When a power plant comes under cyber attack, we tend to imagine sophisticated hackers breaching a heavily guarded digital vault. In reality, the door is often left wide open by a much smaller, seemingly harmless device. In late 2025, an attack on Poland’s energy sector was traced back to a private mobile network used for remote equipment. By compromising a single environment associated with a wind farm, attackers found a route into systems controlling an entire power plant.
This is the fundamental challenge of the Internet of Things, or IoT. Every new connection intended to drive efficiency also creates a new relationship that must be managed. Security is no longer about building a bigger wall; instead, it is about ensuring that connectivity does not automatically create trust.
The Paradox of Connectivity
Attackers care far less about what a device does than about what it can reach. One of the most striking examples involved a casino where hackers used an internet-connected fish tank thermometer as an entry point to the network. From that thermometer, they accessed sensitive customer data. A sensor meant for convenience became a gateway to a business-critical asset.
Back in 2024, the FTC took action against video surveillance company Verkada after security failures allowed hackers to access live feeds from thousands of cameras in hospitals and schools. This shift means that poor security is no longer just a technical problem for hackers to exploit, it is a legal and compliance nightmare as well.
Whether it is a smart camera, a thermostat, or an industrial sensor, these are not just tools, they are small computers with software, credentials, and network access. When thousands of these devices are poorly secured, they can be harnessed into a “botnet,” which is an army of compromised hardware used to launch massive attacks on other organisations. In the IoT world, a vulnerable device is not just a risk to you, it becomes infrastructure for attacking someone else.
Visibility as the First Line of Defence
You cannot protect what you cannot see. Many IoT devices are installed by facilities teams or suppliers without the security department’s knowledge, and they often remain operational for years. A proper asset inventory must go beyond IP addresses to understand the manufacturer, firmware version, and exactly which systems the device is communicating with.
Effective defence relies on network segmentation. Think of it like an office building: getting into the reception area should not automatically provide a key to the server room. By dividing systems into smaller zones and tightly controlling communication, organisations can ensure that a compromised camera or sensor remains isolated, preventing the lateral movement that turns a minor incident into a major breach.
Building Resilience, Not Just Patching
The uncomfortable reality of IoT is that sometimes you simply cannot patch it. Devices might be out of support, or they might be too critical to take offline. In these cases, just patching is not a strategy. Organisations need compensating controls, such as using behaviour analytics to establish a normal baseline for a device and triggering an alert the moment it starts communicating with an unauthorised overseas IP.
Security should never be a roadblock; it is an enabler. Moving from a reactive posture to a resilient state requires shifting the conversation from what is broken to what matters most to the business. IoT security is not about fixing every vulnerability at once; it is about making data-driven decisions on where to allocate limited resources to protect your most valuable assets.
Strategy Meets Action with Cydea
At Cydea, we specialise in helping organisations navigate this IoT paradox through risk intelligence. We help organisations move away from simply spending on cyber security and towards making strategic investments by quantifying risk scenarios and providing the clarity needed to make better decisions.
Are you ready to understand your IoT exposure? Get in touch with Cydea today to see how our assessment frameworks can help you secure your connected environment and empower your business growth.
Jennifer Howarth
Lucia Turner
Robin Oldham
Archie Coomber
Penny Yap