AUTHORS

Image of Ashwin Pal, Partner in the Risk Advisory division at RSM Sydney. Ashwin specialises in privacy and security consulting, governance, risk, and controls advisory, IT security testing and compliance, cyber risk management, cyber security transformation, and security technology implementation for clients in energy, utilities, government, health, mining, and manufacturing sectors.
Ashwin Pal
Partner
Risk Advisory Services
Sydney

IoT security, AI-assisted attacks, and why connected technology is reshaping enterprise security in Australia

The internet of things (IoT) has delivered enormous operational value. It has also opened the most exploited attack surface in modern enterprise security. 

As of early 2026, there are approximately 19 billion connected IoT devices in operation globally. They sit in your manufacturing plants, conference rooms, clinical environments, logistics chains, and in corners of your network that your security team has probably never mapped.

If you are still treating IoT security as a facilities management question, the threat landscape has already moved past you.  

From nation-state botnets to AI-driven ransomware that moves laterally through forgotten smart thermostats, the threat has never been more sophisticated or more consequential. 

 A brief history of IoT security breaches 

Over the past few years, IoT ecosystems have faced a growing range of threats. These threats exploit the inherently complex, distributed, and often insecure nature of IoT environments. Unfortunately, there are many modern examples of getting it wrong.

Mirai botnet attacks (2016 onwards)

The Mirai botnet should have been a turning point. In late 2016, malware exploiting default credentials on hundreds of thousands of IoT devices brought down Dyn, a major DNS provider, and with it large sections of the internet including Twitter, Netflix, and PayPal.

Mirai worked because the industry had shipped tens of millions of devices with credentials like admin/admin or root/1234 and users never changed them. The attack was simple: scan for devices with factory-default passwords, infect them, then coordinate them into a distributed denial-of-service (DDoS) weapon.
Nearly a decade later, Mirai variants are still active. In September 2024, the FBI revealed that PRC-linked actors had used a Mirai variant called Nosedive to compromise over 260,000 home office and IoT devices as part of a persistent botnet operation. 

BadBox 2.0 (2025)

Described as the largest known botnet of internet-connected consumer devices, BadBox 2.0 involved more than 10 million compromised devices including smart televisions, digital projectors, in-car infotainment systems, and digital picture frames. The malware was distributed through three vectors: pre-installed before purchase, retrieved on first boot from a command-and-control server, or downloaded from third-party app stores. The infected devices were enrolled in a global botnet used for click fraud, account hijacking, and DDoS attacks.

The DJI Romo robovac incident (February 2026)

In February 2026, a French software engineer named Sammy Azdoufal sat down with a PlayStation 5 controller and a curious idea: could he drive his DJI Romo robot vacuum like a video game? Using an AI coding assistant, he reverse-engineered how the vacuum communicated with DJI's cloud servers. This task would previously have required deep specialist knowledge and days of work. Boosted by AI, Azdoufal was successful beyond his initial intention. The security token he extracted to identify his own device acted, on DJI's backend servers, as a master key. Rather than validating access to a single device, the server returned data for nearly 7,000 other DJI robot vacuums operating across 24 countries.

Within nine minutes of a live demonstration, Azdoufal's laptop had collected over 100,000 messages from those devices. He could view live camera feeds. He could activate microphones, access detailed 2D floor plans of strangers' homes, even see which homes were occupied and which were not.

Azdoufal acted responsibly, disclosing the vulnerability to journalists who notified DJI. The company's initial response was to claim the flaw had been patched before it actually had been. Full remediation only followed after journalists demonstrated that access remained live. DJI eventually confirmed the issue and deployed fixes in early February 2026.

Three elements of this incident deserve particular attention:

  1. The technical capability required was minimal. This was a curious hobbyist with an AI coding assistant, not a professional threat actor.
  2. The vulnerability exploited was elementary: a failure to enforce device-level authorisation on a cloud backend.
  3. The devices involved are not enterprise infrastructure. These are consumer products that employees bring into homes where they also access corporate VPNs, handle sensitive files, and participate in confidential video calls.

The boundary between consumer IoT risk and enterprise security risk is not a boundary at all.

Legislative action is only now starting to catch up, with new bans on the manufacture or supply of IoT devices with factory-default login settings in effect from March, 2026 in Australia. This follows similar legislation enacted in the UK in 2023.

 How AI has changed the game on both sides 

Artificial intelligence is reshaping IoT security in two distinct and opposing directions. For defenders, it offers unprecedented capability to detect anomalous behaviour at scale and speed. For attackers, it provides powerful tools to automate and adapt exploitation at a pace that manual patching and monitoring cannot match.

It isn’t surprising that the threat actor community has moved quickly to weaponise AI. More concerning is the way AI tools are democratising the capability to find and exploit IoT vulnerabilities. The DJI incident demonstrates how AI coding tools have dramatically lowered the technical barrier to discovering and exploiting IoT vulnerabilities. The volume and diversity of people capable of probing IoT systems for weaknesses has expanded by orders of magnitude. 

Wired reports that ransomware groups increasingly have AI integrated into their malware development pipeline. Previously, attackers had to manually craft exploits for specific firmware versions or device types. AI-driven scanning tools can now fingerprint every device on a network range, identify its firmware version, and automatically select an optimised attack vector.

We are in an arms war. Adversarial machine learning attacks against AI-powered security systems are an active area of attacker research. When your IoT security camera uses AI to detect intrusions, an adversary can manipulate the input data to cause the AI to misidentify or overlook threats. 

The same capabilities that make AI dangerous in attackers' hands make it powerful in defenders' hands. Traditional security information and event management systems were not designed for IoT environments, where thousands of devices generate millions of data points continuously. AI-powered anomaly detection can establish baseline behavioural profiles for every connected device and flag deviations that would be invisible to human analysts.

AI-driven device discovery is also transforming asset visibility. Machine learning models can analyse network traffic and communication behaviour to identify and classify devices that have never been registered in any inventory. This addresses the shadow IoT problem at the network level rather than through policy and governance alone. In large environments, AI can infer device type, function, and risk posture based on how it communicates, without requiring manual documentation.

Perhaps most importantly, AI helps address the alert fatigue problem. IoT environments generate enormous volumes of security signals, most of which are low-risk or redundant. AI systems can correlate signals across devices, filter noise, and surface only the events that require human attention. This can help to prioritise threats by actual exploitability and business impact rather than alert volume. 

 Next steps for organisations 

IoT security is a governance problem as much as a technology problem. To address IoT cyber security risks effectively, organisations should adopt a strategic, lifecycle-based approach. Organisations that have made meaningful progress on IoT security share several characteristics: they know what they have, they apply consistent policy to it, and they treat it as a first-class element of their cyber security programme rather than an infrastructure footnote.

Recommended next steps include:

  1. Conduct an IoT risk assessment: Identify all IoT assets, data flows, and threat vectors / Evaluate the business impact of potential compromises.
  2. Develop an IoT security policy: Formalise policies for procurement, configuration, use, maintenance, monitoring, and decommissioning of IoT devices.
  3. Establish governance and accountability: Assign ownership for IoT security at both technical and executive levels.
  4. Implement security by procurement: Require vendors to meet security standards and provide transparency around update and support policies.
  5. Train employees and stakeholders: Promote awareness about secure use, device handling, and incident reporting.
  6. Participate in threat intelligence sharing: Engage with information sharing and analysis centres (ISACs) and IoT-specific security communities.

 The window to get ahead of this threat is narrowing 

In recent years, attackers have increasingly targeted insecure and poorly managed IoT systems, resulting in data breaches, operational disruption, and financial losses. These threats can be mitigated through a combination of security-by-design principles, robust network controls, continuous monitoring, and organisational readiness.

Organisations must treat IoT as a core component of their cybersecurity strategy, not as a peripheral concern. By implementing strong governance, following established standards, and committing to ongoing risk assessment and mitigation, enterprises can harness the benefits of IoT while minimising the associated risks.

For more information about IoT security, please reach out to your local RSM adviser. 

 Frequently asked questions 

The internet of things refers to the vast network of physical objects embedded with sensors, software, and other technologies that enable them to connect and exchange data with other devices and systems over the internet. These “things” range from consumer products like smart thermostats and wearable fitness trackers to industrial equipment, medical devices, and critical infrastructure systems.

The IoT is transforming how we live, work, and interact with our environment, providing unprecedented convenience, efficiency, and data-driven insights. However, this rapid expansion introduces significant cybersecurity challenges. IoT devices often have limited computing resources, minimal built-in security, and operate in diverse and dynamic environments, making them attractive targets for malicious actors.

IoT devices often lack robust security measures due to limited processing power and their propensity to connect to insecure networks. Additionally, manufacturers may prioritise convenience over security, leaving vulnerabilities open to exploitation. This makes IoT security a critical concern as these devices proliferate in homes and businesses worldwide.

Botnet attacks

  • Example: variants of Mirai continue to infect vulnerable IoT devices and integrate them into botnets for DDoS (distributed denial of service) attacks.
  • Impacts: service disruption, reputational damage, and network congestion.

Firmware exploits and supply chain vulnerabilities

  • Example: attackers exploit outdated or insecure firmware and third-party components in smart devices.
  • Impacts: unauthorised access, data theft, and lateral movement across networks.

Unauthorised device access

  • Example: devices shipped with default credentials or no authentication mechanisms.
  • Impacts: attackers gain control of devices for surveillance, sabotage, or pivoting to other systems.

Man-in-the-middle (MitM) attacks

  • Example: insecure communication protocols (e.g., unencrypted MQTT) are intercepted or altered.
  • Impacts: data tampering, espionage, or command injection.

Ransomware and data exfiltration

  • Example: smart medical and industrial devices targeted to disrupt operations or extract sensitive data.
  • Impacts: operational downtime, extortion, harm to individuals if medical devices are disrupted and regulatory penalties.

Physical attacks and tampering

  • Example: devices deployed in unsecured environments (e.g., cameras, sensors in public places) are physically accessed or modified.
  • Impacts: loss of integrity, safety issues, or network entry points for broader attacks.

No sector is immune, but some carry disproportionate risk given the stakes involved if IoT systems are compromised.

  • Healthcare (IoMT): It is unfortunately common for connected medical devices to run on outdated operating systems. With the majority of data breaches in Australia occurring in the Health sector, and the nature of the data revealed, managing this risk to patient privacy should be a top concern.
  • Critical infrastructure (energy, water, utilities): State-sponsored actors including Volt Typhoon have demonstrated the intent and capability to pre-position inside western infrastructure networks for months before being detected. In September 2025, the FBI confirmed Volt Typhoon hackers had maintained access to a Massachusetts utility's systems for ten months.
  • Manufacturing: Ransomware attacks on OT environments increased significantly from 2020 to 2025. Manufacturing and transportation are consistently among the top targeted sectors. Physical production disruption can translate directly to product shortages, supply chain failures, and existential business risk.
  • Retail: Compromised point-of-sale systems, smart inventory trackers, and logistics sensors create multiple vectors for data theft and supply chain disruption.
  • Building systems: Smart building infrastructure such as HVAC, access control, lighting and elevators are increasingly targeted as an entry point into corporate networks. These systems are often managed by facilities teams with no security expertise and connected to networks with insufficient isolation.

Securing IoT requires a layered defence-in-depth approach. Key control measures include:

Secure device design and hardening

  • Principle of least privilege: restrict access to only necessary functions.
  • Security-by-design: include encryption, secure boot, and tamper resistance during development.

Network segmentation

  • Use of VLANs or firewalls: Isolate IoT devices from core enterprise systems.
  • Zero trust architecture (ZTA): treat all devices as potentially untrusted.

Identity and access management (IAM)

  • Device authentication: implement mutual authentication and certificate-based identity.
  • Credential management: enforce strong password policies, disable default logins, and rotate credentials.

Firmware and software update mechanisms

  • Secure OTA (over-the-air) updates: sign and encrypt updates to prevent tampering.
  • Patch management: Regularly update firmware to address known vulnerabilities. 

Monitoring and threat detection

  • Anomaly detection: Use machine learning or behavioural analytics to detect deviations in device activity.
  • SIEM/soar integration: Incorporate IoT telemetry into broader security operations platforms.

Regulatory compliance and standards adherence

HAVE ANOTHER QUESTION?

  Get in touch 

Related insights