What is an IoT device? Parts, examples and how they connect

An IoT device is a physical object that senses or changes something in the real world and is connected to a network, so it can send what it measures and receive commands without a person sitting in front of it. The name comes from the Internet of Things, the idea of ordinary objects joining the network alongside computers and phones. A temperature sensor that reports every few minutes, a smart plug you switch from an app and a pump controller in a factory are all IoT devices. This article gives a working definition, takes one apart, lists examples in different settings, explains how IoT devices connect and how they differ from a computer or phone, and sets out the risks that come with them.

What is an IoT device: a working definition

Three things together make a device part of the Internet of Things.

It deals with the physical world. It measures something, such as temperature, motion, light, current or position, or it acts on something by switching a relay, turning a motor or opening a valve. Many devices do both.

It is connected. It sends data to, or takes instructions from, a service somewhere else: an app, a hub in the house, a server on a factory floor or a cloud platform. The connection might be Wi-Fi, a low-power radio, a cellular modem or a cable.

It runs largely unattended. It does one job, repeatedly, for years, with no keyboard or screen and nobody operating it. People see the results in an app or dashboard, but the device itself just gets on with its task.

“IoT devices”, in the plural, usually means the whole category: sensors, actuators, gateways and the smart products built from them. The meaning is the same whether the device sits in a kitchen or on an oil pipeline.

The parts of an IoT device

Open almost any IoT device and you find the same six parts, even when they share one chip.

The sensor or actuator is the part that touches the world. A sensor turns a physical quantity into an electrical signal; an actuator does the reverse, turning a signal into movement, heat, light or a switched circuit. The IoT sensors guide covers the common types and what each one measures.

The microcontroller is the small computer that reads the sensor, decides what to do and drives the actuator. It has its processor, memory and storage on one chip, draws little power and can sleep between tasks. Larger devices such as cameras and gateways often use a more powerful processor running Linux instead. The microcontroller comparison looks at the boards most people start with, and the ESP32-C6 guide covers a newer chip built around smart home radios.

The radio or network interface connects the device. It might be Wi-Fi, Bluetooth Low Energy, Zigbee or Thread, LoRa, a cellular modem, or wired Ethernet. The choice of radio decides much of the rest of the design, because it sets how far the device can reach, how much data it can send and how much power it uses.

Power comes from mains, a battery or harvested energy such as a small solar cell. On a battery device the power budget governs everything else: how often it wakes, how long its radio stays on and how many readings it can send. Some devices have no battery at all and run only on harvested energy; the ambient IoT guide explains how they manage.

Firmware is the software that runs on the microcontroller. It holds the logic, the network code and the device’s identity and security keys, and on a well-designed device it can be updated over the network.

The service is the part outside the box: a cloud platform, a local hub or an on-site server that receives the data, stores it, runs rules and sends commands back. For most IoT devices the service is what makes the device useful, and a device whose service is switched off often stops working.

Examples of IoT devices

The same anatomy turns up in very different places. What changes is what the device measures, how far it has to reach and how long it has to last.

A few things in the table are worth drawing out. Home devices mostly sit within reach of Wi-Fi or a hub, so they use short-range radios. City and farm devices are spread over kilometers and run on batteries for years, which pushes them toward long-range, low-power networks. Industrial devices often connect to machines that already have their own networks, and a gateway bridges the two.

How an IoT device differs from a computer or a phone

A laptop or phone is a general-purpose computer. You install whatever apps you like, you sit in front of it, and it has a screen, a keyboard and a large battery that you charge every day. An IoT device is built for one task, and the differences follow from that.

It runs fixed firmware for a single purpose. You cannot install new software on a smart plug, and the manufacturer decides what it does.

It has no screen or keyboard, or a very small one. You interact with it through an app, a hub or its own physical button.

It is constrained. A typical sensor has a microcontroller with kilobytes of memory, a radio chosen for low power and a battery expected to last months or years.

It lives a long time with nobody watching. A meter or thermostat may stay on the wall for ten years or more, and its owner rarely thinks about updating it.

The boundary is not sharp. Smart speakers, smart TVs and connected cars contain full computers but behave like IoT devices in the ways that matter: one main purpose, managed by the manufacturer, and connected all the time. Many people count them as IoT devices, and for security purposes they should be treated as such.

How IoT devices connect

There are two basic routes from an IoT device to the service it reports to.

The direct route suits devices with an IP-capable radio. A Wi-Fi or Ethernet device joins the local network and talks to its service over the internet. A cellular device, including those on the low-power NB-IoT and LTE-M networks, connects straight to a mobile network. In both cases the device speaks an internet protocol itself, usually MQTT or HTTPS, sometimes CoAP.

The gateway route suits devices whose radio is too small or too low-power to reach the internet on its own. Zigbee, Bluetooth Low Energy and LoRaWAN devices send their readings to a hub or gateway nearby, and the gateway forwards them over the home or site network. Thread is a middle case: it carries IP, but it still needs a border router to reach the rest of the network. The gateway often does more than pass messages along: it can translate protocols, filter or combine readings, and keep working locally if the internet connection drops.

Which route a device uses depends on its radio, and the radio depends on its range, data and power needs. The IoT protocols explainer lays out the radios and the messaging protocols above them as one stack.

The risks of IoT devices

The features that make IoT devices useful also make them a risk. They are connected all the time, they run for years and nobody watches them.

Security is the first concern. Devices have shipped with default passwords, open network services and unencrypted traffic, and a compromised device can be used to spy on its owner, reach other machines on the same network or join attacks on other systems. Putting IoT devices on their own network segment limits the damage one weak device can do.

Updates are the second. Firmware has flaws like any software, and a device that cannot be updated keeps them for life. A good device checks for updates, installs them automatically and verifies they came from the manufacturer.

End of support is the third. Manufacturers stop issuing updates after a while, and some shut down the cloud service a device depends on, which can leave it unpatched or stop it working entirely. Some countries, the UK among them, now require manufacturers to state how long a device will receive security updates, and that period is worth checking before you buy. Devices that can work with a local hub are less exposed to a service shutting down.

The IoT device security basics article covers these risks in more depth, with the checks to run on any device before it goes on your network.