Internet of Things (IoT) Explained: Architecture, Protocols, and Security Risks

The Internet of Things (IoT) is the network of everyday physical objects – sensors, appliances, vehicles, machines – that carry embedded sensors and wireless connectivity so they can send and receive data over the internet with little or no human input. IoT Analytics counted 21.1 billion connected IoT devices worldwide by the end of 2025, growing about 14% a year toward roughly 39 billion by 2030. This guide defines IoT, shows how a device works end to end, and covers its applications, protocols, and main security risks.

What Is the Internet of Things?

The Internet of Things is a system where physical objects connect to IP networks and exchange data without manual input:

• What counts as IoT: a device needs a unique identifier (IP address or device ID), at least one sensor or actuator, and network connectivity.
• The range: from a $5 temperature sensor on LoRaWAN to a $50,000 CNC machine streaming vibration data for predictive maintenance.
• Origin: the term was coined by Kevin Ashton in 1999 at MIT’s Auto-ID Center, in the context of RFID supply-chain tracking.

Best for understanding: if an everyday object can sense something and report it over a network, it is IoT.

How Does an IoT Device Work, End to End?

An IoT device works by sensing the physical world, sending that data over a network to edge or cloud compute, then acting on the result – a four-stage loop:

• Sense. A sensor or actuator (temperature, motion, vibration, GPS) captures a reading from the physical environment as analog or digital data.
• Connect. The device sends data over a radio (Wi-Fi, Bluetooth, Zigbee, LoRaWAN, or cellular NB-IoT), often through a gateway that translates mixed protocols into one format.
• Process. Compute happens at the edge (a local gateway like a Raspberry Pi or NVIDIA Jetson) for low latency, or in the cloud (AWS IoT Core, Azure IoT Hub) for storage, analytics, and machine learning.
• Act. The result drives an action – a dashboard alert, an automated control (turn on HVAC, open a valve), or a command sent back to the device.

IoT Architecture: 4 Layers

IoT systems are organized into 4 functional layers, each handling one stage of data flow from physical sensing to the end-user app:

IoT Communication Protocols

IoT splits into connectivity radios that carry the data and messaging protocols that format it. Two messaging protocols dominate because they are efficient on tiny devices:

• MQTT (Message Queuing Telemetry Transport): a publish-subscribe protocol for low-bandwidth or unreliable networks. Minimum header is just 2 bytes; runs over TCP port 1883 (plain) or 8883 (TLS). Used in Amazon Alexa and industrial sensor networks.
• CoAP (Constrained Application Protocol): a RESTful protocol over UDP port 5683 with a 4-byte header, for devices too small to run HTTP – 8-bit microcontrollers with under 10 KB of RAM. Defined in RFC 7252.
• Radios: Wi-Fi for high-bandwidth devices, Bluetooth/BLE for wearables, Zigbee and Thread for low-power mesh, and Matter as an interoperability layer that runs over Wi-Fi, Ethernet, or Thread to unify smart-home ecosystems. See how computers work for the networking basics underneath.

Consumer IoT Applications

Consumer IoT covers connected devices in the home and on the body. Three categories show the range of sensor, connectivity, and processing needs:

Best for: convenience and automation at home – low cost, easy setup, but the weakest security posture of any IoT class.

Industrial IoT (IIoT) Applications

Industrial IoT applies connected sensors and analytics to manufacturing, logistics, and infrastructure. Two use cases dominate current deployments:

• Predictive maintenance: MEMS vibration sensors (10-40 kHz), temperature, and oil-quality sensors on motors and pumps stream to ML models that detect bearing wear early. GE’s Predix reported a 25% drop in unplanned downtime; unplanned industrial downtime costs an estimated $50 billion a year across Fortune 500 manufacturers (Aberdeen, 2019).
• Supply-chain tracking: RFID tags (UHF Gen2) and GPS asset trackers monitor location, cold-chain temperature (2-8C for pharma), and shock from factory to customer. Walmart’s 2022 RFID mandate targets 98%+ inventory accuracy vs a ~63% industry average without it.
• Scale signal: BMW’s private 5G factory network links thousands of sensors to edge controllers that optimize throughput in real time.

Best for: uptime-critical operations – higher cost and longer device life, with certificate-based security built in.

3 Major IoT Security Risks

IoT security failures are well documented at scale, and three attack vectors cause most compromises:

• Default credentials: the Mirai botnet (Sept 2016) took over 600,000 routers, cameras, and DVRs using just 62 factory username-password pairs. Its Oct 21 2016 DDoS on Dyn DNS peaked at 1.2 Tbps and knocked Twitter, Reddit, GitHub, and Spotify offline.
• Unpatched firmware: Palo Alto Networks (2020) found 57% of IoT devices vulnerable to medium- or high-severity attacks and 98% of IoT traffic unencrypted. Devices with no update path stay exploitable indefinitely.
• Lack of encryption: plaintext MQTT, Zigbee without AES-128, and older Z-Wave permit traffic interception. A 2019 NIST study found only 17% of tested consumer IoT devices enforced TLS to the cloud.

Consumer IoT vs. Industrial IoT Comparison

Consumer and Industrial IoT share the same architecture but differ sharply in reliability, security, and latency needs:

For the hardware powering the processing layer – edge gateways, CPUs, and storage – see the computer hardware guide and what a CPU is.

Last Thoughts on the Internet of Things

The Internet of Things is everyday objects made to sense and report over a network, and its 21.1 billion connected devices in 2025 all run the same four-stage loop – sense, connect, process, act – across four architecture layers. The network and processing layers decide latency, cost, and security; MQTT and CoAP handle messaging for the smallest devices. The split between cheap, lightly secured consumer gear and uptime-critical industrial systems is the line that matters most in practice.

Security stays the defining challenge: with most traffic unencrypted and a majority of devices unpatched, the Mirai botnet showed how default credentials at scale become attack infrastructure. Treat every connected device as something that must be identified, updated, and isolated – the same discipline industrial deployments already apply through certificates, VPNs, and segmented networks.

Key Takeaways:

• The Internet of Things is everyday physical objects with sensors and connectivity that exchange data over the internet; a device qualifies when it has a unique ID, a sensor or actuator, and a network connection.
• There were 21.1 billion connected IoT devices by the end of 2025 (IoT Analytics), growing ~14% a year toward ~39 billion by 2030; about 60% are consumer devices.
• Every IoT device runs a four-stage loop – sense, connect, process, act – across four architecture layers: perception, network, processing, and application.
• MQTT (2-byte header, pub-sub) and CoAP (4-byte header over UDP) handle messaging for constrained devices; Wi-Fi, Bluetooth, Zigbee, Thread, and Matter carry the data.
• The Mirai botnet (2016) hijacked 600,000 devices with 62 default credential pairs to launch a 1.2 Tbps DDoS – default passwords, unpatched firmware, and no encryption are the top three risks.
• Industrial IoT needs >99.9% uptime and 10-20 year device life with certificate-based security, versus 2-5 year, lightly secured consumer IoT.

Frequently Asked Questions (FAQs)