Internet of Things
Last reviewed
May 4, 2026
Sources
20 citations
Review status
Source-backed
Revision
v1 · 4,468 words
Improve this article
Add missing citations, update stale details, or suggest a clearer explanation.
Suggest edit
CtrlK
Last reviewed
May 4, 2026
Sources
20 citations
Review status
Source-backed
Revision
v1 · 4,468 words
Add missing citations, update stale details, or suggest a clearer explanation.
The Internet of Things (IoT) is the network of physical objects ("things") embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the Internet. The term covers everything from a Wi-Fi-enabled lightbulb in a living room to a temperature sensor monitoring a turbine blade inside a jet engine, provided the device can be addressed on a network and contributes data or accepts commands from a remote system.
IoT extends digital intelligence into the physical world by combining low-cost microcontrollers, wireless communication, cloud back-ends, and increasingly, on-device machine learning. Annual shipments of cellular IoT modules, Wi-Fi chips, and Bluetooth radios now run into the billions, and the installed base of active connected devices has overtaken the number of personal computers, smartphones, and human beings combined. The category sits at the intersection of embedded systems engineering, networking, data engineering, and applied AI.
The AI relevance of IoT has grown sharply since the late 2010s. Sensor data from connected devices is the raw fuel for predictive maintenance models, anomaly detection, computer vision, and digital twins, while inference is increasingly pushed back down to the device through TinyML frameworks and edge accelerators. The phrase "AIoT" (Artificial Intelligence of Things) is now common shorthand for this convergence, and most major IoT platforms ship managed AI services alongside their device management features.
IoT is most usefully defined by three properties: each "thing" has a unique addressable identity on a network (typically an IP address or a network-layer identifier mapped to one), each thing collects or actuates data about the physical world, and each thing can be reached from outside its immediate physical environment. The classic Internet connects servers and end-user computers; IoT extends the same model to objects that previously had no networking at all.
IoT overlaps with several adjacent terms. Machine-to-machine (M2M) communication usually refers to direct point-to-point links between devices, often over cellular or serial lines, without an Internet back-end; M2M predates IoT by decades and survives inside it. Cyber-physical systems (CPS) is the academic term, popularized by the U.S. National Science Foundation around 2006, for tightly coupled computational and physical components and is broader than IoT because it does not require Internet connectivity. Ubiquitous computing or "ubicomp," coined by Mark Weiser at Xerox PARC in 1988, is the philosophical predecessor that envisioned computers fading into the background of everyday objects. The Industrial Internet, a term promoted by GE around 2012, is roughly synonymous with Industrial IoT.
IoT is sometimes confused with the Web of Things (WoT), a W3C effort to expose IoT devices through web standards (HTTP, JSON, semantic descriptions). The Web of Things is a layer on top of IoT, not a separate phenomenon.
The Internet of Things has a longer prehistory than the term itself. A networked Coca-Cola vending machine installed at the Carnegie Mellon University Computer Science Department in 1982 is widely credited as the first Internet-connected appliance. Graduate student David Nichols, with Mike Kazar, John Zsarnay, and Ivor Durham, instrumented the machine in Wean Hall so that anyone on ARPANET could query its contents using the finger protocol and learn whether bottles were stocked and cold before walking over. The hack was a private convenience but is now treated as the symbolic birth of consumer-style IoT.
In 1990, networking pioneer John Romkey connected a Sunbeam Deluxe Automatic Radiant Control toaster to the Internet, controlling power to the heating element via SNMP over a SLIP link. Demonstrated at the Interop trade show after a challenge from organizer Dan Lynch, Romkey's toaster is sometimes called the first true "thing" on the Internet because it acted on the physical world rather than merely reporting state.
The phrase "Internet of Things" itself was coined by British technologist Kevin Ashton in 1999. Working at the time as an assistant brand manager at Procter & Gamble on supply-chain visibility for cosmetics, Ashton used the title for a slide deck pitching radio-frequency identification (RFID) tags as a way to give every physical object a digital identity. Later that same year, Ashton helped found the Auto-ID Center at MIT with Sanjay Sarma, Sunny Siu, and David Brock; the center, an industry consortium, set out to standardize an open RFID infrastructure and produced the Electronic Product Code (EPC) that became GS1's EPCglobal standard.
Cisco's Internet Business Solutions Group (IBSG) later argued that the Internet of Things was "born" between 2008 and 2009, the period in which, by Cisco's reckoning, the count of devices connected to the Internet first exceeded the global human population. The 2010s then brought rapid commercialization driven by smartphones (which contributed a generation of cheap sensors, radios, and processors), low-cost cloud back-ends, and the maturation of low-power wide-area network (LPWAN) standards.
A cluster of significant corporate moves followed. In August 2013, Arm Holdings acquired Finnish IoT software company Sensinode, gaining the NanoStack and NanoService implementations of 6LoWPAN and CoAP that would later anchor Arm's Mbed IoT platform. On January 13, 2014, Google announced its acquisition of smart-thermostat maker Nest Labs for $3.2 billion in cash, then the largest hardware acquisition in the company's history and a signal that hyperscalers viewed smart home as strategic.
The mid-2010s through 2020 brought the rise of Industrial IoT, the Industry 4.0 movement out of Germany, and large-scale smart-city pilots in Barcelona, Singapore, Songdo, and elsewhere. Security incidents also began to define the field: the Mirai botnet, first observed in August 2016 by malware research group MalwareMustDie, launched a record-setting distributed denial-of-service attack on DNS provider Dyn on October 21, 2016, by enslaving hundreds of thousands of IP cameras and home routers shipped with default credentials.
In December 2019, Amazon, Apple, Google, and the Zigbee Alliance announced Project Connected Home over IP (CHIP), an effort to unify smart-home protocols around a single IP-based standard. The project was renamed Matter on May 11, 2021, and the Zigbee Alliance was rebranded as the Connectivity Standards Alliance (CSA) at the same time. Matter 1.0 was published on October 4, 2022, with Matter 1.4 following on November 7, 2024, and Matter 1.5 on November 20, 2025. The 2020s have also been marked by the integration of generative AI into consumer IoT devices and by widespread on-device inference using edge accelerators, often described as AI-native or "AIoT."
A typical IoT solution can be described as a layered stack, although the boundaries blur in practice. At the bottom sit the things themselves: sensors that convert physical phenomena into electrical signals, actuators that convert signals into physical motion or other effects, and microcontrollers that orchestrate them. Above that sit local networks and gateways that aggregate traffic from constrained devices and bridge it to the wider Internet. Wide-area connectivity carries the resulting data to cloud back-ends, where device management, storage, analytics, and integration with business systems live. Applications and dashboards expose the data to humans or to other software.
| Layer | Typical components | Concerns |
|---|---|---|
| Devices/things | MCUs, sensors, actuators, batteries, radios | Cost, power, form factor, security keys |
| Edge gateway | Local hub, edge computing box, industrial PC | Protocol translation, buffering, local logic, on-device ML |
| Connectivity | Wi-Fi, BLE, Zigbee, Thread, LoRaWAN, NB-IoT, LTE-M, 5G | Range, throughput, power, deployment cost |
| Platform | Device registry, message broker, time-series store, twin model | Identity, OTA updates, scaling, multi-tenancy |
| Application | Dashboards, alerts, analytics, automation | UX, latency, business KPIs |
IoT solutions also vary by topology. Star topologies put each device in direct contact with a hub or gateway and dominate consumer Wi-Fi and BLE deployments. Mesh topologies let devices forward packets for one another and are common in Thread, Zigbee, and Bluetooth Mesh networks. Cellular IoT designs typically connect each device directly to the operator's base station, removing the local hub.
The split between edge computing and cloud computing is a long-running architectural question. Edge processing reduces latency, bandwidth costs, and exposure of raw data, and is essential for safety-critical or privacy-sensitive applications. Cloud processing offers elastic compute, easy aggregation across fleets, and access to large pretrained models. Real systems usually combine both, with feature extraction or model inference at the edge and aggregation, training, and analytics in the cloud.
IoT relies on a mix of physical-layer, network-layer, and application-layer protocols. The choice depends on range, throughput, power budget, and whether the device is plugged in or running on a coin cell.
| Category | Protocol | Range | Notes |
|---|---|---|---|
| Short range | Bluetooth / BLE | ~10–100 m | Standard for wearables, beacons; Bluetooth 5 LE Audio adds Auracast |
| Short range | Wi-Fi (802.11) | ~50 m indoor | Dominant in smart home; Wi-Fi HaLow (802.11ah) targets sub-GHz IoT |
| Short range | Zigbee | ~10–100 m | Mesh on 802.15.4 PHY; CSA standard |
| Short range | Z-Wave | ~30 m | Sub-GHz proprietary mesh, popular in U.S. home security |
| Short range | Thread | ~10–100 m | IPv6 mesh on 802.15.4, transport layer for many Matter devices |
| Short range | NFC | <0.1 m | Tap-to-pair, payments |
| Short range | RFID | <1 m | Asset tracking, identity tags |
| Wide area | LoRaWAN | 2–15 km | Sub-GHz LPWAN managed by LoRa Alliance |
| Wide area | Sigfox | up to 50 km | Ultra-narrowband LPWAN |
| Wide area | NB-IoT | 1–10 km | 3GPP LPWAN over licensed spectrum |
| Wide area | LTE-M (Cat-M1) | similar to LTE | 3GPP LPWAN with higher throughput than NB-IoT |
| Wide area | 5G NR-RedCap | similar to 5G | "Reduced Capability" 5G profile for mid-tier IoT |
| Application | MQTT | n/a | Lightweight publish/subscribe over TCP, OASIS standard |
| Application | CoAP | n/a | UDP-based REST analog, IETF RFC 7252 |
| Application | AMQP | n/a | Message-queue protocol, often in industrial back-ends |
| Application | HTTP/REST | n/a | Default for higher-power devices and gateway uplinks |
| Application | OPC UA | n/a | Industrial interoperability, OPC Foundation |
| Application | DDS | n/a | Real-time data distribution, common in robotics and defense |
Mesh networking technologies (Thread, Bluetooth Mesh, Zigbee) extend coverage and resilience without adding wiring, at the cost of higher latency and complexity. Time-Sensitive Networking (TSN), a set of IEEE 802.1 standards, brings deterministic Ethernet to factory floors and is increasingly used in industrial IoT deployments where motion control or safety functions require bounded jitter.
IoT hardware spans an enormous range. At one extreme are battery-operated 8-bit microcontrollers running for years on a coin cell; at the other are Linux-class single-board computers and edge servers with discrete GPUs or NPUs. The most common designs use 32-bit Arm Cortex-M microcontrollers, often with integrated radios.
| Tier | Examples | Typical use |
|---|---|---|
| Low-power MCU | STMicro STM32, NXP Kinetis, Microchip SAM, Nordic nRF52/nRF54, Silicon Labs EFR32 | Battery sensors, wearables, smart-home endpoints |
| Wireless SoC | Espressif ESP32, Realtek RTL8720, Telink TLSR | Cost-sensitive Wi-Fi/BLE devices |
| Hobbyist/prototyping | Arduino Uno/Nano/MKR, Adafruit Feather | Education, prototyping, makers |
| Application processor | Raspberry Pi 4/5, BeagleBone Black, Rockchip boards | Gateways, kiosks, light edge AI |
| Edge AI | NVIDIA Jetson Nano/Orin, Google Coral Dev Board, Hailo-15 modules | Computer vision, robotics, edge inference |
| Industrial | Siemens Simatic IOT2050, Advantech UNO, Moxa UC | Factory gateways, ruggedized deployments |
| Connectivity modules | Quectel, Sierra Wireless, u-blox, Murata | Cellular and LPWAN connectivity |
The Cortex-M family from Arm dominates the low-power tier, with hundreds of vendor variants integrating radios, sensors, and security peripherals. RISC-V cores are growing share, particularly in Espressif's later parts. On the higher tier, Linux-capable Cortex-A application processors and Jetson modules with integrated GPUs anchor the edge AI segment.
IoT devices run a wide range of operating systems depending on resource constraints. The lowest tier runs a real-time operating system (RTOS) on a few tens of kilobytes of RAM; gateway and edge AI devices run embedded Linux distributions; specialized stacks aim at narrow niches.
| Category | Examples | Notes |
|---|---|---|
| RTOS | FreeRTOS | Open source, AWS-stewarded; ubiquitous in MCUs |
| RTOS | Zephyr | Linux Foundation project, broad SoC support |
| RTOS | Mbed OS | Arm-led, since 2024 in maintenance mode |
| RTOS | ThreadX / Azure RTOS | Microsoft-acquired Express Logic; later contributed to Eclipse Foundation as Eclipse ThreadX in 2024 |
| RTOS | NuttX | POSIX-like RTOS, used in PX4 autopilot |
| Embedded Linux | Yocto Project | Build system for custom Linux distributions |
| Embedded Linux | Buildroot | Simpler alternative to Yocto |
| Embedded Linux | Ubuntu Core | Canonical's snap-based immutable Linux |
| Specialized | Mongoose OS, Toit | Targeted IoT firmware platforms |
Home Assistant Operating System sits at the gateway tier as a turnkey Linux distribution that hosts the open-source Home Assistant smart-home hub.
Cloud IoT platforms provide device identity, telemetry ingestion, command routing, over-the-air update orchestration, time-series storage, rule engines, and integration with analytics, machine learning, and business systems. The market consolidated significantly in the early 2020s as several large platforms shut down or were repositioned.
| Vendor | Service | Status |
|---|---|---|
| AWS | AWS IoT Core, Greengrass, SiteWise, Events, FleetWise, ExpressLink | Active, broad portfolio |
| Microsoft Azure | Azure IoT Hub, IoT Operations, IoT Edge | IoT Central retired in March 2027 (announced 2024); Hub and Edge active |
| Google Cloud | Google Cloud IoT Core | Discontinued August 16, 2023 |
| Alibaba Cloud | Alibaba Cloud IoT Platform | Active, leader in China |
| PTC | ThingWorx | Industrial IoT platform |
| Siemens | MindSphere, renamed Insights Hub on Siemens Xcelerator (June 2023) | Active |
| GE | Predix | Repositioned around GE Vernova and GE Digital products |
| IBM | Watson IoT Platform | Service on IBM Cloud sunset on December 1, 2023 |
| Particle, Losant, Akenza, Bosch IoT | Various | Independent platform vendors |
The shutdowns of Google Cloud IoT Core and IBM Watson IoT Platform within months of each other in 2023 prompted enterprise customers to revisit reliance on hyperscaler-specific IoT services and to favor open standards (Matter, MQTT, OPC UA) and portable runtimes such as EdgeX Foundry, Eclipse ioFog, and Open Horizon.
IoT spans nearly every industry. The same underlying components (sensors, microcontrollers, radios, cloud back-ends) appear in very different configurations across consumer, urban, industrial, and scientific use cases.
| Domain | Representative applications |
|---|---|
| Consumer smart home | Smart bulbs, thermostats, locks, cameras, speakers, robot vacuums; Apple HomeKit, Google Home, Amazon Alexa, Samsung SmartThings |
| Wearable technology | Apple Watch and other smartwatches, fitness trackers, continuous glucose monitors |
| Smart cities | Adaptive street lighting, smart parking, waste-bin sensors, environmental monitoring, traffic optimization |
| Industrial IoT | Factory automation, predictive maintenance, asset tracking, OEE monitoring, energy optimization |
| Healthcare | Remote patient monitoring, smart inhalers and pumps, hospital asset tracking |
| Agriculture | Soil-moisture and nutrient sensors, livestock collars, drone-based crop monitoring, irrigation control |
| Logistics | Cold-chain temperature loggers, container tracking, fleet telematics |
| Utilities | Smart electricity, gas, and water meters; substation monitoring; leak detection |
| Automotive | Connected cars, V2X, fleet management; companies including Tesla treat the vehicle as a software-defined IoT endpoint |
| Retail | Electronic shelf labels, beacons, footfall counters, smart vending |
| Energy | Distributed solar inverters, battery storage management, EV chargers |
Industrial IoT (IIoT) has produced the clearest economic returns. Predictive maintenance models trained on vibration, temperature, and current data from industrial motors and pumps reduce unplanned downtime by detecting bearing wear or cavitation weeks ahead of failure. Digital-twin platforms, which keep a synchronized software model of a physical asset or factory, are most useful when fed by IIoT telemetry.
The convergence of artificial intelligence and IoT, often abbreviated as AIoT, is the most active area of growth in the field. The pattern is twofold: cloud-side AI consumes IoT telemetry to drive analytics and automation, while on-device AI performs inference where the data is generated.
On-device or "edge" inference has become standard practice on devices powerful enough to host a small neural network. Three classes of hardware support it. Microcontroller-class targets run TinyML workloads through frameworks such as TensorFlow Lite for Microcontrollers (TFLM), Edge Impulse, and Glow; typical models include keyword spotters, gesture classifiers, vibration-based anomaly detectors, and small image classifiers. Application-processor-class targets run ONNX Runtime, PyTorch ExecuTorch, or TensorFlow Lite. Edge accelerator targets such as the NVIDIA Jetson Orin, Google Coral Edge TPU, Hailo-8 and Hailo-15, Qualcomm AI Engine in Snapdragon parts, and Arm Ethos-U NPUs deliver from a few TOPS to hundreds of TOPS at single- or low-double-digit watts.
The practical applications cluster around a handful of patterns. Smart cameras run object detection and people-counting locally so that only events, not raw video, leave the device. Industrial gateways host anomaly-detection models for predictive maintenance. Wearables run heart-rate variability and arrhythmia classifiers. Voice assistants perform wake-word detection on-device before sending audio to the cloud. Federated learning techniques, in which a global model is updated by aggregating gradients computed locally on each device, are used in keyboard prediction (notably by Google) and are being explored for fleet-wide IoT learning that respects data sovereignty.
The most recent shift is the arrival of generative AI on edge IoT hardware. Quantized variants of small open-weight language models such as Meta's Llama 3.2 1B/3B, Microsoft's Phi family, and Google's Gemma 2B/3B run interactively on Jetson Orin modules, on Apple Silicon, and on Snapdragon X-series chips. In the smart home, Amazon Alexa and Google Assistant integrate large model back-ends, while open-source Home Assistant supports local LLM integrations through projects like Whisper-on-edge and Ollama. In industrial settings, generative AI is being grafted onto digital twins so that a plant operator can ask natural-language questions of the asset model or have a chatbot draft a maintenance work order from a stream of sensor readings.
Matter is an open, IP-based connectivity standard intended to give consumer smart-home devices a single common protocol so that products from different vendors interoperate without bridges or cloud round-trips. Matter is governed by the Connectivity Standards Alliance (CSA), formerly the Zigbee Alliance, with founding sponsorship from Apple, Google, Amazon, and Samsung among others.
The project was first announced in December 2019 as Project Connected Home over IP (CHIP). It was renamed Matter on May 11, 2021, when the Zigbee Alliance was simultaneously renamed CSA. Matter 1.0 was published on October 4, 2022, defining device types for lighting, switches, plugs, locks, sensors, thermostats, blinds, media devices, and bridges, and specifying Wi-Fi and Thread as the underlying networks for IP transport with Bluetooth Low Energy used for commissioning. Matter 1.4 was released on November 7, 2024, with significant additions for energy management (batteries, solar, heat pumps, water heaters) and home routers. Matter 1.5 was published on November 20, 2025, adding camera streaming, soil-moisture sensors, and refinements to closures and energy management.
Matter's reference implementation lives in the open-source connectedhomeip repository on GitHub, originally seeded by Apple, Google, and others, and is licensed under Apache 2.0. Adoption has been gradual: support is shipping in Apple Home, Google Home, Amazon Alexa, and Samsung SmartThings, but multi-admin features, ecosystem-specific feature gaps, and certification cost remain points of friction for vendors.
IoT is shaped by an unusually large number of standards organizations because it touches networking, hardware, industrial automation, and consumer electronics simultaneously.
| Body | Scope |
|---|---|
| IETF | IPv6, 6LoWPAN (RFC 6282), CoAP (RFC 7252), RPL (RFC 6550), CORE working group |
| IEEE | 802.11 (Wi-Fi), 802.15.4 (low-rate WPAN), 802.1 TSN |
| 3GPP | NB-IoT, LTE-M, 5G (including NR-RedCap and Ambient IoT in Release 19) |
| oneM2M | Common service-layer architecture for M2M and IoT |
| OCF (Open Connectivity Foundation) | OCF specification, IoTivity reference implementation |
| CSA | Zigbee, Matter, Z-Wave (since 2024) |
| OPC Foundation | OPC UA industrial interoperability stack |
| IIC (Industrial Internet Consortium, now part of OMG) | Industrial Internet Reference Architecture |
| LoRa Alliance | LoRaWAN |
| GSMA | Embedded SIM, IoT SAFE, cellular IoT certification |
IoT security is hard for structural reasons. Many devices ship with default credentials, lack any update path, run for years without supervision, and live in environments where physical tampering is feasible. The economic incentive to harden a $5 sensor is weak compared to the cost of compromise.
The Mirai botnet, first observed in August 2016, became the canonical example. Mirai scanned the Internet for IoT devices (chiefly IP cameras, DVRs, and home routers) listening on Telnet with one of approximately 60 default username/password pairs, infected them, and used them as a distributed denial-of-service platform. On October 21, 2016, a Mirai-driven attack against managed-DNS provider Dyn caused outages at PayPal, Twitter, Reddit, Netflix, Spotify, and many other services in the eastern United States and parts of Europe. The Mirai source code was leaked publicly in late 2016, and variants continue to circulate.
Industrial IoT carries higher stakes. Stuxnet, a worm uncovered in June 2010, targeted Siemens Step 7 software running on Windows PCs that programmed S7-300 PLCs controlling centrifuges at Iran's Natanz uranium-enrichment facility. The worm caused centrifuges to spin out of their normal range while reporting normal readings to operators, and is widely attributed to a joint U.S. and Israeli intelligence operation. Stuxnet established that cyber operations could cause physical destruction of industrial equipment.
Other recurring concerns include weak or absent encryption on consumer telemetry, poor handling of cryptographic keys, the use of hard-coded backdoors for remote support, vulnerable bootloaders that allow firmware downgrade attacks, and the long tail of devices that outlive their vendors. Privacy concerns center on how much intimate data smart speakers, smart cameras, and wearables collect, where it is processed, and how long it is retained, with the EU General Data Protection Regulation (GDPR) and analogous laws elsewhere driving disclosure and minimization requirements.
Market data for IoT varies sharply by analyst because the definition of a "connected device" differs. The most widely cited tracker, IoT Analytics, reported that the installed base of active connected IoT devices reached 18.8 billion at the end of 2024 (12 percent growth over 2023) and forecast 21.1 billion by the end of 2025 (14 percent growth). The same firm projects roughly 39 billion connected devices by 2030 at a 13.2 percent compound annual growth rate from 2025. Wi-Fi accounts for roughly 32 percent of all IoT connections and remains the largest single connectivity technology, while cellular IoT (2G through 5G plus LTE-M and NB-IoT) accounts for roughly 22 percent.
On the economic side, McKinsey & Company estimated in a 2021 study that IoT could enable between $5.5 trillion and $12.6 trillion in global value by 2030, including value captured by consumers and end customers. McKinsey allocated about 26 percent of that total to factory settings and 10 to 14 percent to human-health settings, with B2B applications accounting for 62 to 65 percent of the total. The 2020 actual value captured was estimated at about $1.6 trillion, near the low end of McKinsey's earlier 2015 scenarios, indicating that operationalizing IoT has proved harder than initial forecasts suggested.
IDC and Gartner have published their own forecasts; the headline numbers differ but consistently project double-digit annual growth in connected devices and IoT spending through the late 2020s.
Regulation of IoT has shifted from voluntary guidance to legally binding requirements. The European Union's Cyber Resilience Act (CRA) entered into force on December 10, 2024, with the principal obligations applying from December 11, 2027, and incident-reporting obligations from September 11, 2026. The CRA covers products with digital elements placed on the EU market and imposes mandatory cybersecurity requirements on manufacturers, including secure-by-design development, vulnerability handling, and provision of security updates over the product's expected lifetime.
In the United States, the Federal Communications Commission adopted rules in March 2024 to create the U.S. Cyber Trust Mark, a voluntary cybersecurity labeling program for consumer wireless IoT products. UL Solutions was conditionally selected as the lead administrator in December 2024, and the program was formally launched by the White House in January 2025. Devices bearing the mark are expected to meet baseline requirements derived from NIST IR 8425, with a QR code linking to a public registry of product details.
Other jurisdictions have moved in parallel. The United Kingdom's Product Security and Telecommunications Infrastructure (PSTI) Act came into force on April 29, 2024, banning default passwords on consumer connected products and requiring published security-update windows. Singapore's Cybersecurity Labelling Scheme (CLS) provides a four-level mark for consumer IoT devices.