What is the Internet of Things (IoT)?
The Internet of Things (IoT) is a network of physical devices embedded with sensors, microcontrollers, and wireless connectivity that collect, process, and exchange data without human intervention. An IoT system typically consists of four layers: the device layer (sensors + MCU), the connectivity layer (wireless protocol), the platform layer (cloud/edge processing), and the application layer (dashboards, alerts, automation).
As of early 2026, there are an estimated 21.2 billion IoT connections globally (IoT Analytics), with the fastest growth in industrial IoT (IIoT), smart energy, and connected health. The EU Cyber Resilience Act deadline (December 2027) is now accelerating a wave of IoT hardware redesigns across every sector.
How Does an IoT Device Actually Work?
At the hardware level, a typical IoT sensor node consists of:
- Sensor(s) — Temperature (±0.1°C, e.g., TI TMP117), humidity, pressure, motion, light, or application-specific transducers
- Microcontroller — Low-power processor (e.g., STM32U5 at 160 MHz, 110 nA in shutdown mode) that reads sensor data, runs local logic, and manages power
- Wireless module — BLE, LoRaWAN, NB-IoT, Wi-Fi, or Thread radio for data transmission
- Power source — Battery (CR2032, 2×AAA, LiPo), energy harvesting (solar, thermal), or wired power
- Secure Element — Dedicated tamper-resistant IC (e.g., Infineon OPTIGA Trust M, NXP SE050) for hardware-rooted key storage — one of the measures a CRA risk assessment may lead to; the regulation does not prescribe it
The MCU wakes periodically (e.g., every 15 minutes), reads sensor data, optionally runs local processing (thresholds, filtering, on-device ML inference), transmits a compact data packet (typically 10–50 bytes), and returns to deep sleep to conserve power.
Choosing the Right Connectivity Protocol
The choice of wireless protocol is the most consequential architecture decision in IoT design:
| Protocol | Range | Data Rate | Power | Battery Life | Monthly Cost | Best For |
|---|---|---|---|---|---|---|
| BLE 5.4 | 100 m | 2 Mbps | Ultra-low | 2–5 years | €0 (no subscription) | Wearables, proximity, asset tags |
| LoRaWAN | 2–15 km | 0.3–50 kbps | Very low | 5–10 years | €0.5–2/device | Environmental monitoring, agriculture, metering |
| NB-IoT | Cellular | 250 kbps | Low | 3–5 years | €1–5/device | Wide-area tracking, remote assets |
| LTE-M | Cellular | 1 Mbps | Low–Medium | 2–4 years | €2–5/device | Mobile assets, voice, higher throughput |
| Wi-Fi 6E/7 | 50 m | 2.4–46 Gbps | Medium–High | Wired/short | €0 | Cameras, gateways, high-bandwidth |
| Thread/Matter 1.3 | 30 m mesh | 250 kbps | Low | 2–5 years | €0 | Smart home, building automation |
| 5G RedCap (Rel-17) | Cellular | 150 Mbps | Medium | 1–3 years | €5–10/device | Industrial IoT, video, AR |
| DECT NR+ (NR+) | 1–5 km mesh | 3 Mbps | Low | 3–7 years | €0 | Smart metering, building infrastructure |
Rule of thumb: If you need multi-kilometer range with battery life >5 years, choose LoRaWAN. If you need cellular coverage without deploying infrastructure, choose NB-IoT or LTE-M. If you need high bandwidth and have power available, choose Wi-Fi 6E/7. New in 2026: DECT NR+ is gaining traction for license-free mesh deployments in the 1.9 GHz band — especially for smart metering and building infrastructure across the EU.
IoT Application Protocols
Once data reaches a gateway or cloud endpoint, application-layer protocols handle message routing:
- MQTT 5.0 (Message Queuing Telemetry Transport) — Publish/subscribe pattern, lightweight (2-byte header), with v5.0 adding shared subscriptions, message expiry, and topic aliases. Used by AWS IoT Core, Azure IoT Hub, and most IoT platforms
- CoAP (Constrained Application Protocol) — REST-like request/response over UDP, designed for extremely constrained devices and lossy networks. Gaining relevance in LPWAN deployments
- LwM2M 1.2 (Lightweight M2M) — OMA standard for device management, firmware OTA, and telemetry on resource-constrained devices. Version 1.2 adds MQTT transport and composite operations
- HTTP/REST — Standard web APIs for unconstrained gateways and edge devices with sufficient resources
- Sparkplug B — MQTT-based specification for industrial IoT, providing standardized topic namespaces and payload encoding for SCADA/MES integration
What Industries Benefit Most?
| Industry | IoT Application | Typical ROI |
|---|---|---|
| Smart Buildings | Occupancy sensing, HVAC optimization, energy monitoring, ESG reporting | 15–30% energy cost reduction |
| Agriculture | Soil moisture, weather stations, irrigation automation, livestock tracking | 20–40% water savings |
| Logistics | Asset tracking, cold chain monitoring, fleet telematics, customs digitization | 10–25% fuel savings, 99.5% shipment visibility |
| Manufacturing (IIoT) | Predictive maintenance, OEE monitoring, quality inspection, digital twins | 15–30% reduction in unplanned downtime |
| Smart Cities | Waste bin fill level, parking occupancy, air quality, noise mapping | 30–50% collection cost reduction |
| Healthcare | Remote patient monitoring, asset tracking, environmental compliance | Reduced readmissions, regulatory compliance |
| Energy & Utilities | Smart metering, grid edge intelligence, EV charging management | 10–20% demand response improvement |
IoT Security: The Non-Negotiable Layer
IoT security is a regulatory requirement, not an option. The EU Cyber Resilience Act (Regulation (EU) 2024/2847) places essential cybersecurity requirements on manufacturers of products with digital elements from 11 December 2027. It does not prescribe specific technologies; measures are selected from the cybersecurity risk assessment. For connected devices this typically means:
- Secure boot — Cryptographic verification of firmware at every startup
- Authenticated OTA updates — Signed firmware packages with rollback protection
- Unique device identity — Per-device credentials provisioned during manufacturing, no shared secrets or default passwords
- Vulnerability handling — Documented process for handling and disclosing security vulnerabilities during the support period (at least five years, unless the product is expected to be in use for a shorter time)
- Software Bill of Materials (SBOM) — Machine-readable inventory of software components covering at least the top-level dependencies, required by Annex I
Hardware-rooted security (Secure Elements like NXP SE050, Infineon OPTIGA Trust M, Microchip ATECC608B) provides tamper-resistant key storage that software-only solutions cannot match. For a comprehensive guide to hardware security implementation, see our Hardware Security Deep-Dive.
The Scale of IoT in 2026
The numbers continue to grow: IoT Analytics projects 32+ billion connected devices by 2028. But raw device count is less important than the data these devices generate. A single industrial sensor transmitting a 20-byte packet every 10 seconds generates 63 MB/year — multiply by thousands of sensors, and the data management challenge becomes clear.
This is why edge computing and Edge AI are becoming essential: processing data locally reduces bandwidth, latency, and cloud costs, while improving privacy and reliability. In 2026, an increasing share of IoT nodes run on-device ML inference — enabled by MCUs like the STM32N6 with dedicated NPU accelerators, delivering sub-millisecond classification without cloud dependency.
Our IoT Project Management Approach
Inovasense manages IoT hardware projects from concept through production — coordinating specialized EU-based engineering partners for sensor selection, PCB design, firmware development, cloud integration, and CE/CRA certification. Our NB-IoT Postbox Sensor deployed across European postal networks is one example of end-to-end project delivery. Contact us to discuss your IoT project.
Sources & Official References
- Cyber Resilience Act — Regulation (EU) 2024/2847 — EUR-Lex (Official Journal of the EU)
Frequently Asked Questions
What is an IoT device?
An IoT device is a physical object containing sensors (or actuators), a microcontroller, and wireless connectivity that exchanges data over a network without continuous human interaction. Typical components: a sensor (temperature, motion, GPS), an MCU or SoC for processing, a radio (Wi-Fi, BLE, LoRaWAN, cellular), and a power source. Globally, 21.2 billion IoT devices are connected as of 2026.
How does IoT connectivity work?
An IoT system has four layers. Device layer: sensor + MCU + radio. Connectivity layer: wireless protocol (Wi-Fi, BLE, Zigbee, LoRaWAN, NB-IoT, 5G). Platform layer: cloud or edge processing (AWS IoT, Azure IoT Hub, local edge gateways). Application layer: dashboards, alerts, automation logic. Data flows from sensor reading → MCU pre-processing → radio transmission → cloud ingestion → application response.
What's the difference between LoRaWAN, NB-IoT, and BLE?
BLE is short-range (10–100m), high data rate (~1 Mbps), low power, designed for personal-area networks like wearables. LoRaWAN is long-range (2–15 km), low data rate (~50 kbps), ultra-low power, designed for battery-powered sensors with multi-year life — agricultural, smart-city, asset tracking. NB-IoT is long-range cellular (km), low data rate (~250 kbps), uses licensed spectrum, suitable for metering and applications needing carrier QoS guarantees.
What is MQTT and why is it the standard for IoT?
MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe messaging protocol designed for unreliable, bandwidth-constrained networks. It runs over TCP/IP, supports three Quality-of-Service levels (at-most-once, at-least-once, exactly-once), and has minimal overhead (2-byte header). MQTT became the de facto IoT protocol because it works on devices with as little as 16 KB RAM and tolerates intermittent connectivity.
How many IoT devices are connected globally?
As of early 2026, IoT Analytics estimates 21.2 billion active IoT connections globally — more than double the 2020 count. Fastest-growing segments: industrial IoT (factories, predictive maintenance), smart energy (grid meters, EV charging), connected health (patient monitoring, wearables), and asset tracking (logistics, fleet management). EU adoption is accelerating ahead of the December 2027 CRA deadline.
Is IoT secure?
Modern IoT is more secure than its 2015–2020 reputation, but only when implemented with hardware-level security: secure boot anchored in silicon, hardware-protected key storage (Secure Element or TPM), authenticated firmware updates, and encrypted communications (TLS 1.3). The EU Cyber Resilience Act sets essential cybersecurity requirements for products with digital elements from 11 December 2027; it is technology-neutral, so such measures are selected from the product's risk assessment rather than prescribed. Insecure IoT devices face market withdrawal and fines up to €15M.
What does the EU Cyber Resilience Act mean for IoT products?
Regulation (EU) 2024/2847 sets essential cybersecurity requirements for products with digital elements; most obligations apply from 11 December 2027. The requirements are outcome-based and technology-neutral: measures such as a secure default configuration or authenticated updates are selected from the risk assessment. The support period is at least five years unless the product is expected to be in use for a shorter time. Actively exploited vulnerabilities and severe incidents must be reported from 11 September 2026, with an early warning within 24 hours. The manufacturer keeps a software bill of materials and technical documentation for conformity assessment. Infringements of the essential requirements and of Articles 13 and 14 can be fined up to €15 million or 2.5% of total worldwide annual turnover.
Should I use Wi-Fi or LoRaWAN for my IoT product?
Choose Wi-Fi when devices have continuous power, are near existing infrastructure, and need high bandwidth (video, image upload). Choose LoRaWAN when devices run on batteries for years, are deployed across kilometers (farms, cities), and transmit small payloads (sensor readings, GPS coordinates) infrequently. Many products combine both: Wi-Fi for gateways, LoRaWAN for distributed sensors.