Securing IoT devices with Zero Trust architecture

The rising threat landscape for IoT devices

The Internet of Things (IoT) is revolutionising industries, from smart cities and electric vehicle (EV) charging stations to automation in utilities and logistics. However, with the anticipated surge to over 50 billion connected devices by 2035 (IoT Analytics), the attack surface for cyber threats is expanding at an alarming rate. According to Verizon, one in three data breaches now involves an IoT device, and IBM reports that more than 50% of these devices have critical vulnerabilities that hackers can exploit.

As IoT devices become more integrated into critical infrastructure, the stakes are higher than ever. Rogue base stations, SIM swap attacks, and OTA (Over-the-Air) exploits are just a few of the tactics cybercriminals use to compromise these devices. The result? Potential operational disruptions, data breaches, and hefty regulatory fines. In this environment, traditional security measures are no longer sufficient.

Why Zero Trust is crucial for IoT security

Zero Trust is emerging as the new baseline for protecting IoT devices. Unlike traditional security models that assume everything inside the network is safe, Zero Trust operates on the principle that no entity—whether inside or outside the network—should be inherently trusted. Every device, user, and connection must be verified.

This approach is particularly crucial for IoT environments, which are often uniquely exposed. Devices are frequently located in remote or public areas, making them easy targets for attackers. Once a single device is compromised, attackers can move laterally through the network to reach more valuable assets, such as customer data or payment systems. Zero Trust mitigates this risk by continuously verifying each connection and limiting access to only the necessary resources.

Implementing Zero Trust: key principles and practices

Implementing Zero Trust for IoT involves several key principles:

• Least privilege access: Devices should only communicate with necessary endpoints. This minimises the potential damage if a device is compromised.

• Micro-segmentation: By dividing the network into smaller segments, organisations can limit the exposure of each device's traffic and prevent lateral movement of threats.

• Secure identity: Each device, SIM, or module must prove its identity before joining the network. This ensures that only authorised devices can access the system.

• Context-aware controls: Policies should be applied based on the context, such as location, behaviour, or time. This adds an additional layer of security.

• Continuous Verification: Monitoring activity continuously ensures that persistent access does not equate to persistent trust.

Securing data paths: Moving beyond public networks

Most IoT traffic today still runs over shared mobile networks and the public internet—channels that were never designed for security or control. This is a significant liability for deployments handling sensitive data. Public paths are opaque, leaving organisations blind to how data is routed and who handles it. Shared Access Point Names (APNs) and public IPs further expose devices to probing and attacks.

The solution lies in moving to connectivity that is secure by design. Private, isolated data paths through dedicated APNs, VPN tunnels, or direct cloud endpoints provide full control over how, where, and when data moves. Combined with Zero Trust principles, this architecture validates every connection, limits exposure, and surfaces anomalies in real time.

Overcoming the challenges of Zero Trust implementation

Implementing Zero Trust can seem daunting, especially for organisations with large-scale IoT deployments. However, modern solutions make it possible without overhauling existing infrastructure. Key strategies include:

• Support for modern SIM technologies: Adopting eSIM or multi-profile SIMs ensures local compliance and resilience against permanent roaming restrictions. These technologies also enable remote provisioning and quicker deployment across regions.

• Cloud-native integration: Direct integration with cloud environments like AWS, Azure, or GCP allows IoT data to flow securely into your backend without relying on public internet paths. This reduces latency and improves data residency control.

• Network-level policy enforcement: A connectivity model that supports Zero Trust principles at the network edge is crucial. This includes capabilities like micro-segmentation, traffic monitoring, IP filtering, and anomaly detection as close to the source as possible.

Future trends in IoT security and Zero Trust

Looking ahead, several trends will shape the future of IoT security and Zero Trust:

• iSIM Goes Mainstream: Integrated SIM (iSIM) technology will see broader adoption, offering better security and reducing hardware complexity.

• 5G RedCap Deployments Expand: 5G Reduced Capability (RedCap) will provide a sweet spot between LTE-M/NB-IoT and full 5G, opening doors for more critical mid-tier applications.

• Tighter Security-by-Design Requirements: Stricter mandates under regulations like the EU Cyber Resilience Act will scrutinise IoT supply chains and connectivity vendors.

• AI at the Network Edge: AI-driven anomaly detection and policy enforcement will increasingly occur closer to devices, enabling faster threat mitigation.

• Consolidation of IoT Connectivity Platforms: More enterprises will shift toward integrated platforms that bundle SIM provisioning, security, policy enforcement, and observability.

By embracing these trends and implementing Zero Trust, organisations can ensure their IoT devices and data remain secure, resilient, and compliant in an ever-evolving threat landscape.

About the author

IXT writes about IoT connectivity because we build it. We’re a Full-MVNO with our own core network and a CMP we designed in-house, so we see what works at scale and what doesn’t. Our team has decades of experience in M2M/IoT, from network engineering to enterprise rollouts, so the guidance we share is practical, vendor-agnostic and field-tested. Connect, secure and manage devices with confidence using our IoT Connectivity.

IXT – Connected. Secure. Everywhere.