We were selling a bit pipe. That stopped being enough.

For years, IoT connectivity was sold as a border. You got a SIM, a private network around your devices, and the promise that nothing from the outside world got in. Inside that border, everyone assumed things were safe. The operator assumed it, the customer assumed it, and we assumed it too.

At our October webinar on securing IoT devices, IXT CTO Henning Solberg put it plainly:

“In the past, maybe we [the market] have been a bit naive… We are providing the bit pipe, essentially… We had the approach that the customer will be safe within that environment. This is rapidly changing now.”

That admission matters to anyone buying connectivity, because the border model quietly settled who was responsible for security. The answer was nobody in particular.

Why the border made sense

When fleets were small and closed, it held up. A few hundred meters reported to one head-end system, and nobody outside the company needed access. The operator's job was coverage and uptime, and that is what operators were measured on.

What changed inside the border

Fleets grew into the thousands and spread across countries. Vendors now need remote access, and a single charger or gateway runs software from several suppliers that each want to talk to somewhere. None of that traffic crosses the border, so none of it trips the border's defences.

If one device is compromised, everything it reaches inside the network is within the attacker's reach too.

The gap nobody owns

Ask a customer who secures the traffic inside their private network, and a common answer is the operator. Ask the operator, and the answer is the customer. Cloud computing settled this years ago with a shared responsibility model that spells out which side owns what. IoT connectivity has never had one written down.

Regulation is closing that gap from the customer's side. NIS2 puts accountability at board level, and its security measures include access control and supply chain security. A board asked to prove control over its connected devices needs a provider that has taken on its share of the job.

Who should own what

Henning's answer in the webinar was that the provider has to remove the attack surface, not only route the traffic. Written down, the split looks like this.

The provider's side is the network. It keeps device traffic off the public internet, so devices expose no ports. It checks every session, because most IoT devices cannot run security software of their own. It shows you what every device talks to and enforces the rules you set. And when a vendor needs access, it gives them one device for a limited time, recorded, instead of a VPN into everything.

Your side is the decisions and the paperwork. You decide which device should talk to what. You own risk documentation, incident response, staff training and supplier governance, including which vendors get access at all. Any conformity assessment under the Cyber Resilience Act stays with you too.

At IXT, the provider's side comes as standard, not as an add-on: SecureNet for the private network, and Zero Trust with Zscaler and Illumio for the sessions and the map. It addresses the technical controls in NIS2 Article 21(2). A provider that promises to make you compliant is overselling.

If your current provider won't put its side of that split in writing, you are still buying a bit pipe.

Want to watch the full webinar? Take a look here.

This article was first published on 3 November 2026 in Secure SIM Insights, IXT's weekly newsletter on LinkedIn. Subscribe on LinkedIn to get each edition when it comes out.

Why trust this guide

This guidance is based on real IoT and OT deployments in regulated industries including energy, utilities, and industrial environments.

IXT designs and operates secure connectivity architectures where:

• devices are deployed across multiple countries and networks
• SIM-level identity is enforced at the network edge
• third-party access is controlled without VPNs
• audit trails are required for regulatory compliance (including NIS2)

The patterns described here reflect how these environments are secured in practice, not theoretical models.

About the author

This article was written by the IXT Connectivity and Security team.

IXT operates a full MVNO core network and delivers secure IoT connectivity across 190+ countries and 600+ mobile networks. The team works directly with industrial, utilities, and infrastructure operators to design and secure large-scale IoT and OT deployments.

Their focus is on network-level Zero Trust architecture, SIM-based identity, and secure device communication without relying on VPNs or endpoint agents.