A modern IoT connectivity architecture has five layers: device and SIM identity, radio access, the mobile core, private routing into your systems, and a security enforcement layer that decides what each device reaches. A management platform sits across all five. Most of the connectivity problems that surface in production are not radio problems. They are layer boundary problems, and they appear months after the pilot worked fine.
Knowing where one layer ends and the next begins tells you which questions to ask a provider, and which failures you will own yourself.
Every session starts with identity. The SIM holds the subscriber identity the network authenticates before a single byte moves. Form factor changes the physical constraints, not the principle. A removable 4FF card, an MFF2 solder-down chip, an eSIM with remote provisioning, and an iSIM built into the modem all present the same identity to the network.
What differs is how you change that identity later. eUICC and remote SIM provisioning under GSMA SGP.32 let you swap the operator profile without touching the device. That matters when the device sits on a pole in another country for eight years. Get this layer wrong and every carrier change becomes a truck roll.
This is the layer buyers ask about first and the one they misjudge most. Coverage maps show where a network exists. They do not show whether your provider holds a roaming agreement with that network, whether the local operator accepts long-term roamers, or whether the radio technology your modem supports is live in that market.
LTE-M and NB-IoT behave differently from LTE Cat 1 in power draw, latency, and indoor penetration. Choose the radio technology against the device duty cycle, then verify regional availability before you commit. IXT SIMs reach 600+ mobile networks across 190+ countries, and the selection logic sits in the network rather than on the device.
The core authenticates the SIM, assigns an IP address, applies the APN or DNN policy, and routes traffic onward. Few buyers ask about it. It decides how much control you hold for the next decade.
An operator running a dedicated mobile core built for IoT controls routing, policy, and security directly. A provider running virtualised on a partner's infrastructure inherits that partner's constraints, and every policy change becomes a request to somebody else. IXT runs its own core as a full MVNO.
Once traffic leaves the core it has to reach your systems. A private APN or DNN keeps it off the public internet. IPSec tunnels carry it into your data centre. Direct cloud connections take it into AWS, Azure, GCP, or Alibaba without a public hop.
Private APN hides traffic but doesn't defend it. Inside the APN you still have a flat network. Anything that reaches one device reaches the rest of them. Treat this layer as isolation rather than as security, and you will design the next layer properly.
Enforcement answers one question for every session: is this device allowed to reach this application right now? Traditional answers depend on software running on the device. Most IoT hardware will never run a client. No operating system to host it, no memory to spare, no update path to maintain it.
Moving enforcement into the network removes that dependency. Traffic is device-initiated, so no ports face the internet. Each device gets least privileged access to the one application it needs, and policy-based segmentation contains a compromise to a single device rather than the whole fleet. Third-party vendors reach a device through a browser session, time-limited and recorded, with no VPN and no network-wide access. In IXT's model this is standard rather than an upgrade: SIM identity, SecureNet private networking, and a Zero Trust layer that checks every session in the network and cloud.
The management platform is where the architecture becomes operable. Activation, suspension, IMEI locking, usage thresholds, session logs, and an API your own systems query. The number that matters here is the latency of the information. Many provider portals show usage on a 24-48 hour delay. IXT's CMP shows every SIM in real time. When a device drops at 02:00, the gap between those two numbers is the gap between a response and a postmortem.
Three failures often repeat. The first is a fleet that works in the home market and disconnects abroad, because layer two was chosen from a coverage map and layer one has no path to a local profile. The second is a security review that stalls at layer four, because an isolated APN gives no answer to "show me what this device talked to". The third is a provider change that never happens, because layer one was locked to a single operator profile at manufacture.
Each of those is decided at design time and paid for in production.
Ask a provider to describe each layer separately. Who owns the core. Whether the SIM profile is changeable in the field. What sits between the APN and your application. How fast the management data updates. A provider who answers all five clearly is describing an architecture. A provider who answers with one product name is describing a brochure.
Ask us how the five layers work for your deployment. Book a demo at ixt.io.