infrastructure, and routers in particular, has overtaken traditional endpoints as the riskiest category on business networks.

The scale of the underlying weakness has been documented for years. Palo Alto Networks’ Unit 42 published a landmark IoT threat report in 2020 that analyzed 1.2 million devices. Its findings became the baseline the industry still references, and while the report is now several years old, the structural problems it identified, unencrypted traffic and flat networks that let malware spread, remain common today.

The pattern across every current source is consistent: the devices that route and connect a network are more dangerous than the laptops sitting on it, because a weakness in the plumbing exposes everything downstream. Segmenting IoT devices onto their own network, changing default credentials, and patching firmware on a schedule address the majority of what these reports flag.

Source: Forescout Riskiest Connected Devices of 2025 | Palo Alto Networks Unit 42 IoT Threat Report (2020 baseline)

Bring your network infrastructure under active management

Industry Impact: Manufacturing, Healthcare, and Beyond

IoT risk is not spread evenly. It concentrates in sectors that run large fleets of specialized connected equipment, and healthcare is the clearest example. Claroty’s Team82 analyzed 2.25 million connected medical devices across 351 healthcare organizations and found the exposure is close to universal.

Manufacturing and transportation top the list for raw attack volume, while retail carries the riskiest devices on average, followed by financial services, government, healthcare, and manufacturing, according to Forescout. The common thread is operational technology and connected devices that cannot easily be taken offline to patch, which is precisely what makes them attractive targets.

For regulated industries, the stakes go beyond downtime. A breached connected device in a healthcare, legal, financial, or accounting environment can trigger reporting obligations and penalties under frameworks such as HIPAA, PCI-DSS, and SOC 2. That is where a strategic view of device risk, not just a firewall, becomes a compliance requirement rather than a nice-to-have.

Source: Claroty Team82, State of CPS Security: Healthcare Exposures 2025

Get a Virtual CIO to map device risk to compliance

The IoT Security Market and Regulatory Response

Spending and regulation are both catching up to the threat, if slowly. The IoT security market is forecast to nearly triple across the second half of the decade as organizations move device security from an afterthought to a line item.

Three regulatory regimes are pushing manufacturers and operators toward secure-by-default devices. The direction of travel is the same everywhere: no more universal default passwords, mandatory vulnerability reporting, and clear support timelines.

Regulation raises the floor for new devices, but it does nothing for the billions already deployed. The devices on a network today were largely built before these rules existed, which means the responsibility for securing them stays with the organizations that run them. That is the gap between what the market is buying and what the threat data demands.

Source: MarketsandMarkets IoT Security Market Forecast | European Commission, Cyber Resilience Act | FCC US Cyber Trust Mark

Summary Table: Every Statistic at a Glance

The full set of IoT security statistics from this report, with the primary source and reference year for each. Journalists and researchers are welcome to cite this table with attribution to CNiC Solutions and the original source named in each row.

Frequently Asked Questions

Methodology and Sources

The takeaway from every dataset points the same way: the number of connected devices is growing fast, the attacks against them are growing faster, and the weakest links are the routers, cameras, and specialized devices that most organizations do not actively manage. The devices are already on your network. The question is whether anyone is watching them. A free security audit is the fastest way to find out what is connected and where the gaps are.

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC