Why updates sit at the center
Software almost always contains mistakes, and some are security flaws. Makers and researchers find them over time, and a fix is released as an update. For a connected device, that update is usually called firmware, the low-level software that runs the hardware. A device that is not updated keeps every flaw that has been published since it was made, and published flaws are exactly the ones attackers build tools around.
That is why this checklist begins with patching. Many of the other threats, such as botnets, credential theft and data exposure, become much easier when a device is running old software.
Checklist: threats to watch for
1. Devices that never update themselves
Some devices install updates automatically, some ask you to do it and some have no update mechanism at all. Check which you have. A device that needs manual action is easy to forget. Where updates are delivered wirelessly, the process is described under over-the-air updates, and it works well only if it is switched on and the maker keeps releasing fixes.
What to do: Turn on automatic updates in the app or settings. For manual devices, set a reminder every few months to check.
2. Unknown or unstated support lifetimes
Makers differ widely in how long they provide security fixes. Some state a period, many do not, and the gap between the end of support and the end of the hardware’s usefulness can be long. This is a major reason devices turn into risks over time, and it connects to the broader question of device lifespan and the right to repair.
What to do: Before buying, look for a stated update period on the product page or support site. A maker that does not say anything is giving you less certainty. Prefer products with a clear commitment.
3. End-of-support devices still in use
When a device stops getting updates, it does not stop working. It continues quietly, accumulating known flaws.
What to do: Make a plan, as described below.
4. Factory logins left in place
Updates do not help if anyone can log in with the original credentials. Changing default passwords belongs on every checklist alongside patching.
5. Exposed remote access
A device reachable from the internet is a target for scanners, and an outdated one is likely to be caught. Disable remote access features that you do not need and avoid forwarding ports from the router.
6. A neglected router
The router sits in front of all other devices and needs the same updates. Many routers update themselves, while others need a manual check. Replace one that no longer receives fixes.
7. Forgotten and duplicate devices
Old trial devices, spare cameras and unused smart plugs often remain connected and unpatched. Keep a list and remove what you do not use.
8. Companion apps and accounts
The phone app and the online account are part of the system. Keep the phone updated, install apps only from official stores, and use a unique password with multi-factor sign-in on the account.
9. Unusual behavior
Unexpected restarts, slow responses, changed settings or odd network traffic may signal trouble or a plain fault. Investigate rather than ignore.
10. Poor update security
Updates should be checked for authenticity before they are installed. Owners cannot easily verify that, but a maker with a published security contact and a history of clear notices is generally a better sign than silence.
What to do when a device stops getting updates
This is a decision, not a panic. The options below are roughly ordered from least to most effort.
- Confirm it is really end of support. Check the maker’s support page or announcements. Sometimes a newer version of the software exists but needs a manual step.
- Reduce exposure. Turn off remote access and cloud features you do not need. Remove port forwarding. Keep the device off the internet if it can work locally.
- Isolate it. Place it on a separate guest or gadget network so that a compromise reaches little else. This is the idea behind network segmentation.
- Check the risk it poses. A cheap sensor that reports temperature is a different case from a camera, lock or anything with a microphone. The more sensitive the function, the stronger the reason to replace it.
- Replace it. When a device guards your door, watches your home or controls something important, replacing it with a supported product is usually the sound choice.
- Retire it properly. Factory-reset it, remove it from your account and recycle it responsibly through an electronics collection program. Do not give away a device that still holds your credentials.
Some users run alternative community-maintained software on older hardware. That can extend life, but it requires technical skill and carries its own risk if done wrong, so it is not a casual fix.
For small businesses and larger deployments
Track every device, its software version and its support end date. Plan replacement as part of the budget instead of waiting for a failure. Where equipment cannot be updated easily, such as in industrial settings, compensating measures like network separation and monitoring become the main defense. Those environments, with their different priorities, are discussed under industrial IoT.
Keeping it manageable
You do not need to monitor every news item about every flaw. A routine is enough: automatic updates on, a list of devices, a check twice a year on what is still supported, and a willingness to replace what is not. Outcomes can never be guaranteed, but staying current closes a large share of the openings attackers rely on.