The Sealed-Battery Problem
A cheap smoke alarm with a sealed ten-year battery is an honest product: the constraint is printed on the box. A connected sensor with a sealed battery, a five-year firmware commitment and a cloud backend the manufacturer can retire at will is not. The buyer cannot see the second expiry date, and the seller frequently has not decided it. That asymmetry — physical durability outlasting commercial commitment — is the central unresolved problem in consumer and industrial IoT, and it is the one the product-cycle coverage reliably omits. The question worth asking of any connected device is not what it measures. It is who pays for the firmware in year four.
[NEWS PEG 1 — NONE — REQUIRES VERIFICATION] Desk: insert today's primary development. Two sentences, factual, sourced.
[NEWS PEG 2 — NONE — REQUIRES VERIFICATION]
Mirai's Unfinished Lesson
The 2016 Mirai botnet did not exploit a sophisticated flaw. It authenticated to consumer cameras and routers using a short list of published default credentials, then leveraged the resulting fleet against DNS infrastructure. [VERIFY: Mirai timeline, vector and the Dyn incident against primary incident write-ups.] The industry read this as a password-hygiene failure. That reading was too narrow, and the decade since has demonstrated why: the credentials were never the defect. The defect was a manufacturing model with no funded mechanism for post-sale maintenance, of which hardcoded credentials were merely the most visible symptom.
The lesson regulators eventually absorbed is that the maintenance obligation must be attached at point of sale, because nothing downstream creates it. The UK's product security regime and the EU's Cyber Resilience Act are both attempts to legislate that attachment. [VERIFY: PSTI Act scope and commencement; CRA application dates and reporting obligations against the official texts.] Whether they succeed depends on enforcement against importers, not on the elegance of the requirements.
The Support Horizon Is the Product
Hardware margins on a connected sensor are thin and earned once. Firmware maintenance is a recurring cost incurred for as long as the device remains in the field, and it scales with the number of SKUs a vendor has shipped rather than with revenue. Every additional product variant multiplies the build, test and certification burden of each subsequent security release. This is why support windows in this category are so often short, vague or silently truncated: the cost curve is structural, not a failure of intent.
The consequence buyers should internalise is that a declared support period is a more reliable quality signal than any sensor specification. Defined support period disclosure is now a regulatory expectation in several jurisdictions, which makes it comparable across vendors for the first time. [QUOTE / STATISTIC SLOT 1 — NONE — REQUIRES VERIFICATION: source a published figure on median firmware support duration versus mean field lifespan, or an on-record statement from a manufacturer's product-security lead.]
[NEWS PEG 3 — NONE — REQUIRES VERIFICATION]
Counter-Argument: Baseline Mandates Are Not Theatre
The case against regulating this category deserves a fair hearing, and part of it is wrong. It is fashionable to treat device-security rules as paperwork that burdens compliant manufacturers while offshore sellers ignore them. But the specific interventions chosen — prohibiting universal default passwords, requiring a vulnerability contact, mandating a stated update window — are unusually well-targeted. They attack the exact failures Mirai exploited, they are cheap to implement at design time, and they are objectively testable by a market-surveillance authority without deep technical investigation.
Where the sceptical case retains force is on enforcement capacity and on the second-order effect: obligations priced per-SKU favour large platforms and accelerate the exit of small vendors, concentrating the ecosystem. The honest position is that these rules will raise the floor meaningfully and simultaneously reduce vendor diversity. Both outcomes should be stated to a procurement committee, not traded against each other rhetorically.
Biometric Inference and the Actuarial Feedback Loop
Wearables present a distinct version of the problem, because the asset that outlives the support window is not the device — it is the longitudinal record. Continuous heart-rate, sleep-stage, temperature and activity data supports inferences well beyond the condition the user consented to: pregnancy, medication adherence, depressive episodes, early neurodegenerative signal. The consent obtained at onboarding was for a feature. The inference available at year five is a risk profile.
The underexamined exposure is contractual rather than technical. When a wearable vendor is acquired, the record transfers with the estate, and the privacy policy the user accepted is frequently amendable on notice. Nothing about the device changes; the counterparty does. [QUOTE / STATISTIC SLOT 2 — NONE — REQUIRES VERIFICATION: source a peer-reviewed figure on inference accuracy for a non-disclosed condition from wearable telemetry, or on-record comment from a data-protection authority on health-adjacent classification.] Buyers should treat the acquisition scenario, not the breach scenario, as the base case.
Counter-Argument: Local Processing Is Not Sovereignty
The standard remedy proposed for that exposure is on-device inference: keep the signal local, export only conclusions, and the privacy problem recedes. This is a genuine improvement and it is not sufficient. A device that computes locally and syncs nightly has relocated the trust boundary, not removed it, and the sync path remains a disclosure surface governed by the same amendable policy. Nor does local processing address the inference problem, since the conclusion is often more sensitive than the raw series.
The defensible version of the argument is narrower and more useful: local processing reduces the volume of material available to a future acquirer and shrinks the breach blast radius. That is worth engineering for. It is a mitigation with a measurable scope, not a sovereignty guarantee, and vendors marketing it as the latter should be asked what specifically leaves the device.
Interoperability Moves the Trust Boundary
The consolidation around common application-layer standards has been read almost entirely as a consumer-convenience story. Its security consequence is more interesting. Standardised commissioning replaces a patchwork of bespoke pairing flows with one well-specified path, which is a clear gain. It also concentrates authority in the hub or border router that holds commissioning credentials, and it makes a single update pipeline a dependency for heterogeneous fleets.
The operational implication is that the hub, not the endpoint, is now the asset worth attacking and the asset worth auditing. Fleets that were once isolated by incompatibility now share a blast radius. [QUOTE / STATISTIC SLOT 3 — NONE — REQUIRES VERIFICATION: source a primary measurement on commissioning-credential handling or hub compromise in a standards-conformant stack.]
[NEWS PEG 4 — NONE — REQUIRES VERIFICATION]
[NEWS PEG 5 — NONE — REQUIRES VERIFICATION]
Procurement Is the Lever That Works Today
Buy the support window, not the sensor. Require a written end-of-support date in the purchase order and treat its absence as a disqualifier. Segment by consequence, not by convenience. Put connected devices on an isolated network segment with no lateral path to payment systems or records; this costs a configuration change and defeats most commodity abuse. Register the counterparty. Record which legal entity holds each device's data and set a review trigger on acquisition news. Prefer exportable formats. Insist on documented local export so a vendor's exit does not become your data loss. Audit the hub. Inventory commissioning credentials and confirm the update path is signed and revocable. For individuals, the highest-value actions are narrower: change default credentials, enable update notifications, and export your health history annually.
Two Quarters Out
Forecast — analytical projection, not reporting. Expect the competitive axis to shift from features to declared longevity, because regulation makes it comparable and procurement will start scoring it. Watch three signals: support-period length appearing as a advertised differentiator rather than fine print; market-surveillance actions against importers rather than domestic brands, which will indicate whether enforcement is real; and the first acquisition in which a wearable data estate is valued explicitly in the transaction, which will settle the consent-transfer question in practice before it is settled in law. The vendors that survive this will be the ones that priced the fourth year of firmware into the first year's margin.