Keyfactor and Vanson Bourne released findings from an independent survey and analysis that examines the state of IoT security for both manufacturers and end users. The report, Digital Trust in a Connected World: Navigating the State of IoT Security, reveals concerns and challenges modern businesses face when establishing digital trust in today’s connected world, and shows 97% of organizations are struggling to secure their IoT and connected products to some degree. The research survey also found that 98% of organizations experienced certificate outages in the last 12 months, costing an average of over $2.25 million.  

The costly outages organizations have faced in the past year are not the only expense of inefficient IoT security. The report found that 89% of respondents’ organizations that operate and use IoT and connected products have been hit by cyber attacks at an average cost of $250K. Furthermore, in the past three years, 69% of organizations have seen an increase in cyber attacks on their IoT devices. The March attack on Amazon’s Ring that exfiltrated sensitive customer data such as recorded footage and credit card numbers is an example of the increase in IoT attacks. 

Other key report highlights

• Proliferating growth of IoT devices and connected products in organizations: In the past three years, respondents reported a 20% average increase in the number of IoT and connected products used by organizations.
• IT professionals are not fully confident in the security of their IoT and connected devices: 88% of organizations agree that improvements are needed in the security of IoT and connected products in use within their organization, with 37% of respondents reporting that significant improvement is needed and 60% reporting that some improvement is needed. When it comes to specific strategies, 4 in 10 organizations report that they strongly agree they would benefit from using a PKI to issue digital identities on the IoT and IIoT devices in their environment. 
• IoT security budgets are increasing but are being used to cover staggering costs from certificate outages: While budgets for IoT device security are increasing year over year, with an anticipated increase of 45% in the next five years, half (52%) of that budget is at risk of being diverted to cover the cost of successful cyber breaches on IoT and connected products. 
• Organizations and manufacturers are split on who is responsible for IoT security: Of the respondents surveyed, 48% believed that the manufacturer of IoT or connected devices should be at least mostly responsible for cyber breaches on their products. 

The study was conducted by Vanson Bourne on behalf of Keyfactor with responses from 1,200 IoT and connected product professionals across North America, EMEA, and APAC. All respondents had some responsibility or knowledge of IoT or connected products within their organization, and included original equipment manufacturers (OEMs) and those who are using and operating connected devices within their organization.