How do you choose an IoT security vendor?

Photo: FlyD / Unsplash

At a glance

Listed in alphabetical order, not ranked. Nobody pays to appear on a shortlist, and paid directory placements get no preference here (see the editorial policy).

“IoT security vendor” covers at least three markets that rarely overlap. Identity vendors issue and manage the certificates that let devices prove who they are. Product security vendors analyze the firmware you ship and produce the evidence regulators now ask for. Network security vendors find and watch the devices already running on a plant floor, in a hospital or across a campus. Decide which problem you have before you take a demo, because each group answers a different question and is bought by a different team.

If you build devices: identity and firmware

Device makers need two things from vendors. The first is identity: a PKI that issues unique X.509 certificates at manufacturing, renews them in the field and revokes them when a device is retired. Key storage on the device (a secure element or TPM) is a hardware choice, but the PKI vendor decides how keys get there and how certificates are rotated across a fleet. The guide to device identity and PKI explains the moving parts.

The second is knowing what is inside your firmware. Binary analysis tools build a software bill of materials from the image you actually ship, including third-party components you never had source for, then track new vulnerabilities against it. Under the Cyber Resilience Act and similar rules, that inventory and your handling of vulnerabilities become documented obligations; see IoT security regulation. Buyers increasingly ask how long a product will receive fixes, a question covered in our guides to smart device end of support and security support period labels.

If you operate devices: visibility and detection

Operators first need an inventory. OT and IoT devices often cannot run agents, and active scanning can disrupt fragile controllers, so the leading tools rely on passive monitoring of network traffic, with optional safe queries to controllers or endpoint sensors where they are possible. The inventory then feeds vulnerability prioritization, anomaly and threat detection, and network segmentation decisions. In industrial settings, check how findings map to IEC 62443 zones and conduits; the guide to IoT vs IIoT covers why plant networks need different treatment from office ones.

Deployment matters more here than in other security categories. Sensors need span ports or taps at the right places, plants may require on-premises or air-gapped consoles, and someone has to triage alerts. Some vendors bundle threat hunting or incident response; others expect your SOC to do it.

How are these tools priced?

Few vendors in these categories publish price lists, so start by asking which unit they charge on. For identity platforms it may be certificates issued, identities under management or signing keys; for firmware analysis, products, firmware images or scans; for network visibility, monitored assets, sites or sensors, with services on top. Ask for a quote built on your own numbers (devices shipped per year, firmware releases, monitored sites) rather than a list price, and check what happens to stored certificates, SBOMs or asset data if you leave.

Questions to ask the vendor

• Which of our problems does this product solve, and which does it leave to other tools?
• What exactly does the tool produce as evidence for the CRA, IEC 62443 or FDA submissions?
• For network tools: is discovery passive by default, and what does active querying touch?
• For identity tools: how are keys injected at our factory, and how are certificates rotated in the field?
• What is the post-quantum migration plan for the certificates and signatures we issue today?

How we built this list

The picks come from the security category of our directory and cover the three groups above: identity and PKI, firmware and product security, and OT/IoT network visibility. Each note was checked against the vendor’s official site on October 22, 2026. The list is alphabetical, not ranked, no vendor paid to appear, and we have not tested the products. For background, start with IoT security fundamentals.

The shortlist

Picks, products and the notes above were checked on the vendors' official sites on October 22, 2026. Plans and prices change; the official page is the reference. A vendor missing or described wrongly? Tell us.