The Evolution of IoT Security: A Critical Review of Threat Landscapes (2015–2026)

1. Introduction: From Conceptual Model to Real‑World Turbulence

The Internet of Things (IoT) has grown significantly. It has transformed the way we perceive both the virtual and physical world, forming a new area in which numerous devices interconnect and interact autonomously (Tariq et al., 2023; Shah et al., 2022). However, it has also created a large and complex attack surface, making cybersecurity extremely critical. Recent surveys classify deployments into consumer, industrial/OT, healthcare, and smart‑city environments and show how each introduces distinct threat patterns (Shah et al., 2022).

Mohamed Abomhara and Geir M. Køien, in their 2015 paper “Cyber Security and the Internet of Things: Vulnerabilities, threats, intruders, and attacks”, were among the first to attempt to structure and describe these new threats in IoT (Abomhara & Køien, 2015). Their work was conducted at a time when IoT was beginning to transition from a concept to a reality, and it represented an initial attempt to grasp the challenges on the horizon. This article examines their paper through the eyes of a modern cybersecurity practitioner. It seeks to understand their taxonomy, evaluate its conclusions in the context of subsequent research, and contrast it with what we now know after a decade of large‑scale botnets, Ransomware‑as‑a‑Service, AI‑driven attacks, and deep supply‑chain risks (Tariq et al., 2023; Butun et al., 2022).

2. How the Original Paper Approached IoT Security

Abomhara and Køien did not conduct empirical measurements or propose new cryptographic protocols. Their key aim was to perform a descriptive study and build a framework that could help others understand IoT security issues systematically, at a time when the field was still emerging (Abomhara & Køien, 2015). They decomposed the ecosystem into components—assets, weaknesses, threats, and the individuals and groups who generate threats—and then classified each of these in detail.

The methodology they used was an in‑depth review of the literature and assimilation of existing knowledge. They aggregated data from research articles, industry reports, and technical standards to create a comprehensive model of the IoT environment. This can be divided into several important stages (Abomhara & Køien, 2015).

This descriptive and classificatory methodology was appropriate for a foundational work. The goal was not to optimize a single algorithm, but to bring structure to a chaotic and rapidly emerging field, providing a framework that subsequent empirical and solution‑driven research could extend (Sicari et al., 2015; Butun et al., 2022).

3. The Central Questions: Still the Right Checklist in 2026

The article does not pose a formal, testable hypothesis. Instead, its investigation is guided by a central exploratory question: How can the complex and multifaceted security challenges of the Internet of Things be systematically identified, classified, and understood? (Abomhara & Køien, 2015, p. 66). This overarching question is broken down into specific guiding questions that must be addressed to achieve a secure IoT ecosystem.

In 2026, these questions remain a useful checklist for any IoT deployment, regardless of domain. Assets now include not only sensor data and control logic, but also on‑device ML models and Software Bill of Materials (SBOM) metadata (Shah et al., 2022). Threat actors include not only individuals, groups, and agencies, but also professional RaaS ecosystems and supply‑chain adversaries (Nemec Zlatolas et al., 2024; Aldosari, 2025). Security mechanisms encompass not only classical PKI and access control, but also blockchain‑anchored provenance and post‑quantum‑resistant key exchange (Li et al., 2024).

5. Reference Architecture: Where Security Actually Lives

Building on Abomhara and Køien’s abstraction of entities, devices, and services (Abomhara & Køien, 2015), a modern IoT security architecture can be viewed as four interacting layers. Each layer has its own assets, threats, and controls across consumer, industrial, healthcare, and smart‑city deployments (Shah et al., 2022; Butun et al., 2022).

From a defender’s perspective, this layered model also clarifies where different classes of threats should be mitigated. Physical tampering and side‑channel attacks concentrate on the device layer. Protocol exploits and man‑in‑the‑middle attacks live primarily at the device–edge and edge–cloud interfaces. Identity abuse and privilege escalation show up in the cloud and application layers, while long‑term stealth—such as supply‑chain backdoors or key misuse—is detected most effectively in the trust and monitoring fabric. Mapping Abomhara and Køien’s threat categories onto these layers helps teams design controls where they will have the most impact (MITRE, 2024; CISA, 2023).

This layered view connects directly back to the 2015 taxonomy. Assets span all four layers. Threats and intruders can be mapped to specific techniques at each layer using frameworks like MITRE ATT&CK for ICS, and long‑term trust anchors increasingly rely on quantum‑aware PKI and blockchain research (Li et al., 2024; Alshahrani et al., 2025).

6. New Axes in the 2026 Landscape: RaaS, AI, and Supply‑Chain Risk

6.1 Professionalized Cybercrime and RaaS

Abomhara and Køien were correct in identifying financial gain as a key motivation for cybercrime (Abomhara & Køien, 2015). However, the threat has evolved from relatively isolated actors into large‑scale organized crime rings that utilize advanced tactics such as Ransomware‑as‑a‑Service (RaaS). These operations increasingly target critical services, including industrial production, healthcare, and municipal infrastructure, by abusing IoT and OT devices as entry points or leverage for extortion. For example, attackers may exploit an exposed VPN appliance or OT gateway, encrypt adjacent file shares and control systems, and then demand payment to restore operations (Aldosari, 2025; Nemec Zlatolas et al., 2024).

6.2 AI as Defender and Attack Surface

The 2015 paper does not discuss the role of artificial intelligence. Today, AI and machine learning are central to the new dynamics of threats and defenses. On one hand, AI‑driven intrusion‑detection systems and anomaly detectors can sift through vast volumes of telemetry from industrial sensors, consumer devices, medical equipment, and smart‑city nodes to detect abnormal behavior (Messinis et al., 2024). On the other hand, adversarial AI introduces new attack vectors: data‑poisoning and model‑evasion attacks can compromise IoT infrastructures from within, in ways that traditional threat models did not anticipate (Tariq et al., 2023; Mauri & Damiani, 2022).

6.3 Supply‑Chain and Third‑Party Dependencies

According to the original paper, intruders are classified as individuals, groups, or agencies. In 2026, a crucial additional dimension is the supply chain. Modern IoT infrastructure consists of complex interconnections of third‑party software, hardware, and cloud services. A vulnerability in any stage of this chain—from build systems to shared libraries—can generate weaknesses in millions of devices yet to be deployed (Nemec Zlatolas et al., 2024; Butun et al., 2022).

This reality makes SBOMs, secure development pipelines, and trusted update channels fundamental requirements. Agencies such as ENISA and NIST now treat supply‑chain attacks as critical threats, emphasizing the need for transparency and rapid impact assessment when a new vulnerability or compromise is discovered (CISA, 2023; Cyber Resilience Act 2022).

7. Logical Follow‑Up Directions: Extending the 2015 Framework

The work of Abomhara and Køien provides fertile ground for numerous follow‑up studies, many of which are now active areas of research. Based on their foundational framework, several directions are particularly important in 2026.

Taken together, these directions suggest a research agenda that goes beyond patching today’s vulnerabilities. It aims at end‑to‑end, adversary‑aware systems that are cryptographically agile, explainable under formal models like Dolev–Yao, and empirically grounded in real‑world adversary behaviour catalogued by frameworks such as MITRE ATT&CK. My goal with this review is to provide a bridge between the early conceptual work of 2015 and these emerging lines of work, so that practitioners and researchers can situate their own contributions inside a coherent evolution of IoT security thinking.

8. Conclusion: Why a 2015 Taxonomy Still Matters in 2026

The paper “Cyber Security and the Internet of Things” by Abomhara and Køien was a seminal early work on IoT security. It adopted a descriptive, taxonomic approach to structuring a new and complex field, providing one of the first clear inventories of vulnerabilities, threats, and intruders. Its conclusions on IoT device weaknesses and the need for a holistic approach to security were prescient and remain valid today (Abomhara & Køien, 2015; Tariq et al., 2023).

At the same time, the last decade has witnessed a remarkable transformation of the cybersecurity landscape. The professionalization of cybercrime, the introduction of AI both as a defensive tool and as a target, and the growing sophistication of global supply chains have added new dimensions to IoT security challenges (Nemec Zlatolas et al., 2024; Messinis et al., 2024). Although the original framework remains an informative teaching and modelling tool, it must be supplemented with up‑to‑date knowledge on RaaS, AI, supply‑chain risk, blockchain, and post‑quantum cryptography to be fully useful in practice.

IoT security research of the future will continue to build on the conceptual ground that Abomhara and Køien helped lay, pushing toward adaptive, intelligent, and resilient security solutions for an increasingly interconnected world. In a follow‑up article, I will focus exclusively on the current and future landscape: agentic AI kill chains, operationalizing the EU Cyber Resilience Act, deploying PQC in real‑world IoT products, and exploring quantum‑secure blockchain architectures in depth.