Home Assistant
The gold standard for local control. In 2026, it leverages 'Home Assistant Assist' for local, private voice AI, ensuring your smart home data never leaves your four walls.
AdGuard Home
A network-wide DNS sinkhole that stops 'chatty' IoT devices from leaking telemetry, blocking the tracking and telemetry domains that smart TVs and appliances call home to. Pi-hole is the equivalent, equally popular alternative; both run on modest hardware such as a Raspberry Pi.
Matter Standard (CSA)
The unified smart-home protocol from the Connectivity Standards Alliance. The Distributed Compliance Ledger (DCL) records the certification and firmware information manufacturers publish for each device; it is a reference ledger, not an access control that decides whether a device may join your network.
Thread Protocol
A low-power, self-healing mesh network that eliminates the single point of failure. It uses IP-based security and AES encryption at the mesh layer, making it the preferred 2026 transport for secure IoT.
Australian Smart Device Rules 2025
In force since 4 March 2026, these rules require smart devices made for the Australian market to have unique or user-set passwords, a clear vulnerability-reporting path, and a published support period with an end date.
EU Cyber Resilience Act (CRA)
A major legislative shift. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities through the EU's single reporting platform: an early warning within 24 hours, a full notification within 72 hours, and a final report within 14 days of a corrective measure being available.
U.S. Cyber Trust Mark
An 'Energy Star' for security. The voluntary FCC labelling programme covers wireless consumer IoT products that meet baseline security requirements; the label's QR code links to a registry with the product's support period, update behaviour, setup guidance and how to change the default password. The programme is still being rolled out, so labelled products are limited.
OWASP IoT Top 10
The 2018 list of the ten most common IoT weaknesses, from weak passwords and insecure network services to insecure ecosystem interfaces and poor device management. It remains the canonical IoT risk list; there is no 2026 edition.
IoTGoat
The 'vulnerable-by-design' firmware used by 2026 security researchers to practice finding backdoors, hardcoded keys, and buffer overflows in a safe, legal environment.
CISA Secure-by-Design
Joint guidance first published in 2023, urging manufacturers to stop putting the 'security burden' on the user and to turn security features such as automatic updates on by default.
UK PSTI Regime
The UK's Product Security and Telecommunications Infrastructure regime, in force since 29 April 2024. Consumer connectable products must use unique or user-defined passwords, publish a point of contact for vulnerability reports, and state a minimum security-update support period.
Binwalk
A firmware analysis tool, rewritten in Rust for version 3. It identifies and optionally extracts files and data embedded inside a firmware image, and its entropy analysis highlights compressed or encrypted regions in images that have no readable structure.