A Cross-Sector Measurement Study of Internet-Exposed IoT Devices

Abstract

The rapid expansion of the Internet of Things (IoT) has created a heterogeneous attack surface that spans consumer devices, enterprise systems, industrial control networks, and critical infrastructure. Although prior work has examined vulnerabilities within individual domains, there is limited empirical evidence comparing security exposure across operational sectors. This paper presents a cross-sector measurement study of publicly reachable IoT systems in consumer, commercial, industrial, infrastructure, and military environments. Using indexed Internet discovery and controlled non-intrusive vulnerability assessment, we constructed a dataset comprising 424 unique vulnerabilities and 12,366 vulnerability instances across multiple device classes. The analysis evaluates severity distribution, vulnerability categories, and sector-specific exposure behavior, showing that IoT insecurity is not uniform: consumer and commercial environments exhibit high-frequency web and configuration weaknesses, while industrial and infrastructure systems demonstrate fewer but higher-impact vulnerabilities related to control protocols and segmentation. To improve risk prioritization, an Isolation Forest-based anomaly detection model was applied to identify high-risk IoT exposure profiles based on vulnerability density and severity characteristics. The results indicate that IoT risk is primarily shaped by deployment context, highlighting the need for sector-aware defensive strategies and scalable AI-assisted analysis approaches.