Labels, Patches and a Separate Network: Smart-Home Security That Works

The smart home has a way of producing statistics that are more exciting than the evidence. A widely repeated claim that the average household contains more than fifty connected devices is not supported by any public survey. Deloitte's long-running estimate for the United States put the figure at twenty-one devices per household in 2023, and growth since then has been steady rather than explosive. The honest number is less dramatic and the security advice is the same: a house with twenty devices, half of them unpatched, is a meaningful attack surface.

Regulation Finally Gives You a Label

For years the consumer advice was to research a product's update policy, which was impossible in a shop and unreliable on a marketplace listing. Three regimes have changed that.

The UK's Product Security and Telecommunications Infrastructure regime has applied since April 2024 to consumer connectable products sold there. It bans universal default passwords, requires a published vulnerability disclosure route, and requires transparency about how long security updates will be provided. Those three requirements are not a high bar, but they are the right three, and they are enforced against manufacturers rather than left to the buyer.

The EU Cyber Resilience Act's reporting duty for manufacturers began on 11 September 2026, with ENISA operating the single reporting platform. From that date, manufacturers must report actively exploited vulnerabilities with a 24-hour early warning and a fuller notification within 72 hours. The main conformity obligations, and the CE marking that goes with them, arrive on 11 December 2027. Anyone buying European products in 2027 should find the CRA on the box; anyone buying now should know that the reporting channel exists but the product requirements do not yet apply.

The US Cyber Trust Mark has been slower and is now real. The FCC selected ioXt as lead administrator in April 2026, opened a filing window for label administrators in August 2026, and the mark is designed to signal exactly the properties the UK regime mandates: no default passwords, a vulnerability disclosure process, and a stated support period. It is voluntary, so its value depends on manufacturers wanting the badge, but a label is still a better buying signal than a paragraph of marketing copy.

Buying: Four Questions That Matter

• Does it carry a label? The US Cyber Trust Mark or a UK PSTI-compliant product is a reasonable filter, not a guarantee.
• How long will it be updated? A stated support period is the single best predictor of whether the device is safe in three years.
• Does it need a cloud account? Prefer devices that work locally over Matter, Thread, Zigbee or Z-Wave. Local control survives the vendor's business model changing.
• Can it be isolated? Anything that needs an app and an internet connection belongs on a network segment that cannot reach your laptop.

Running What You Already Own

Most of the risk is in the devices people already have, and the work is unglamorous. Put firmware updates on a schedule and check the manufacturer's support page rather than trusting the app to notify you. Replace end-of-life gear deliberately; a camera whose last update was in 2019 is not made safe by a strong password. Give the router an administrator password that is not the one printed on the sticker, disable remote administration and UPnP unless something specific needs them, and keep the router firmware current, because it is the one device every other device depends on for isolation.

Segmentation is the highest-value control available to a household and does not require enterprise equipment. A guest network that isolates clients from each other and from the main LAN is enough for most homes, and a second SSID for smart devices keeps a compromised bulb away from the laptop that holds the tax return. Where the router supports VLANs, a dedicated IoT VLAN with outbound access limited to what the devices actually need is better still. The test is simple: if the camera is compromised, can it reach the network storage?

Cameras and the Privacy Bill

Cameras and doorbells deserve separate consideration because their failure mode is not a botnet. It is footage. Use local storage where the product supports it, enable two-factor authentication on the vendor account, use a unique password, and check what the device sends home. A camera that requires a cloud subscription to record is a camera whose footage depends on a company that may be acquired, repriced or shut down.

The botnet story that made IoT famous in 2016 was built on default credentials and internet-exposed devices. A decade of regulation has made default passwords illegal in some markets and labelled in others, but the installed base does not change when a law does. The practical work is to treat the home network as a small untrusted estate: inventory it, patch it, segment it, and retire what no longer receives updates.