A sensor sends a reading. Minutes later a dashboard shows a number. Between those two moments sit five distinct layers, four or five organisations, and a handful of decisions your team made years ago and has not revisited since.
Most IoT problems are not device problems. They are path problems. A meter that stops reporting in Poland, a camera that floods your data pool, a vendor session that reaches further into your network than anyone intended: each traces back to a specific layer of the path, and each has a specific owner.
Here is how the path works, layer by layer, and where the control points sit.
The device produces data and hands it to a radio. That radio choice sets the ceiling for everything above it.
LTE-M and NB-IoT suit low-power devices sending small payloads on long battery cycles. Metering, environmental sensing, asset tracking. LTE and 5G suit devices sending video, firmware, or continuous telemetry. The radio determines throughput, latency, and battery life, and once hardware ships, you live with the choice.
Two constraints matter more than throughput at this layer. Most IoT devices are headless. No screen, no operating system you would recognise, no memory to spare. They cannot run a VPN client. They cannot run a security agent. They cannot flag anomalous behaviour about themselves.
Anything you want to enforce about a headless device has to be enforced somewhere other than the device.
The radio attaches to a mobile network. The SIM identifies the device to that network.
This is the first real control point, and the most underused one. The SIM is not just a billing token. It is a cryptographic identity issued before the device ever leaves the factory, present on every session, and impossible for the device software to forge. When a device has no other credential worth trusting, the SIM is the credential.
At this layer three decisions shape the rest of the path:
Get identity right at layer two and the layers above it have something solid to reference. Get it wrong and every security control further up is guessing.
Traffic leaves the mobile network and travels to wherever your systems live. Two models dominate.
The default model routes device traffic out to the public internet, then back in through a firewall or a VPN concentrator. It works. It also means your devices hold a public address, accept inbound connections, and sit exposed to anything scanning that range.
The private model keeps traffic off the public internet entirely. A private APN or DNN carries device traffic from the mobile core to your data centre or cloud environment over IPSec or a direct cloud interconnect. The device never holds a public address. Nothing scans it, because nothing reaches it.
A private APN hides traffic but does not defend it. Inside that APN, devices still sit on a flat network. A compromised meter reaches every other meter. Isolation is not segmentation, and treating the two as the same thing is the most common architectural mistake at this layer.
This layer decides what each device reaches and what reaches each device. It exists in every architecture, whether or not anyone designed it deliberately.
In the VPN model, enforcement happens at the tunnel. A device or a vendor laptop authenticates once, joins the network, and reaches whatever that network segment allows. The unit of trust is the network. One compromised credential inherits everything behind it.
In a Zero Trust model, enforcement happens per session. Every connection is checked against identity and policy before it opens. Traffic is device-initiated, so no ports face outward. Each device reaches the one application it needs and nothing else. The unit of trust is the session.
For IoT, the practical difference is where the enforcement runs. Standard Zero Trust assumes an agent on the endpoint. Headless devices have nowhere to put one. Moving enforcement to the network edge removes that dependency: the SIM supplies the identity, the network applies the policy, and the device does nothing it was not built to do.
Third-party access follows the same logic. An operator with eight hardware vendors faces a choice between eight VPN tunnels into the estate and browser-based privileged remote access scoped to individual devices, time-limited and session-recorded.
One of those produces an audit trail. The other produces an incident report.
The layers above produce data about themselves. Someone has to read it.
A connectivity management platform covers the SIM estate: which SIMs are active, which country each sits in, what each consumes, which have stopped reporting. SIM lifecycle actions live here too, in bulk rather than one at a time.
Refresh rate decides whether this layer is operational or historical. Many provider portals show usage on a 24 to 48 hour delay. That is a report. Live status is an operations tool. When a device drops at 2am, the gap between those two definitions is the gap between noticing tonight and noticing on Thursday.
Traffic visibility is a separate question from SIM visibility. Knowing a SIM is online tells you nothing about what it talks to. Real-time traffic mapping across the fleet, with anomaly detection and policy-based segmentation, is what turns a flat estate into something you hold an auditor to.
Data arrives, gets parsed, stored, and rendered. Your platform team owns this layer and knows it well.
One point worth carrying up from below: the audit trail an auditor asks for under NIS2 does not live here. Application logs record what the application did. They do not record which contractor opened an SSH session to which meter, at what time, for how long, and what they touched. That record comes from the access enforcement layer or it does not exist.
Read the path from the top and every layer looks equally important. Read it from the device and a pattern appears. Three decisions constrain everything downstream:
Teams spend most of their attention on layers five and six, where the tooling is visible and the dashboards live. The constraints come from layers one to three.
IXT runs a dedicated mobile core built for IoT. That places IXT at layers two, three, four, and five of the path described above, with four distinct components rather than one blended promise.
The SIM identifies the device across 600+ mobile networks in 190+ countries. SecureNet keeps traffic off the public internet and routes it to your data centre or cloud. The Zero Trust layer checks every session in the network and cloud, with Zscaler ZTNA for access and Illumio for traffic mapping and segmentation. The CMP shows every SIM in real time.
Your devices and your applications stay yours. Everything between them is what IXT operates.
Device and radio access, network access and SIM identity, transport, security and access enforcement, management and visibility, and the cloud application. Older three-layer models collapse the middle three into one, which hides the layer where most security decisions get made.
At the network layer, for most deployments. Headless devices cannot run agents, and the cloud application sees traffic only after it has already arrived. Enforcement between those two points is the one place that reaches every device regardless of what the device runs.
A private APN removes the public internet from the path. It does not segment devices from each other. Devices inside the APN sit on a flat network unless a segmentation policy separates them.
Network access changes at layer two. The device attaches to a different operator, breaks out at a different point, and falls under a different regulatory regime. Multi-IMSI and eUICC give the fleet more than one identity to present, which keeps devices attached where a single-network SIM would fail.
The access enforcement layer. Per-session records of which identity reached which device, when, and for how long come from Zero Trust enforcement. SIM management reporting is operational and does not cover third-party access.
This guidance is based on real IoT and OT deployments in regulated industries including energy, utilities, and industrial environments.
IXT designs and operates secure connectivity architectures where:
The patterns described here reflect how these environments are secured in practice, not theoretical models.
This article was written by the IXT Connectivity and Security team.
IXT operates a full MVNO core network and delivers secure IoT connectivity across 190+ countries and 600+ mobile networks. The team works directly with industrial, utilities, and infrastructure operators to design and secure large-scale IoT and OT deployments.
Their focus is on network-level Zero Trust architecture, SIM-based identity, and secure device communication without relying on VPNs or endpoint agents.