Internet of Things (IoT): Devices, Sensors and Applications
The Internet of Things (IoT) connects physical objects, and information about them, to networks so that software can monitor them, combine their data and sometimes act on it.[1] This page explains how the pieces fit together, where IoT is used, and what makes it hard to do well.
Short answer
- The ITU defines the IoT as a global infrastructure that enables advanced services by interconnecting physical and virtual “things”, using existing and evolving interoperable communication technologies. A “thing” is an object that can be identified and connected to networks, and a “device” is equipment that can communicate and may also sense, act, capture, store or process data.[1]
- A simple way to think about it: a device produces data, a connection carries it, and a service uses it.
- Standards bodies and regulators document well-known challenges: security, privacy, interoperability, reliability, maintenance and energy. Claims about economy-wide disruption are expectations, not settled evidence.
How to read this page. Numbers in square brackets point to the sources under References. A statement without a number is our own plain-language explanation or illustration, not a research finding. Statements about the future are labelled as forecasts.
What is the Internet of Things?
In ITU’s definition, the IoT is a global infrastructure for the information society that enables advanced services by interconnecting physical and virtual things, using existing and evolving interoperable information and communication technologies.[1] A thing can be a physical object, such as an industrial robot, goods or electrical equipment, or a virtual one, such as multimedia content or application software.[1]
The word “device” has a narrower meaning: equipment that must be able to communicate and may also be able to sense, act, capture data, store data or process data.[1]
How do devices, networks, data and services fit together?
Two standards describe the same idea in different ways. ITU’s reference model has four layers: the device layer, the network layer, a service and application support layer, and the application layer.[1] NIST describes five building blocks, which it calls primitives: a sensor, an aggregator, a communication channel, an external utility (“eUtility”) and a decision trigger.[2]
To keep the explanation simple, this page groups them into four parts: device, connection, data and service. This grouping is our simplification, and the table shows where each part appears in the standards.
-
Stage 1
Devices and sensors
Physical equipment that can sense, act, or both, and can communicate. Examples on this page: wearables, smart-home devices and industrial sensors.[1]
-
Stage 2
Connectivity
Carries data between devices and services. The link can use different technologies.[2, 3, 4]
- Wi-Fi
- Mobile networks
- Thread
- Bluetooth LE
- Wired
-
Stage 3
Data processing
Raw readings are combined, summarised or analysed. This can happen in different places, or in several at once.[2, 5]
- On the device
- At the network edge
- In the cloud
-
Stage 4
Application or service
Software that uses the results, for example to show a dashboard, send an alert or trigger an action.[1, 2]
Not every system looks like this. NIST describes five building blocks for a network of things and says some networks may lack one or more of them, though it expects that to be rare.[2] The terms “edge” and “fog” computing are also used in slightly different ways, and NIST notes there is no consensus on the distinctions.[5] Here, “edge” means processing close to the devices.
| Part | In plain language | How standards describe it | Illustration (ours) |
|---|---|---|---|
| Device | The physical equipment that can sense or act and can communicate. | ITU: a device always has communication capability and may also sense, act, capture, store or process data.[1] NIST: a sensor measures physical properties such as temperature, acceleration, weight, sound, location, presence or identity.[2] | A temperature sensor. |
| Connection | The network or channel that carries data between devices and services. | ITU: the network layer provides connectivity for application data and for control information.[1] NIST: a communication channel is a medium by which data is transmitted, such as wired or wireless links.[2] | A Wi-Fi or mobile network link. |
| Data | The readings and other information the device produces, which may be combined or summarised. | NIST: an aggregator is software that transforms groups of raw data into intermediate, aggregated data.[2] ITU: common support capabilities include data processing and storage.[1] | A reading every minute, averaged over an hour. |
| Service | The software or online service that uses the data and may trigger an action. | ITU: the application layer holds IoT applications, supported by service and application support capabilities.[1] NIST: an eUtility is a software or hardware product or service, and a decision trigger produces the final result a system exists to deliver.[2] | An app that alerts you and switches the heating. |
A worked example
Illustration Imagine a temperature sensor in a greenhouse. The device measures the temperature. The connection, perhaps Wi-Fi, carries each reading to an online service. The data is the series of readings, which the service may average or check against a limit. The service compares the data with a target and, if the greenhouse is too hot, sends an alert or tells another device, such as a vent motor, to open. This is an invented example to show the roles, not a description of a real product.
What do sensors and actuators do, and what is the difference between monitoring and automation?
NIST describes IoT as involving sensing, computing, communication and actuation.[2] In ITU’s terms, communication is the one mandatory capability of a device, while sensing and actuation are optional.[1]
In plain language, a sensor measures something and an actuator does something, such as switching a circuit or opening a valve. Monitoring means reading and reporting. Automation means that software also decides and acts, which is the job NIST gives to a decision trigger, the part that produces the final result a system exists to deliver.[2]
Wearables, smart-home devices and industrial sensors
Wearables
The ETSI standard lists wearable health trackers among consumer IoT devices.[6] Devices used for patient monitoring can also fall under medical-device regulators. The US FDA describes non-invasive remote monitoring devices as acquiring patient physiological data without in-clinic visits.[7] The FDA also says that connecting medical devices can improve care but adds cybersecurity risk.[8]
Smart-home devices
ETSI’s examples include connected smoke detectors, door locks, window sensors, baby monitors, cameras, TVs, speakers, appliances and the gateways and hubs that many devices connect to.[6] Because devices come from many makers, the Connectivity Standards Alliance developed Matter, which it says aims to let products from different brands work together. Its first release ran over Ethernet, Wi-Fi and Thread, with Bluetooth Low Energy used to set devices up.[3] That source is the Alliance’s own announcement, so it tells us the aim, not how widely or how well Matter works in practice.
Industrial sensors
In manufacturing, NIST describes using sensor readings to assess equipment health, predict remaining useful life and diagnose failures. In some systems, readings feed into control systems that watch for fault indicators such as vibration levels, flow rates, temperatures, chemical concentrations and strains.[9] ITU lists industrial robots among physical things and industrial machines among the equipment that can be IoT devices.[1]
Where is IoT used?
Four examples at a glance, each with one potential benefit and one limit or risk:
-
Smart homes and wearables
- Example
- A connected door lock, camera or fitness tracker.[6]
- Potential benefit
- Standards such as Matter aim to let devices from different brands work together, which could make setup and mixing brands easier.[3]
- Limit or risk
- Security depends on basics such as avoiding shared default passwords and keeping software updatable.[6] In the UK, makers of in-scope products must publish how to report security issues and for how long updates are provided.[10]
-
Healthcare
- Example
- Measuring a patient’s body signals at home with a remote monitoring device.[7]
- Potential benefit
- Data can be collected without a clinic visit, which can reduce the need for some in-office or in-hospital services.[7]
- Limit or risk
- Connecting medical devices to networks adds cybersecurity risk.[8] The sources here are from the US regulator, and other countries have their own rules.
-
Agriculture
- Example
- Precision-farming systems, such as guidance for planting and fertiliser.[11]
- Potential benefit
- FAO says such systems can save seed, fertiliser and tractor fuel, and that variable-rate technologies and drones can reduce water and pesticide use.[11]
- Limit or risk
- FAO warns that weak infrastructure, high technology costs and low digital skills risk leaving rural areas behind.[11]
-
Manufacturing
- Example
- Watching equipment with sensors to spot wear or failure early.[9]
- Potential benefit
- NIST says this kind of monitoring can cut maintenance time and costs and reduce the chance of faults and failures.[9]
- Limit or risk
- Those are stated aims, not measured results. For devices that affect the physical world, safety and reliability needs can clash with common cybersecurity practice.[12]
ITU lists intelligent transportation systems, smart grid, e-health and smart home as examples of IoT application areas.[1] The table gives the examples we could support with sources we read.
| Area | Example use | What the sources say | Limits |
|---|---|---|---|
| Healthcare | Remote monitoring of a patient’s body measurements. | The FDA describes non-invasive remote monitoring devices as used to acquire patient physiological data without in-clinic visits, and to support patient management while reducing the need for in-office or in-hospital services.[7] | US regulator document. Not every consumer wearable is a medical device. |
| Manufacturing | Watching equipment for signs of wear or failure. | NIST describes using sensor readings to assess equipment health, predict remaining useful life and diagnose failures. Its roadmap says this kind of monitoring can reduce maintenance time and costs.[9] | Describes aims and design, not measured results. |
| Agriculture | Precision farming, such as guidance systems for planting and fertiliser. | FAO calls precision agriculture an example of IoT in agriculture, and says such systems can lead to savings in seed, fertiliser and tractor fuel.[11] | A 2019 briefing paper that describes possibilities. |
| Transport | Intelligent transport systems. | ITU lists intelligent transportation systems among IoT application areas.[1] | We reviewed no source with details on transport, so this page does not describe it further. |
| Homes | Connected locks, alarms, cameras, speakers and appliances. | The ETSI standard lists connected smoke detectors, door locks, baby monitors, smart cameras, TVs, speakers, home-automation hubs and appliances as consumer IoT devices.[6] ITU also lists smart home as an application area.[1] | Consumer products vary widely in quality. |
What are the benefits and opportunities?
The sources describe these as possibilities or aims. What a particular deployment achieves depends on how it is designed and run.
- Monitoring without being there. Remote monitoring devices can acquire patient data without in-clinic visits.[7]
- Better-informed maintenance. NIST says monitoring of equipment health can reduce the time and cost of maintenance and reduce the potential for faults and failures.[9]
- Resource savings in farming. FAO says precision agriculture can lead to savings in seed, fertiliser and fuel, and that variable-rate technologies and drones can reduce water and pesticide use.[11]
- Easier compatibility. Matter aims to make products from different brands work together.[3]
- Shared platforms for new services. ITU notes that IoT applications can be built on common support platforms that provide generic capabilities such as authentication and device management.[1]
What are the main challenges?
| Challenge | Why it arises | What the sources say |
|---|---|---|
| Security | Every connected thing is a possible way in for an attacker. | ITU states that because every “thing” is connected, there are significant security threats to the confidentiality, authenticity and integrity of data and services.[1] NIST sets a goal of preventing a device from being used to conduct attacks, such as distributed denial-of-service attacks, or to eavesdrop on network traffic.[12] ETSI requires that, where passwords are used, consumer IoT device passwords are unique per device or defined by the user.[6] |
| Privacy | Devices can collect data about people and their surroundings. | NIST names protecting data security and protecting individuals’ privacy, where personal information is processed, as two of its three risk-mitigation goals.[12] |
| Interoperability | Devices come from different makers with different hardware and networks. | ITU describes IoT devices as heterogeneous, built on different hardware platforms and networks.[1] The Matter standard aims to let products from different brands work together.[3] |
| Reliability and safety | Some devices change the physical world, so a failure can have physical effects. | NIST notes that many IoT devices affect the physical world in ways conventional IT devices usually do not, and that needs for performance, reliability, resilience and safety may conflict with common cybersecurity practices.[12] |
| Maintenance and updates | There can be very many devices, and they cannot always be managed like computers. | NIST says many IoT devices cannot be accessed, managed or monitored in the same ways as conventional IT, which can mean doing tasks manually for large numbers of devices.[12] ETSI says all software in consumer IoT devices should be securely updateable, while noting that not all software can be, for example a boot loader written once to storage.[6] |
| Energy and cost | Many devices must be cheap and run on batteries. | For “massive machine type communications”, ITU-R describes a very large number of connected devices that send small amounts of data, and requires devices to be low cost with a very long battery life.[4] |
An example of regulation: the UK
The UK’s product security regime for consumer connectable products came into effect on 29 April 2024. It requires manufacturers to ban universal default passwords and easily guessable ones, to publish how to report security issues, and to publish the minimum period for which security updates will be provided. Manufacturers, importers and distributors must comply, and some products are excluded, including electric-vehicle charge points, medical devices and smart meter products.[10]
This is one country’s rules, and rules differ elsewhere and change over time. This page is not legal advice, so check the current official guidance for your situation.
Our interpretation: the energy row describes a design target for large numbers of simple devices, not the total energy use of IoT systems. We reviewed no source on total energy use, so this page makes no claim about it.
Could widespread IoT disrupt whole industries?
Forecast Possibly, but the evidence reviewed here describes expectations, not measured economy-wide results. When it was written in 2012, ITU’s standard expected the number of managed and communicating devices to be at least an order of magnitude larger than those connected to the internet then, and expected device-triggered communication to rise noticeably compared with human-triggered communication.[1] The same document describes IoT as a vision with technological and societal implications.[1]
The sector sources are also about potential: NIST describes the aims of equipment-health monitoring,[9] and FAO describes savings that precision agriculture can make possible, as well as weak infrastructure, high technology costs and low digital skills that risk leaving rural areas behind.[11]
Our interpretation: industries that depend on keeping track of physical equipment or conditions, such as manufacturing maintenance and farming, are where changes look most plausible. History also suggests that effects can arrive slowly and unevenly, as we discuss on the Emerging Technologies page.
Common questions
Is a smartphone an IoT device?
It can be. ITU lists smartphones, home electrical appliances and industrial machines as examples of general devices for IoT application areas.[1]
Does the IoT always use the internet?
Not necessarily the public internet. The ETSI standard covers consumer devices that connect to network infrastructure such as the internet or a home network.[6]
Is the IoT the same as 5G?
No. The IoT is about connecting things and the services built on their data. 5G is a family of mobile network technologies that can carry such data. ITU-R’s vision document for mobile systems for 2020 and beyond includes a use case, “massive machine type communications”, for very large numbers of low-cost, long-battery-life devices sending small amounts of data.[4] Other networks are used too: the first Matter release, for example, ran over Ethernet, Wi-Fi and Thread.[3] Our 5G and Beyond page covers 5G in its own right.
What should I look for when buying a connected device?
The standards point to three questions. Does the device avoid a shared default password?[6] Does the maker say how to report a security problem, and how long it will provide security updates?[10] Can the software be updated securely?[6] In the UK, in-scope products must come with information on how to report security issues and on the minimum security update period.[10]
References
Each source is listed in the order it is first cited. The note under each one says what it supports and how it was checked. Where only an abstract or summary page was read, the note says so.
- Overview of the Internet of things (Recommendation ITU-T Y.2060, renumbered Y.4000 in 2016). International Telecommunication Union. approved 15 June 2012.Supports: the definitions of IoT, “thing” and “device”; the four-layer reference model; the listed application areas; the characteristics and security requirement; and the 2012 expectation about scale. Checked against the full text (PDF).
- Networks of ‘Things’ (NIST Special Publication 800-183). Jeffrey Voas, National Institute of Standards and Technology. July 2016.Supports: IoT described as involving sensing, computing, communication and actuation, and the five building blocks (“primitives”) of a network of things. Checked against the full text.
- Matter arrives, bringing a more interoperable, simple and secure Internet of Things to life. Connectivity Standards Alliance (press release). 4 October 2022.Supports: what Matter aims to do and the networks the first release ran over. This is the standards body’s own announcement, so it shows intent, not independent evidence of results.
- IMT Vision: framework and overall objectives of the future development of IMT for 2020 and beyond (Recommendation ITU-R M.2083-0). International Telecommunication Union. September 2015.Supports: the “massive machine type communications” use case (many low-cost, long-battery-life devices sending small amounts of data). Checked against the full text (PDF).
- Fog Computing Conceptual Model (NIST Special Publication 500-325). Michaela Iorga, Larry Feldman, Robert Barton, Michael J. Martin, Nedim Goren and Charif Mahmoudi, National Institute of Standards and Technology. March 2018.Supports: the description of fog and edge computing as processing placed close to or between end devices and centralised cloud services (including local computing capability on a sensor), and the authors’ remark that no consensus exists on the distinctions between edge, fog and related terms. Checked against the full text (PDF).
- Cyber Security for Consumer Internet of Things: Baseline Requirements (ETSI EN 303 645 V2.1.1). ETSI (European Telecommunications Standards Institute). June 2020.Supports: the scope and examples of consumer IoT devices, and the provisions on default passwords, vulnerability reporting and software updates. Checked against the full text (PDF).
- Enforcement Policy for Non-Invasive Remote Monitoring Devices Used to Support Patient Monitoring: Guidance for Industry and FDA Staff. U.S. Food and Drug Administration. 19 October 2023.Supports: the description of remote patient-monitoring devices. US-specific. Checked against the full text (PDF).
- Cybersecurity (medical devices). U.S. Food and Drug Administration, Digital Health Center of Excellence. page checked 27 October 2026.Supports: the statement that connecting medical devices can improve care but adds cybersecurity risk. Checked against the page.
- Measurement Science Roadmap for Prognostics and Health Management for Smart Manufacturing Systems (NIST AMS 100-2). Joan Pellegrino, Mauricio Justiniano and Anand Raghunathan (Energetics), prepared for NIST. September 2016.Supports: how sensor readings are used to monitor equipment health, and the stated aims of this kind of monitoring. These are aims and descriptions, not measured results. Checked against the full text (PDF).
- Regulations: consumer connectable product security. GOV.UK (UK Government guidance). published 8 January 2024, last updated 17 March 2025.Supports: the UK requirements, the 29 April 2024 start date, who must comply, and the exclusions. UK-specific; rules differ elsewhere and may change. Checked against the guidance page.
- Digital technologies in agriculture and rural areas: briefing paper. Nikola M. Trendov, Samuel Varas and Meng Zeng, Food and Agriculture Organization of the United Nations. 2019.Supports: precision agriculture as an IoT application, the resource savings it says are possible, and the barriers in rural areas. A briefing paper, so it describes possibilities. Checked against the full text (PDF).
- Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks (NIST IR 8228). Katie Boeckl and colleagues, National Institute of Standards and Technology. June 2019.Supports: the three considerations that make IoT risk different from conventional IT, and the three risk-mitigation goals. Checked against the full text.