Internet of Things (IoT) Security: The Threat Before Us
The Internet of Things (Iot) offers many footholds for attackers to infiltrate organizations through smart devices. but self-learning AI is here to help.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Marcus Fowler
CEO of Darktrace Federal
Share
29
Sep 2021
Attackers are increasingly gaining footholds into corporate environments to conduct ransomware or data theft operations via Internet-connected smart devices. Whether they be printers, lockers, aquariums, or conference rooms, these seemingly innocuous access points to corporate environments can provide attackers the critical initial access to conduct their attacks. These can also often be blind spots for many security teams.
When dropped into an organization’s digital environment for the first time and learning its surroundings, Darktrace often finds 15–20% more devices than anticipated. Most of these unexpected devices and areas of unsecured vulnerability result from an influx in IoT-enabled tech. This growing dependence on IoT devices will only continue to accelerate. There are currently more than 10 billion active IoT devices. This number is estimated to surpass 25.4 billion in 2030, though, by Darktrace’s predictions, it will in fact be much higher. We assess that almost all estimates around IoT usage by 2025 are too low.
As a result of the COVID-19 pandemic and hybrid work, the future workplace environment will only become more hands-free and interconnected. Broad adoption of 5G will not only mean more IoT devices, but also expanded capabilities as they become more efficient and highly connected.
People can walk in with an Internet-connected device on their wrist, or a security problem can enter a company through a newly updated Internet-connected vending machine. IT teams do not always know these devices are “smart” or vet them like they would with standard company technology.
IoT device manufacturers do not have a record of prioritizing the security of their devices, often sacrificing it for access and convenience, placing the burden on company security teams after the fact. Starting with one of these IoT devices that are typically not reinforced with security protocols makes it easier for a hacker to move laterally. Much like the threat from supply chains, it is easier for a hacker to go through an open window than a locked, guarded front door.
IoT compromise frequently appears as a lead threat across Darktrace’s global SOC operations. We have seen IoT devices intentionally brought into a corporate environment and used by an insider because of their small size, low signature, and capabilities, making them a powerful tool to evade traditional security defenses focused on external and known threats. Darktrace has even discovered crypto-mining malware on a door sensor, showcasing how creative attackers can get and all the different ways unsecured IoT can be misused.
IoT security is critical to prevent hackers from moving laterally throughout a company network. If hackers can breach one device within an organization’s digital environment, they can move to more critical devices with more sensitive data.
The good news is that security teams aren’t without resources to defend their environments. The first thing corporations need to have is a policy around IoT usage and adoption. The next and often most challenging step is increasing visibility and understanding of these shadow devices the instant they connect to the network in the first place. To meet this mission, some security teams use AI to identify the device and map ‘normal’ behaviors, then enforce a device’s behavior to disrupt any attacker’s efforts to use that device as an attack platform. Leveraging AI in this way also reduces the workload on already taxed security teams.
From a broader policy perspective, in tandem with internal security efforts, more pressure needs to be put on IoT manufacturers to make security a priority and part of the entire development and upgrade process. Disrupting attacks and hardening environments from attacker access points and attack vectors is everyone’s responsibility.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
AIは今や攻撃サイクルの複数のポイントに存在しています。Daybreakは脆弱性の発見と修正にモデルを適用しています。Darktrace Signal Labsは信頼される企業内AIエージェントがどのように悪用されうるかを、管理された環境内で実証しました。JPCERT/CCは最近のインシデントにおけるAI支援による脆弱性探索およびAPI攻撃を確認しました。Microsoft社は実際の攻撃でStorm-0940がARTEXを使用していることを報告しました [4][7][8][9]。
[3] Cyber Security Agency of Singapore, https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/
[4] OpenAI, Daybreak: Tools for securing every organization in the world, 22 June 2026. https://openai.com/index/daybreak-securing-the-world/
[5] OpenAI Developers, Scaling cyber defenders with Daybreak, 21 August 2026. https://developers.openai.com/blog/scaling-cyber-defenders-with-daybreak
[6] OpenAI, Cloudflare links vulnerability discovery to defense with OpenAI, 21 October 2026. https://openai.com/index/cloudflare-cyber/
[7] Darktrace Signal Labs, Shared Memories as a Covert C2 Channel, draft research supplied for review.
[8] JPCERT/CC, Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques, 21 October 2026. https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
[9] Microsoft Security Research and Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, 21 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
[10] Darktrace, Advancing the Use of Frontier AI in Cybersecurity: Darktrace Joins the OpenAI Daybreak Cyber Partner Program to Explore Defensive AI Integrations, 22 June 2026. https://www.darktrace.com/blog/advancing-the-use-of-frontier-ai-in-cybersecurity-darktrace-joins-the-openai-daybreak-cyber-partner-program-to-explore-defensive-ai-integrations
