The Internet’s Next Wave Needs a Different Security Model
Smartphones turned every person on the planet into a permanent, mobile Internet node — there are roughly 6.5 billion of them today. But that explosion of connected devices will be dwarfed by the next phase of the Internet’s evolution: devices that connect not for human communication but to gain intelligence. IoT devices now outnumber smartphones on the Internet by roughly two to one, and unlike phones, they aren’t limited by the number of humans who can carry them.
That growth has brought an equivalent surge in risk. For years, defenders have fought DDoS botnets built from compromised IoT gear — Mirai, Meris, and their successors keep growing. The reason is straightforward: IoT devices remain hard to secure, and manufacturers often lack incentives to make them secure. NIST is actively drafting requirements to address the shortfall, and the EU is following close behind.
Cloudflare is now moving into this space with an IoT platform designed to give a single pane of glass over your devices, provision connectivity for new ones, and secure every device from the moment it powers on.
More Than Lightbulbs
The word “IoT” usually conjures images of smart bulbs or motion sensors. But many devices we touch daily qualify: nearly every payment terminal, any modern car with an infotainment or GPS system, and millions of industrial devices that drive logistics, processes, and manufacturing. What you may not realize is that nearly every one of these devices has a SIM card and connects over a cellular network.
Cellular connectivity is increasingly ubiquitous, and when a device can connect without Wi-Fi configuration hassles — working out of the box — a whole class of operational support problems disappears. That points directly at the same direction as the recently announced Zero Trust SIM.
Cloudflare already secures hundreds of thousands of IoT devices that connect to its network using mutual TLS and API Shield. Major device makers use Workers and the Developer Platform to offload authentication and compute from the device itself; Cloudflare Pub/Sub, the programmable, MQTT-based messaging service, is another building block.
But a few gaps remained: device management, analytics, and anomaly detection. There are plenty of “IoT SIM” providers, but most focus on shipping SIM cards at scale — not on security or developer experience. Customers asked for a way to secure IoT devices as easily as they secure employees with Zero Trust.
Cloudflare’s IoT Platform will support ordering, provisioning, and managing cellular connectivity at scale. Every packet from each IoT device can be inspected, approved, or rejected by policies you create before it reaches the Internet, your cloud infrastructure, or your other devices.
Emerging standards like IoT SAFE will let the SIM card serve as a root-of-trust, storing device secrets and API keys securely on the device and raising the bar for compromise. This doesn’t mean abandoning mutual TLS: not every device makes sense on cellular alone, whether due to per-device costs, coverage gaps, or existing deployments that can’t be redeployed.
Zero Trust, Applied to Things
Humans need access to a potentially unbounded set of destinations; IoT devices typically need to speak to a far smaller set of endpoints — your API backend, your storage bucket, your telemetry endpoint. Yet in practice, few controls exist to enforce that boundary.
Cloudflare Gateway already provides DNS, network, and HTTP policies that allow or deny traffic based on richer identity- and location-based controls, not just source or destination. Bringing these capabilities to IoT devices lets developers restrict what endpoints their devices can talk to — keeping them from becoming part of a botnet.
The platform also extends Gateway to be IoT-aware. If you’ve provisioned 5,000 cellular-connected devices, you can lock them to a geographic region if they don’t need to travel; restrict them to your API backend or metrics provider only; or bind the SIM to the modem’s IMEI so that a lifted SIM stops working. These network-layer controls raise the bar on device security and reduce the risk that your fleet becomes a bad actor’s tool.
Keep Compute Off the Device
A device that does nothing and communicates nowhere is perfectly secure — but useless. Yet non-trivial on-device compute has real drawbacks:
- It demands a more powerful, costlier device. ARMv8-based hardware with a few gigabytes of RAM is getting cheaper, but at IoT scale, those premium components add up.
- Device fleets are rarely homogeneous. Units deployed three years ago may be several times slower than what ships today — do you abandon them?
- More business logic on the device means greater operational and deployment risk. Change management gets critical, and the risk of “bricking” a device remotely is never zero.
- Security suffers: devices that call external APIs need carefully scoped credentials, lest they be pulled off the device and abused.
Other platforms talk about “edge compute,” but often mean either on-device processing or a handful of cloud regions that introduce latency — neither solves the problems above. Cloudflare’s approach moves compute to its global network via Workers, telemetry to Analytics Engine, SQL to D1, and scalable messaging to Pub/Sub. That keeps compute and storage close to the device but off it, across 275+ cities.
Developers can use Wrangler for fast iteration and safe deployment, sidestepping the risk of bricking part of the fleet.
Getting Started
You can register interest in the IoT Platform today. Cloudflare will reach out over the coming weeks to understand the problems teams face, with a closed beta planned in the coming months. Teams deploying new IoT fleets or expanding existing ones are particularly encouraged to apply.
In the meantime, teams needing to secure IoT devices today can start building on API Shield and Pub/Sub (MQTT).
