Sources were identified through IEEE Xplore, ScienceDirect, MDPI, arXiv and Google Scholar, using combinations of the terms “IoT security”, “IIoT security”, “IoT DDoS”, “lightweight cryptography IoT”, “blockchain IoT consensus”, “Zero Trust IoT”, and “IoT vulnerability 2024/2025”. Grey literature (CISA/ICS advisories, vendor security bulletins, and named threat-intelligence reporting from Barracuda, Cloudflare, Claroty and Modat) was included specifically for case-study verification, since peer-reviewed sources lag real-world incident disclosure by 12-24 months.

Foundational and architectural sources (layered IoT models, Mirai analysis, core standards) were drawn from 2013-2020. Threat, mitigation and technology sources were prioritised from 2023-2026 to reflect the current threat landscape, per Reviewer 1’s request for currency.

Case studies were included only where a named, dated, and independently reported incident or disclosure existed (e.g. a CVE identifier, CISA advisory, or named threat-intelligence report), rather than generic or anonymised claims. Technology sources (cryptographic primitives, consensus protocols) were selected on the basis of standardisation status (e.g. NIST) or peer-reviewed comparative benchmarking, in preference to vendor marketing material.

As a narrative rather than systematic review, source selection is not exhaustive and is not free of author judgement; no formal inter-rater screening was conducted. This is disclosed here rather than obscured, consistent with the paper’s aim of methodological transparency.

A major and persistent threat is the Distributed Denial-of-Service (DDoS) attack, in which compromised IoT devices are conscripted to flood a target with traffic. The Mirai botnet, first identified in 2016, showed how everyday devices such as cameras and routers could be hijacked at scale. Mirai scanned the internet for devices running default or weak credentials, installed a lightweight bot agent, and reported compromised devices to command-and-control servers coordinating large DDoS attacks [7]. The attack succeeded because many devices shipped with default credentials and exposed management interfaces. Three practical lessons follow: manufacturers should ship unique per-device credentials rather than defaults; management interfaces should be closed by default and protected through gateway firewalling and segmentation; and secure update mechanisms should allow compromised firmware to be detected and isolated (see Figure 1).

Mirai’s source code, leaked in 2016, seeded a lineage of variants that remains active a decade later. Reported deployments have included use against government and corporate websites during the 2022 Russia-Ukraine conflict [8], and, more recently, the Aisuru botnet, active since 2024, which has driven some of the largest recorded volumetric DDoS campaigns to date, chiefly against internet service providers and online gaming platforms, exploiting the same underlying weaknesses as the original Mirai: default credentials, unpatched firmware, and exposed management protocols such as Telnet and SSH [9]. A related botnet, Kimwolf, active since 2025, has additionally propagated through unauthorised or cloned Android TV streaming devices shipped with insecure remote-access components, illustrating that the underlying supply-chain weakness, not any single device category, is the durable problem [9]. This persistence, nearly a decade after Mirai’s disclosure, is itself evidence that credential and firmware hygiene recommendations have not been adequately enforced across the consumer device supply chain.

Beyond consumer devices, a growing concern involves Industrial IoT (IIoT) and Cyber-Physical Systems (CPS), such as those used in energy grids or manufacturing, where attacks can cause physical harm rather than only data loss. Logic attacks targeting the perception layer, for example by manipulating sensor readings, can deceive control systems into unsafe states. Ransomware can similarly lock down operational technology, halting power, water or transport services until a ransom is paid; these incidents are serious because they threaten safety and continuity simultaneously [10].

Two specific, verifiable 2024 disclosures illustrate this risk. First, CISA and Mitsubishi Electric disclosed CVE-2023-2060 (CVSS 8.7), an authentication-bypass class vulnerability affecting the MELSEC iQ-R and iQ-F series controllers used in critical manufacturing, alongside a further set of denial-of-service vulnerabilities in the same product families [11,12]. Second, an advisory update in January 2024 confirmed CVE-2022-45794 in OMRON’s CS/CJ-series programmable logic controllers: a missing-authentication flaw permitting unauthenticated access to onboard file storage, from which an attacker could retrieve sensitive configuration data [13] (CISA ICSA-23-108-01). We deliberately state these vulnerabilities precisely rather than generically, correcting an earlier draft of this paper, which described the OMRON flaw in broader terms than the disclosed CVE supports; accuracy here matters because overstating technical impact undermines the credibility of the security case being made.

Linking these breaches to Security-by-Design. Both disclosures map directly onto specific Security-by-Design principles rather than IoT security in the abstract. The Mitsubishi authentication-bypass and DoS flaws correspond to the principle of fail-secure default configuration and mandatory authentication on all management interfaces: had authentication been enforced by design rather than left optional or absent, exploitation would have required credential compromise rather than direct access. The OMRON file-system flaw corresponds to the principle of least-privilege access to onboard storage: file-system access should not be reachable without authentication regardless of network position. Table 1 and Figure 3 summarise this mapping.

Healthcare, or the Internet of Medical Things (IoMT), is among the most consequential domains because compromise threatens patient safety as well as data confidentiality. A 2025 investigation by security firm Modat found more than one million internet-exposed healthcare IoT devices and connected medical systems worldwide, including MRI and X-ray systems, frequently secured only by unchanged manufacturer default passwords such as “admin” or “demo” [14]. Independent analysis by Claroty of over 2.25 million IoMT and operational technology devices found critical vulnerabilities present in 99% of healthcare networks surveyed [15]. The risk is not confined to data theft: a hacker able to modify medical records, or alter a smart infusion pump’s dosage settings, could cause direct physical harm.

Current industry analysis [16] puts the global installed base at approximately 21.1 billion connected IoT devices in 2025, growing at roughly 14% year-on-year, with a projection of around 39 billion by 2030.

Security must be layered across the device, network and cloud tiers [29]. At the device level, secure-by-design principles mean storing sensitive material securely, disabling unnecessary features, and supporting regular, authenticated over-the-air (OTA) firmware updates. At the network level, segmentation, keeping IoT devices on a separate network from computers and phones, limits lateral movement if a device is compromised, and Transport Layer Security (TLS) protects data in transit. At the cloud level, APIs must be hardened against exploitation, data must be encrypted at rest, and multi-factor authentication should be used wherever feasible.

The most consequential recent development is NIST’s standardisation of the Ascon family as its lightweight cryptography standard, finalised in August 2025 as NIST SP 800-232, following Ascon’s selection as the winning algorithm of the NIST Lightweight Cryptography competition in 2023. Ascon provides authenticated encryption and hashing designed explicitly for constrained hardware such as RFID tags, medical implants and low-power sensor nodes [30]. Its principal advantage over general-purpose AES-GCM is a smaller implementation footprint and lower energy-per-bit cost on 8- and 16-bit microcontrollers, at the cost of lower throughput on devices that do have hardware AES acceleration; the trade-off therefore favours Ascon specifically where energy and silicon area, not raw speed, are the binding constraint.

Older but still widely deployed lightweight block ciphers include PRESENT (an ISO/IEC 29192-2 standard, optimised for compact hardware implementation) and the NSA-designed SIMON and SPECK families, which trade cryptographic conservatism for very low gate counts and are tunable across a range of block and key sizes to fit specific memory budgets [31]. Elliptic Curve Cryptography (ECC) variants using shorter curves (e.g. Curve25519) remain the preferred approach for asymmetric operations such as key exchange and device authentication on constrained hardware, since they achieve equivalent security to RSA at substantially smaller key sizes, reducing both computation and bandwidth.

Table 2 summarises the trade-offs relevant to IoT deployment decisions.

This is a critical rather than promotional comparison: no single algorithm is universally correct, and the choice depends on whether the constraint is energy, code size, or the need for standards compliance in regulated sectors such as healthcare.

Zero Trust operates on the principle of never trust, always verify: every device must be authenticated and authorised before gaining access to resources, regardless of its network position (NIST SP 800-207 provides the general architecture). Applied to the network layer, this is relatively well understood: it means segmenting traffic and requiring continuous verification between gateways and cloud services. Applied specifically to the perception layer, however, ZTA requires additional, more granular controls, because perception-layer devices (sensors, actuators, embedded controllers) cannot generally run full identity-management stacks:

Rather than segmenting only at the network layer (e.g. a separate IoT VLAN), perception-layer micro-segmentation isolates individual sensor clusters or actuator groups from one another, so that a single compromised sensor, for example a tampered temperature sensor in an industrial control loop, cannot communicate laterally with other sensors or actuators in the same physical process, only with its designated aggregation point.

Perception-layer devices often cannot perform expensive continuous authentication therefore ZTA at this layer typically relies on lightweight, hardware-anchored identity (e.g. a Trusted Platform Module or Physical Unclonable Function) verified at connection time and periodically re-attested, rather than per-transaction verification.

Because perception-layer compromise often manifests as false sensor data rather than an unauthorised device joining the network (as in the logic attacks discussed in Section 3.2), Zero Trust at this layer must include continuous plausibility/anomaly checking on the data itself, not only authentication of the device producing it.

This directly addresses the Mirai/Aisuru failure mode described in Section 3.1: had gateway-level micro-segmentation isolated individual device groups rather than treating the whole IoT VLAN as one trust zone, a compromised camera would have been contained rather than able to participate in a coordinated botnet. Figure 6 illustrates this containment mechanism.

AI and machine learning can process large volumes of real-time telemetry to identify anomalous behaviour faster than manual monitoring, and can adapt to new attack patterns over time [32]. Recent work specifically targeting IIoT and IoMT environments illustrates both the promise and the caveats. Alemayehu et al. [33] systematically analyse AI-based detection, mitigation and prevention of DDoS attacks in IIoT, and are explicit that computational overhead, limited model interpretability, and scarcity of representative industrial datasets remain significant barriers to deployment in real critical-infrastructure settings, not merely theoretical concerns. Similarly, hybrid detection architectures such as the SE-ViT-BiLSTM intrusion detection model proposed by Gueriani et al. [34], which reports accuracies above 99% on IIoT and IoMT benchmark datasets, and hybrid RBFN-SVM approaches for DDoS classification [35], which report comparably high precision and recall on the CICDDoS2019 and CICIDS2017 datasets, demonstrate strong benchmark performance. These results should, however, be read critically: benchmark datasets such as CICDDoS2019 and EdgeIIoT are curated and comparatively clean, and accuracy figures in this range do not by themselves establish resilience in production networks against previously unseen or adversarially crafted traffic, distribution shift between lab and field conditions, or the false-positive costs that matter operationally.

The limitations are structural rather than incidental. AI-based detection is only as reliable as its training data, which for industrial settings is often scarce, imbalanced or unrepresentative of the deployment environment [33]. Adversarial machine learning allows attackers to craft inputs that evade detection or poison training data over time. Real-time inference on constrained gateway hardware also introduces a genuine latency/accuracy trade-off that benchmark papers, evaluated on server-class hardware, do not always surface. For these reasons, AI-based detection should be treated as a component of a layered defence, not a replacement for the credential, segmentation and update hygiene discussed in Sections 3-5; a well-tuned anomaly detector cannot compensate for a device shipped with a default password.

Blockchain’s appeal for IoT rests on tamper-evident, decentralised record-keeping, which is genuinely useful for supply-chain provenance and device-identity attestation, but the technology is frequently proposed for tasks it is poorly suited to, notably real-time processing of high-volume raw sensor data, where its latency and computational cost are prohibitive [2].

The consensus mechanism is the determining factor in whether blockchain is feasible for a given IoT deployment, yet general treatments of “blockchain for IoT” often omit this distinction. Classic Proof-of-Work is computationally unsuitable for constrained devices. Lighter-weight alternatives are more relevant in practice: Proof of Authority (PoA) and Delegated Proof of Stake (DPoS) substantially reduce computational overhead by limiting the validator set, at the cost of greater centralisation and trust concentration in the chosen validators; Practical Byzantine Fault Tolerance (PBFT) and related variants offer fast finality suited to permissioned industrial consortia, but scale poorly as the validator count grows, which constrains its use to smaller, permissioned IIoT deployments rather than open consumer IoT networks (see the comparative treatment in recent lightweight-consensus literature, e.g. the ACM 2024 review of lightweight consensus algorithms for IoT).

A concrete illustration of feasible blockchain use is the smart-contract-based decentralised scheme proposed by Mohanta et al. [36] for IoT-enabled smart-grid security, which reports a computational cost of 3.150 ms and communication overhead of 992 bits per transaction, together with smart-contract deployment costs of USD 5.64, figures that are small enough to be credible for smart-grid telemetry but would still be prohibitive if applied to every raw sensor reading across a large sensor network, reinforcing the point that blockchain’s IoT role is best understood as narrow and workload-specific rather than general-purpose.

Table 3 summarises the consensus trade-off.

Both technologies are best understood as targeted mitigations for specific sub-problems, anomaly detection for AI, provenance and access-control attestation for blockchain, rather than general solutions to IoT insecurity. Treating either as a primary defence risks the same over-claiming this section has tried to avoid; the credential, segmentation, update and standards measures discussed earlier in this paper remain the necessary foundation regardless of which advanced technology sits on top of them.