What Is IoT? How the Internet of Things Works

What is IoT? The Internet of Things connects physical objects with digital systems so they can collect information, communicate, process data and, in some cases, trigger actions.

Connected technology is now used across homes, factories, buildings, transportation, agriculture, utilities and many other environments. A temperature sensor can monitor a room, an industrial machine can report its condition, and a tracking device can provide information about the location of an asset.

These examples share the same basic idea: physical objects interact with software, networks and data-processing systems.

Security should also be considered throughout the lifecycle of connected products. The NIST Cybersecurity for IoT Program provides guidance for manufacturers and organizations working with connected products.

Interoperability is another important consideration. The W3C Web of Things initiative explores standards that can make it easier for connected systems and applications to work together.

This guide explains how the Internet of Things works, its architecture, sensors, gateways, connectivity, edge and cloud computing, real-world applications, business benefits, cybersecurity considerations and future developments.

Understanding the Internet of Things

The Internet of Things describes physical objects that contain computing capabilities and can exchange information with other digital systems.

These connected objects may include:

• Environmental sensors
• Smart meters
• Wearable devices
• Industrial machines
• Building-management equipment
• Vehicles
• Asset trackers
• Agricultural sensors
• Connected appliances

What makes these systems especially useful is their connection with the physical world.

A sensor can observe a condition. An actuator can influence a physical process. Software can then analyze the information and help people or automated systems decide what should happen next.

Simple definition: The Internet of Things connects physical objects with digital systems so they can collect information, communicate and support useful decisions or automated actions.

What Does IoT Stand For?

IoT stands for Internet of Things.

The word “things” generally refers to physical objects with digital capabilities. A thing could be a simple battery-powered sensor, a connected vehicle, a production machine or an entire building-management system.

Not every connected object needs a direct connection to the public internet. Some communicate through local networks, private infrastructure, gateways or edge platforms before information reaches a cloud or enterprise application.

Device, Product and System: What Is the Difference?

Connected device

A connected device is the physical computing component that interacts with its environment and communicates with other systems.

It might contain:

• Sensors
• Actuators
• A processor
• Memory
• Firmware
• A network interface

Connected product

The complete product can be much larger than the physical device.

It may also depend on:

• A gateway
• A mobile application
• A web portal
• A cloud platform
• Backend services
• Data analytics

This distinction matters because reliability and cybersecurity must be evaluated across the complete product, not only the physical hardware.

Connected system

A complete system brings multiple components together to achieve an operational or business objective.

For example:

Sensor → Network → Gateway → Platform → Analytics → Application → Action

How Does the Internet of Things Work?

Most connected systems follow a repeating information cycle.

A simple model is:

Sense → Connect → Process → Analyze → Decide → Act → Monitor

1. Sensors observe the physical world

Sensors convert physical conditions into information that computing systems can process.

Depending on the application, sensors may measure:

• Temperature
• Humidity
• Pressure
• Motion
• Location
• Light
• Vibration
• Energy consumption
• Equipment status

2. The device processes information

Embedded electronics can perform basic processing before information leaves the device.

For example, a sensor could calculate an average locally rather than transmitting every individual measurement.

3. Connectivity carries the information

The device can communicate using wired or wireless networking.

Possible technologies include:

• Ethernet
• Wi-Fi
• Bluetooth
• Cellular networks
• Low-power wide-area networks
• Satellite connectivity

4. Data is processed

Processing can happen in several places:

• Inside the device
• At a local gateway
• On an edge platform
• In a data center
• In the cloud

Many architectures combine several processing locations.

5. Applications analyze the information

Software can transform raw measurements into useful information by identifying:

• Current conditions
• Changes over time
• Patterns
• Anomalies
• Events that require attention

6. A decision is made

A person, business application or automated system can use the information to determine what should happen next.

7. The system acts

Where appropriate, an actuator can convert a digital command into a physical action.

This could involve adjusting lighting, controlling a valve, changing temperature settings or operating equipment according to authorized policies.

Sensors and Actuators

Sensors and actuators create the bridge between physical and digital environments.

What is a sensor?

A sensor detects a physical condition and transforms it into information that software can process.

Examples include temperature, pressure, motion, proximity, vibration, humidity and light sensors.

What is an actuator?

An actuator works in the opposite direction. It receives a command from a control system and produces a physical effect.

Actuators can operate:

• Motors
• Valves
• Switches
• Locks
• Lights
• Heating and cooling systems

Combining sensing and actuation creates feedback loops between physical environments and digital applications.

Architecture Explained

There is no single universal architecture for connected systems.

However, a useful reference model is:

Physical Device → Connectivity → Gateway/Edge → Platform → Data & Analytics → Application

Physical layer

The physical layer contains devices, sensors, actuators and embedded computing.

Connectivity layer

This layer transports information between physical devices and other components.

Gateway and edge layer

Gateways and edge systems can:

• Aggregate device information
• Translate communication protocols
• Filter unnecessary data
• Perform local calculations
• Support local operation
• Apply appropriate security controls

Platform layer

A connected-device platform can provide common services such as:

• Device registration
• Authentication
• Configuration
• Messaging
• Data ingestion
• Monitoring
• Application integration

Data and analytics layer

This layer transforms measurements into information that applications and organizations can use.

Capabilities can include:

• Data storage
• Stream processing
• Visualization
• Analytics
• Machine learning

Application layer

Applications present information and capabilities to people or other business systems.

Examples include:

• Monitoring dashboards
• Asset-management applications
• Maintenance platforms
• Energy-management systems
• Mobile applications

The Role of Gateways

A gateway sits between connected devices and other parts of the architecture.

Gateways can be particularly useful when devices cannot or should not communicate directly with cloud services.

A gateway may:

• Aggregate information
• Translate protocols
• Apply local processing
• Filter traffic
• Enforce network policies
• Connect local networks to remote services

Connectivity Technologies

Choosing the right network technology is a fundamental architecture decision.

The appropriate choice depends on:

• Distance
• Bandwidth
• Latency
• Mobility
• Battery life
• Coverage
• Reliability
• Security
• Cost

Ethernet

Ethernet provides wired connectivity and can be suitable for fixed equipment where cabling is practical.

Wi-Fi

Wi-Fi provides local wireless connectivity and is widely available in homes, offices and other buildings.

Bluetooth

Bluetooth, including Bluetooth Low Energy, is commonly used for short-range communication and devices where power consumption is important.

Cellular connectivity

Mobile networks provide wide-area connectivity for distributed and mobile devices.

Technologies such as LTE-M and NB-IoT were developed for use cases that require combinations of wide coverage, relatively low device power consumption and modest data requirements.

The GSMA Internet of Things resources provide additional industry information about cellular connectivity for connected devices.

Low-power wide-area networking

LPWAN technologies are designed for use cases that need relatively small data transmissions over long distances while keeping power consumption low.

Communication Protocols

Network connectivity determines how devices reach other systems, while application protocols determine how information is exchanged.

Common protocol families include:

• MQTT
• HTTP and HTTPS
• CoAP
• AMQP

The right protocol depends on device capabilities, bandwidth, latency, reliability, architecture and security requirements.

Edge Computing

Edge computing processes information closer to the location where it is generated.

Rather than sending every measurement to a remote platform, an edge system can analyze selected data locally.

Potential advantages include:

• Lower response time
• Reduced network traffic
• Local decision-making
• Better resilience during connectivity interruptions
• Greater control over which data leaves a site

Edge computing does not necessarily replace cloud computing. Many modern architectures, including distributed Telco Cloud infrastructure, use both.

Edge vs Cloud Computing

Factor	Edge Computing	Cloud Computing
Processing location	Close to devices	Remote infrastructure
Response time	Potentially very low	Depends partly on connectivity
Large-scale analytics	More limited locally	Well suited
Local operation	Can continue without constant cloud access	Typically depends on connectivity
Cross-site analysis	Usually limited	Useful for aggregating many locations

A common hybrid design is:

Device → Edge Processing → Cloud Analytics → Business Application

Connected-Device Platforms

A platform provides shared services for managing devices, data and applications.

Capabilities may include:

• Device onboarding
• Identity management
• Authentication
• Configuration
• Software management
• Data ingestion
• Messaging
• Rules engines
• APIs
• Analytics
• Monitoring

Platforms help organizations avoid rebuilding these common capabilities separately for every application.

The Data Lifecycle

A useful model for connected-device information is:

Generate → Collect → Transmit → Process → Store → Analyze → Act → Retain/Delete

Every stage introduces decisions around architecture, cost, security, privacy and governance.

Organizations should therefore collect information because it serves a defined purpose, not simply because a sensor can generate it.

Consumer, Enterprise and Industrial Applications

Consumer applications

Connected consumer products can include:

• Smart-home equipment
• Wearable devices
• Home-energy systems
• Connected appliances

Enterprise applications

Businesses can use connected technology for:

• Building management
• Asset tracking
• Environmental monitoring
• Energy optimization
• Remote equipment monitoring

Industrial applications

Industrial environments use connected sensors and control systems to improve visibility into physical operations.

Applications include:

• Equipment monitoring
• Predictive maintenance
• Production visibility
• Quality monitoring
• Energy management

Real-World Examples and Use Cases

Smart homes

Connected thermostats, lighting, environmental sensors and energy systems can help households monitor and control their environment.

Smart buildings

Commercial buildings can monitor:

• Occupancy
• Temperature
• Air quality
• Lighting
• Energy consumption
• Equipment condition

Manufacturing

Manufacturers can collect equipment information to improve:

• Maintenance planning
• Production visibility
• Asset utilization
• Energy management
• Quality monitoring

Logistics

Connected tracking technologies can provide information about:

• Asset location
• Shipment conditions
• Fleet operations
• Warehouse environments

Agriculture

Connected sensors can help farmers monitor conditions such as soil moisture, temperature, equipment status and water use.

Healthcare

Connected medical and monitoring devices can support selected healthcare applications.

Because these environments can involve sensitive information and safety-critical processes, privacy, reliability and cybersecurity require particular attention.

Energy and utilities

Connected infrastructure can support smart metering, equipment monitoring, energy management and operational visibility.

Smart cities

Cities can use connected infrastructure for applications such as environmental monitoring, traffic management, lighting and public infrastructure management.

Predictive Maintenance

Predictive maintenance is an important industrial application.

The basic model is:

Equipment → Sensors → Operational Data → Analytics → Maintenance Insight

Rather than relying only on fixed maintenance schedules, organizations can use equipment information to identify changes that may indicate a developing problem.

This can improve maintenance planning when sensor data, analytics and operational processes are reliable.

Artificial Intelligence and Connected Devices

Connected devices generate data about physical environments. Artificial intelligence can help analyze that information and identify patterns that may be difficult to detect manually.

A simple relationship is:

Connected Device Senses → AI Analyzes → Application Decides → System Responds

Potential applications include:

• Anomaly detection
• Predictive maintenance
• Computer vision
• Energy optimization
• Operational forecasting
• Automated classification

AI is not required for connected devices, but it can add more advanced analytics to suitable applications.

Automation

Connected systems can also trigger automated workflows.

For example:

Sensor Event → Business Rule → Decision → Authorized Action

This connects physical operations with digital processes.

Automation that affects physical equipment should be designed with appropriate authorization, validation, monitoring and safety controls.

5G and Advanced Connectivity

5G can support some connected-device applications, particularly where cellular coverage, mobility or specific performance characteristics are important.

Potential applications include:

• Industrial environments
• Transportation
• Distributed infrastructure
• Mobile equipment
• Large sensor deployments

However, 5G is not a requirement. Ethernet, Wi-Fi, Bluetooth, other cellular technologies and LPWAN solutions remain appropriate for many deployments.

Connected Technology and Digital Transformation

Connecting physical operations with software and data can support broader digital-transformation initiatives.

Organizations may gain:

• Better operational visibility
• Faster decision-making
• Process automation
• More efficient resource use
• New digital services
• Improved asset management

The business objective should come first. Connecting devices without a clear operational or customer problem rarely creates meaningful value by itself.

Business Benefits

Better visibility

Connected sensors can provide more frequent and detailed information about physical operations.

Remote monitoring

Organizations can monitor distributed assets without requiring continuous physical inspection.

Operational efficiency

Better information can help optimize equipment, energy, maintenance and other resources.

Automation

Physical events can trigger digital workflows and appropriate automated responses.

Predictive insight

Historical and real-time information can support analytics that identify patterns and possible future conditions.

New services

Connected products can create new customer experiences, service models and business opportunities.

Implementation Challenges

Scale

Managing thousands of connected devices is very different from managing a small pilot.

Device diversity

Large environments may contain hardware and software from many vendors.

Interoperability

Different technologies, standards and platforms do not always integrate easily.

Power constraints

Some sensors must operate for long periods using batteries or limited energy sources.

Connectivity limitations

Remote or mobile environments may have inconsistent network availability.

Data management

Large deployments can generate significant quantities of information that must be processed, stored and governed.

Lifecycle management

Connected devices can remain deployed for many years.

Organizations therefore need plans for:

• Inventory
• Configuration
• Software updates
• Monitoring
• Vendor support
• Replacement
• Secure retirement

Cybersecurity and Connected Devices

Cybersecurity is a fundamental part of connected-system architecture because these technologies combine computing, networking and physical processes.

The security boundary can include:

Device → Network → Gateway → Platform → Cloud → Application → Data

Organizations should therefore avoid treating the physical device as the only component that needs protection.

NIST’s IoT Device Cybersecurity Capability Core Baseline provides a useful foundation for identifying cybersecurity capabilities that connected products may need.

Why Security Can Be Challenging

Connected environments can have characteristics that differ from conventional enterprise computing.

Examples include:

• Limited processing resources
• Long deployment lifecycles
• Physical accessibility
• Large device populations
• Multiple network technologies
• Limited user interfaces
• Dependencies on cloud services
• Third-party software and components

Security controls therefore need to match the capabilities and risks of the specific environment.

Core Security Capabilities

Device identification

Organizations should know which devices are connected to their environment and understand their purpose.

Asset visibility is a basic requirement for effective management.

Secure configuration

Configuration changes should be limited to authorized users and systems.

Data protection

Information should receive protection appropriate to its sensitivity and business importance.

Identity and access control

Organizations should consider the identities of:

• Devices
• Users
• Applications
• Services

Authentication and authorization should be appropriate to the risk of the system.

Software updates

Organizations should understand whether connected products can receive updates, how those updates are authenticated and how long the manufacturer intends to provide support.

Security-state awareness

Administrators need sufficient information to understand relevant security events, device condition and unexpected behavior.

Network Segmentation

Connected equipment does not necessarily require unrestricted access to the same resources as employees, servers or critical applications.

A simplified model can be:

Connected Device Zone → Controlled Network Policy → Required Services

Segmentation can help reduce unnecessary communication and limit exposure.

In larger distributed environments, technologies such as SD-WAN may form part of the wider enterprise connectivity architecture, although SD-WAN itself is not a requirement for the Internet of Things.

Zero Trust and Modern Enterprise Security

Organizations operating large distributed environments may also apply identity-aware and policy-driven security approaches.

Secure Access Service Edge (SASE), Zero Trust Network Access and related technologies can be relevant when enterprises need to secure distributed users, sites, cloud applications and selected connected environments.

These technologies should not be presented as mandatory components of every connected-device architecture. Their relevance depends on the enterprise network and security design.

Artificial Intelligence in Security Operations

AI can also help security teams analyze large volumes of telemetry, identify anomalies and prioritize security information.

For a deeper discussion of that topic, see our guide to AI in cybersecurity.

AI does not remove the need for good architecture, access control, patching, monitoring or human oversight.

Privacy and Data Governance

Connected devices can collect information about people, locations, behavior and physical environments.

Organizations should understand:

• Which data is collected
• Why it is collected
• Where it is processed
• Where it is stored
• Who can access it
• How long it is retained
• When it should be deleted

Collecting only the information required for the intended purpose can reduce both privacy and security exposure.

Security Is a Lifecycle

Security should begin before deployment and continue until the product is retired.

A useful lifecycle is:

Design → Procure → Deploy → Configure → Monitor → Update → Maintain → Retire

The NISTIR 8259 series provides guidance for incorporating cybersecurity considerations into the lifecycle of connected products.

How to Plan a Connected-Device Project

1. Define the objective

Start by identifying the operational, customer or business problem that needs to be solved.

2. Identify what needs to be measured or controlled

Determine which physical conditions, events or actions matter to the use case.

3. Select appropriate devices

Evaluate environmental conditions, reliability, power, connectivity, lifecycle and security requirements.

4. Design connectivity

Select networking based on range, bandwidth, latency, mobility, coverage, power consumption and cost.

5. Choose processing locations

Determine which workloads should operate on the device, at the edge or in centralized infrastructure.

6. Build security into the architecture

Define identity, access control, network, data, monitoring and software-management requirements before large-scale deployment.

7. Integrate applications and data

Determine how device information will reach analytics, dashboards and business processes.

8. Run a controlled pilot

Test the architecture before expanding it.

9. Measure outcomes

Verify that the deployment actually improves the intended process.

10. Plan lifecycle operations

Establish how devices will be inventoried, monitored, updated, supported, replaced and retired.

Choosing a Platform

Platform selection should begin with requirements rather than vendor feature lists.

Evaluation criteria can include:

• Device compatibility
• Scale
• Connectivity integration
• Device management
• Security
• APIs
• Data integration
• Edge support
• Monitoring
• Operational cost
• Vendor lifecycle support

Metrics That Matter

Success should be measured by operational or business outcomes rather than simply counting connected devices.

Useful measures can include:

• Device availability
• Connectivity reliability
• Data quality
• Energy consumption
• Asset utilization
• Maintenance performance
• Process efficiency
• Security coverage
• Business value delivered

Common Mistakes

Connecting devices without a clear purpose

Connectivity itself does not create business value.

Sending every measurement to the cloud

Edge processing may be more appropriate for some latency, bandwidth, resilience or privacy requirements.

Ignoring lifecycle management

Devices require ongoing inventory, support, updates and eventually retirement.

Adding security after deployment

Security requirements should influence architecture and product selection from the beginning.

Ignoring interoperability

A small proof of concept can be much easier to manage than thousands of devices from multiple manufacturers.

Collecting unnecessary data

Organizations should know why information is being collected and what value it provides.

Future of the Internet of Things

Connected systems are increasingly converging with edge computing, artificial intelligence, cloud platforms, automation and advanced networking.

More edge intelligence

Greater processing capability near physical devices can support faster local decision-making and reduce unnecessary traffic.

AI-enabled operations

Machine learning can help transform sensor information into predictions, classifications and operational insights.

Greater automation

Physical events can increasingly trigger digital workflows and controlled responses.

Better lifecycle management

Large deployments will require stronger processes for inventory, configuration, software management and retirement.

Security by design

Security will increasingly need to be integrated into product design and lifecycle operations rather than treated as an optional feature added after deployment.

IT and operational technology convergence

Enterprise information systems and operational environments are becoming more interconnected, increasing the need for collaboration across networking, cloud, cybersecurity, engineering and operations teams.

Frequently Asked Questions

What is IoT in simple terms?

The Internet of Things connects physical objects with digital systems so they can collect information, communicate and support useful decisions or actions.

What does IoT mean?

IoT means Internet of Things.

What is an example?

A smart-building temperature sensor that sends measurements to a management platform and helps control heating or cooling is a simple example.

How does it work?

Connected devices use sensors or actuators to interact with the physical world, communicate over networks, process information locally or remotely and connect that information with applications.

Does every device require internet access?

No. Devices can communicate through local networks, gateways or private systems and do not necessarily require a direct connection to the public internet.

What is the difference between the Internet of Things and AI?

The Internet of Things primarily connects physical environments with digital systems. Artificial intelligence analyzes information and performs tasks using models or learned patterns. They can work together but are different technologies.

What is the difference between connected devices and cloud computing?

Connected devices interact with physical environments, while cloud computing supplies remotely delivered computing, storage and application services. Cloud platforms are often one part of a larger connected-device architecture.

What is edge computing?

Edge computing processes information close to the devices or locations where it is generated rather than sending everything to centralized infrastructure.

What is Industrial IoT?

Industrial IoT, often abbreviated IIoT, applies connected sensing, monitoring and control technologies to industrial environments such as manufacturing, utilities and infrastructure.

Is IoT secure?

Security depends on the device, software, configuration, architecture, vendor support and controls used. Risk can be reduced when cybersecurity is integrated throughout design, deployment, operation and retirement.

Does it require 5G?

No. Some applications use 5G, but many rely on Ethernet, Wi-Fi, Bluetooth, other cellular technologies or low-power wide-area networks.

What is AIoT?

AIoT generally refers to combining artificial intelligence with connected-device systems so sensor information can be analyzed using AI techniques.

What are the main components?

A typical architecture includes physical devices, sensors or actuators, connectivity, gateways or edge systems, platforms, data-processing capabilities and applications.

Conclusion

The Internet of Things creates a bridge between physical environments and digital systems.

Sensors observe the physical world, networks transport information, edge and cloud platforms process data, applications turn that information into useful insights, and authorized systems can sometimes trigger physical actions.

A useful summary is:

Physical World → Connected Device → Network → Edge/Cloud → Analytics → Application → Action

Successful deployments require more than simply adding connectivity to equipment. Organizations need to consider business value, architecture, interoperability, network design, data governance, cybersecurity and long-term lifecycle management.

As artificial intelligence, edge computing, automation and advanced connectivity continue to develop, connected technology will play an increasingly important role in linking digital intelligence with real-world operations.

Connected devices can also enrich immersive environments by supplying real-world data and responsive controls. See our guide to extended reality, AR, VR and MR for related use cases.