Even to this day, many Internet of Things (IoT) devices remain notoriously insecure. Often lacking the most basic of security measures, these devices are often vulnerable due to default passwords, a lack of encryption and outdated software that remains unpatched.

The rise of Artificial Intelligence (AI) is further compounding this issue. Cybercriminals are increasingly using AI for rapid, large-scale automated reconnaissance, making attacks faster, more adaptive and harder to detect. Consequently, IoT devices now face approximately 820,000 daily attacks, with most of these now deriving from weak authentication, critical vulnerabilities, and these AI-powered attacks.

How are hackers using AI to attack IoT devices?

Through the use of AI, attackers can now automate the discoverability of zero-day vulnerabilities within systems, creating targeted attacks and scanning for network breaches at an unprecedented scale. At the same time, machine learning can now replicate normal network traffic, allowing attackers to bypass even the most powerful AI-protected security systems and evade detection as they move through systems.

Adversarial AI gives attackers the means to craft inputs that hoodwink IoT-based machine learning systems, causing the sensors found in IoT applications like autonomous vehicles or smart cameras to misinterpret the data it receives. False data can also be implemented into an AI model’s training data, resulting in the degradation of system performance, or the creation of backdoors that empower hackers to control connected devices.

Considering there are over 21.1 billion connected devices in use across the globe, you can see why these attacks are a cause for concern; all it takes is one of these to become compromised to create serious security issues. Yet if attackers can collate compromised devices together for attacks, the threat surfaces increases too, and is why the threat of AI-enhanced, autonomous and decentralized botnets and Distributed Denial-of-Service (DDoS) attacks are also giving security professionals nightmares.

The threat of botnets

Attackers are rapidly weaponizing common IoT devices such as cameras, routers and even appliances like smart fridges and washing machines in order to assemble them into botnets and launch powerful DDoS attacks. In March 2026, four major botnets (Aisuru, KimWolf, JackSkid and Mossad) were able to infect more than 3 million devices worldwide and carried out key attacks against servers across the world, including IP addresses assigned to the Department of Defense’s information network.

The results of these botnet attacks can range from minor operational disruptions to major financial and reputational losses for both organizations and individuals. DDoS incidents more than doubled in 2025 to over 47 million – with peak traffic reaching up to 31.4 Tbps – leaving a trail of service outages, data and identify thefts, financial fraud and system instability in their wake.

While global law enforcement institutions have seen some success in dismantling large-scale attacks, for smaller businesses that don’t have significant cybersecurity budgets, these attacks can be devastating.

How does TCG secure IoT devices?

With IoT expanding across billions of devices, securing this ecosystem becomes both increasingly difficult and absolutely essential. Within the Trusted Computing Group (TCG), the IoT Sub Group is focusing on accelerating strong, practical security by showing how the cornerstones of trusted computing can be applied to best protect IoT deployments and by evolving TCG standards to better fit the unique demands of these environments.

As mentioned, IoT systems now extend far beyond the sole devices themselves, encompassing networks, services, and storage – meaning most TCG technologies have a role to play. Yet IoT also introduces distinct constraints: some devices must operate at extremely low power or cost, while many must remain remotely manageable and secure for years or even decades. Trusted Computing offers foundational capabilities such as secure key storage and remote attestation to support long‑term device management.

Which TCG solutions can protect my IoT devices?

At a basic level, for example, the Trusted Platform Module (TPM) is a hardware Root-of-Trust which offers secure key storage, cryptographic operations, and remote attestation. For IoT devices too small for a TPM, the Device Identifier Composition Engine (DICE) also helps establish a cryptographically strong device identity. It can also be used in conjunction with a TPM for more complex IoT security architectures. CyRes also provides IoT devices with greater resiliency, recovery, security updates and effective post-compromise behaviours too.

TCG’s portfolio of technologies – from TPM to DICE to CyRes and beyond – collectively demonstrates our sustained, long‑term commitment to securing devices across the full spectrum of IoT complexity. Through our members and Work Groups, we are building a coherent, interoperable and trusted security foundation that spans identity, attestation, lifecycle management, and recovery. Through these, we are ensuring that every class of device, from the smallest sensor to the most capable edge node, can participate in a secure and resilient IoT ecosystem.