Half of Enterprises Now Block IoT Projects Over Security Concerns

Security overtakes cost as the top IoT deployment barrier

Fifty percent of enterprises now identify security and data privacy as their primary obstacle to IoT deployment, according to new market research aggregating enterprise buyer surveys. The figure marks a shift from earlier IoT adoption cycles, when connectivity cost and integration complexity dominated buyer objections. For enterprise technology buyers, the data provides quantified peer validation that strengthens internal business cases for dedicated IoT security line items in fiscal 2026 budgets.

The finding arrives as overall cybersecurity spending surpassed $200 billion per year in 2024, with network and endpoint security absorbing the largest shares. The correlation matters because it positions IoT security as a distinct budget category rather than an add-on to existing endpoint or network refresh projects. CISOs can now argue for IoT-specific controls with external benchmarking rather than anecdotal risk.

Healthcare breaches expose unmanaged device blind spots

Medical IoT security vendor Asimily published a multi-year breach analysis documenting repeated compromise of unmanaged connected medical and operational devices including infusion pumps, imaging systems, and building controls. The analysis characterizes recent incidents as multi-vector: weak or default credentials, unpatched firmware, and lack of segmentation or monitoring for specialized devices.

The Asimily report identifies a pattern where a large portion of affected assets were never inventoried or centrally patched. The finding aligns with the broader market data showing security concerns now block half of IoT projects. For hospital systems and large facilities operators, the pattern creates two procurement pressures: justify dedicated IoT/medical device security platforms that can discover devices unable to run agents, and reallocate budget from user endpoint controls toward network-based IoT discovery and segmentation.

Asimily competes directly with Armis, Forescout, Cylera, Medigate by Claroty, and Ordr in the healthcare and enterprise IoT/OT visibility segment. All position around passive discovery of shadow IoT, risk scoring of medical and industrial devices, and compensating controls via network access control, firewalls, and micro-segmentation. The breach analysis effectively serves as category marketing: the multi-year exploitation pattern demonstrates that generic endpoint tools miss specialized devices.

Automated patching and credential rotation become baseline requirements

New operational guidance argues enterprises are leaving their front doors unlocked by not systematically managing IoT device hygiene, framing the gap as a board-level risk. The guidance pushes a specific operational model: automate patching, firmware updates, credential rotation, and continuous device inventory for IoT fleets. The argument is that device inoculation — keeping patches and firmware current, rotating credentials by policy, maintaining accurate inventory — reduces attack surface more than network segmentation alone.

This operational model directly informs product roadmaps for IoT device management platforms including Azure IoT Hub, AWS IoT Device Management, and EMnify, which sell over-the-air firmware management and policy-based configuration control. It also shapes IoT security vendors like SecuriThings, Armis, Forescout, and Asimily, which integrate asset discovery, patch visibility, and workflow automation for remediation.

For enterprise buyers, the shift creates a new procurement requirement: vendors must demonstrate integrated inventory-to-patch workflows rather than point discovery or monitoring tools. Expect RFPs to require native IoT device classification, risk scoring, and policy-based control from network and security vendors. IoT platform and device vendors will face increased pressure to provide integrated security baselines including patch orchestration, credential rotation, and device-health telemetry.

What to watch

The combination of 50% of enterprises blocking IoT projects over security and $200 billion in annual cybersecurity spend creates budget headroom for dedicated IoT security platforms. For large hospital systems, that translates to low-to-mid seven-figure annual IoT/OT security line items based on prevailing pricing from Armis, Forescout, Asimily, and competitors.

Procurement teams should add explicit unmanaged device inventory and vulnerability visibility requirements to RFPs, and ask for evidence of coverage for vendor-locked medical systems and building controls, which Asimily flags as frequently compromised. The shift from IoT security as a feature to IoT security as a category changes vendor selection: buyers now evaluate dedicated platforms against network security add-ons rather than choosing between IoT pilots.