On a Friday in October 2016, cameras and recorders that their owners barely thought about were turned into a weapon that knocked major websites offline for hours (Tripwire, 2016). Nobody bought those devices to make news, yet they made the biggest technology story of the week. This guide judges agency candidates against connection counts, security law and recall history published between 2016 and 2025. IoT Analytics, 2025, counted 18.5 billion connected devices in 2024, and every one of them is a surface your story has to survive.
I Discrimen
A connected product is judged by its worst day online, not its launch day
A sensor that behaves for a decade can still be remembered for the single afternoon it was conscripted into an attack.
Buyers of connected products carry two pictures of your company at once. One picture shows the dashboard, the savings and the tidy installation story you planned. The other shows a headline about a camera, a thermostat or a tracker doing something its owner never asked it to do.
Your agency has to hold both pictures in view while it writes. A team that only plans for the first picture will describe your device as effortless and invisible, right up to the moment it becomes very visible indeed. Connected means accountable, and the account is settled in public.
Test candidates on that tension early. Ask how they would announce a firmware flaw in a product already installed in thousands of homes, and listen for owners, timelines and plain words. Their answer tells you more than any glossy launch reel, a lesson that also runs through how to choose a PR agency for cybersecurity, where the incident plan is the reputation plan.
II Machina
Coverage follows the evidence trail a reporter can walk without your help
A journalist who can verify your claim from a standards document will trust the next claim you send.
Reporters covering connected products have learned to ask unglamorous questions. They want to know which radio standard the device uses, how long security updates will be supplied, and what happens to customer data when your company is acquired or the product line closes.
NIST, 2025, maintains a dedicated Internet of Things programme covering device cybersecurity and privacy work for manufacturers and buyers. The FTC staff report on the Internet of Things, 2015, warned years ago that data collection by connected devices could create risks consumers could not see at the point of sale.
Ask a candidate to show you the substantiation file behind a past product claim, with names removed if needed. You are looking for a habit: claim, document, owner, review date. You can set that expectation against the full range of public relations services before you decide which disciplines your budget actually needs to buy.
III Exemplum
The Mirai attack turned household gadgets into the story, and the makers into defendants
Devices sold on price alone became evidence in an argument about an entire industry.
The documented example every IoT founder should study is the attack of 21 October 2016 on Dyn, a provider of domain name services. Dyn confirmed that tens of millions of addresses linked to the Mirai botnet took part, and the traffic disrupted services including Twitter, Netflix, Spotify and Reddit for users in the United States and beyond (IT Pro, 2016).
Mirai recruited devices by trying factory default passwords, and webcams and digital recorders supplied much of its strength. One manufacturer, Hangzhou Xiongmai, issued a recall of its webcams in the United States after its products were identified among those exploited (IT Pro, 2016).
Notice where the communications failure sat. The weakness was known, the passwords were guessable, and yet the public explanation arrived after the outage, in the language of an industry problem rather than an owned one. Your agency rehearsal should therefore include the recall statement, the support page and the retailer notice, not only the press release. A gadget that phones home can also phone in your crisis, which is why founders in adjacent hardware markets study how to choose a PR agency for robotics before their machines meet the public.
IV Damnum
A security story costs you retail shelf space and enterprise trust at the same time
Consumers forgive a clumsy feature faster than they forgive learning their hallway camera served a stranger.
The commercial damage from an IoT incident travels along two roads at once. Households read about botnets and recalls, then hesitate at the shelf. Enterprise buyers read the same coverage, then add questions about update policy and data handling to procurement forms that your sales team must answer for quarters afterwards.
IoT Analytics, 2025, expects connections to keep climbing toward 39 billion by 2030, so scrutiny will grow with the installed base rather than fade. Each new category of connected product inherits the suspicion earned by the weakest device that came before it.
There is an internal cost too. Engineers who warned about default credentials watch how leadership talks when those warnings become headlines, and they remember the wording during your next hiring round. Candour is a retention tool as well as a press strategy. Choose counsel that prices a recall honestly before you are living through one.
V Genus
A factory sensor, a doorbell and a hospital monitor need three different kinds of counsel
The word connected hides three risk profiles that share almost nothing except a radio.
Sort your company before you score any candidate. An industrial supplier sells uptime and integration to operations managers who read trade press and attend plant tours. A consumer brand sells reassurance to households who read reviews and watch local news segments about hacked cameras. A medical or care device sits under health scrutiny, where a connectivity failure can become a safety conversation.
Each profile rewards a different agency strength, from trade media patience to consumer crisis speed. The table below maps the profiles to the proof you should demand.
| Your kind of IoT company | The scrutiny you will actually face | Proof to demand from a candidate |
|---|---|---|
| Industrial sensing and control | Procurement reviews and trade press questions about uptime | A worked example of a technical claim checked against test records |
| Consumer smart home products | Review sites and broadcast segments about privacy at home | A recall or vulnerability statement drafted under time pressure |
| Connected health and care devices | Health reporters asking whether failures affect patient safety | A plan separating product faults from clinical risk in plain language |
| Fleet and asset tracking | Logistics buyers testing data accuracy and coverage claims | A substantiation file for range, battery and reporting claims |
fons: Categories shaped by NIST Internet of Things programme material, 2025, and FTC Internet of Things staff report, 2015.
A candidate fluent in one row and vague in yours is a mismatch, however warm the meeting felt. Network specialists face a cousin of this sorting problem, and how to choose a PR agency for telecommunications shows how coverage claims get tested by people who run the pipes.
VI Regio
Security law for connected products now differs by market, and your copy must differ with it
A sentence about effortless setup can read as a legal admission in a market that bans default passwords.
Where you sell changes what you may say. The United Kingdom product security regime, 2024, requires consumer connectable products to meet baseline rules, including a ban on easily guessable default passwords and a duty to tell buyers how long security updates will be provided. Sellers who ignore the regime face enforcement rather than embarrassment.
Elsewhere, labelling schemes and guidance from bodies such as NIST in the United States and standards organisations in Europe push in a similar direction at different speeds. A launch announcement written for one market can therefore promise support periods, data practices or setup steps that another market treats as regulated statements.
Ask each finalist to mark up your draft launch release for two markets you sell into, flagging claims that need legal review in each. Geography is a drafting input, not a distribution afterthought. Teams that grasp this also tend to handle app store scrutiny well, a point explored in how to choose a PR agency for mobile applications.
VII Occasio
Growth this fast rewards the company that can explain itself in one honest paragraph
When billions of devices arrive each year, the brand that sounds clearest becomes the default reference.
The opening in this market is real and measurable. IoT Analytics, 2025, recorded growth from 18.5 billion connected devices in 2024 toward an expected 21.1 billion during 2025, with cellular connections expanding into places older networks could not reach. Ericsson Mobility Report material, 2025, likewise tracks connected devices as a permanent layer of the network economy rather than a novelty.
Journalists and answer engines both need explainers they can reuse. The company that supplies a clean definition, a defensible number and a named customer becomes the quoted source when a general reporter meets your category for the first time.
Ask candidates which of your existing assets they would build that explainer from: deployment data, a standards contribution, a customer with measured savings. An agency that reaches first for a stunt has mistaken noise for position. Clarity compounds in a crowded market, because every reuse of your paragraph teaches the market your name.
VIII Structura
Judge the agency by its update policy for stories, not only by its launch calendar
A connected product changes after sale, and your public record has to change with it.
Connected products keep talking after the announcement. Firmware updates alter features, support windows expire, cloud services are retired, and each of those moments generates coverage whether you plan it or not. Your agency structure should include a named owner for post launch communication, with authority to publish corrections and sunset notices quickly.
Ask who monitors researcher disclosures about your product class and who decides whether an old claim on your site needs revising. Ask how they log corrections, because a quiet edit discovered by a reporter reads worse than a dated correction note.
Structure shows in small artefacts: a claim register, an update log, a holding statement that names owners rather than departments. The firm that maintains those artefacts in calm months will not improvise them in a bad week. In IoT, the story ships with every unit, so hire the team that keeps editing after the boxes leave the warehouse. Consumer brands feel this most sharply, as how to choose a PR agency for consumer technology argues from the review cycle side.
IX Consilium
Hire the team that asks about your passwords before it asks about your party
An agency curious about your weakest credential understands where IoT reputations are actually lost.
Run a practical audition. Hand each finalist a short brief describing a vulnerability found in a shipping product, a retailer asking questions, and a support team with limited weekend cover. Score the response they return within a day.
Weight the criteria in advance so that confidence in the room cannot outrank competence on paper. The table below offers a scoring frame to adapt to your own launch.
| Your situation this year | Criterion to weight most heavily | Warning sign that should end the talks |
|---|---|---|
| First consumer device launch | Plain language privacy and update explanations | Setup described as magic with no mention of accounts or passwords |
| Industrial contract pursuit | Trade press relationships and procurement fluency | A media list built only from national consumer titles |
| Product already widely installed | Recall and disclosure rehearsal experience | A suggestion to stay silent until journalists notice |
| Entry into a new national market | Working knowledge of local product security rules | Assurance that one global release fits every regulator |
fons: Scoring frame informed by Pinsent Masons product security regime analysis, 2024, and IoT Analytics device counts, 2025.
Sign when the contract names your senior contact, your approval rights on security statements and the cadence of coverage and correction reporting. You are buying judgement for the day a researcher emails about your firmware, and that day is a scheduling question, not a possibility question.
X Quaesita
Questions
How long should an IoT company keep a PR agency on retainer after launch?
Plan for at least the first full update cycle of the product, because disclosures, reviews and support questions arrive long after announcement week. Connected products generate news on the schedule of their firmware, not your marketing calendar. A short engagement that ends at launch leaves the riskiest conversations unstaffed.
What should you ask an agency about vulnerability disclosure?
Ask who drafts your response when a researcher reports a flaw, how fast a holding line can be approved, and whether they have handled a coordinated disclosure before. Listen for named steps and timelines rather than reassurance. The Mirai episode showed how quickly device level flaws become industry level stories (Tripwire, 2016).
Does an industrial IoT firm need consumer media coverage?
Usually only when a failure could reach the general public, such as an energy, water or transport deployment. Trade press and procurement facing material do most of the commercial work in industrial markets. An agency pushing national consumer coverage for a factory sensor is selling its own list, not your buyers.
How should update and support periods be communicated?
State the period plainly at purchase, in the announcement and on the product page, using the same dates in all three places. The United Kingdom regime, 2024, expects buyers to be told how long security updates will last. Vague phrases about ongoing support invite reporters to supply their own interpretation.
What evidence should sit behind a battery or range claim?
Keep the test conditions, sample size and date in a file your agency can quote without calling your engineers at midnight. Unqualified claims invite a reviewer to run a harsher test and publish the gap. A claim with conditions stated survives scrutiny better than a larger claim with none.
How do you judge whether an agency understands consumer privacy concerns?
Give them your data collection summary and ask them to write the paragraph a careful buyer would want to read before installing your device. A strong draft names what is collected, where it is stored and how a user deletes it. A weak draft hides behind fog about valuing privacy without offering a single specific.
When should you replace an agency on an IoT account?
Consider a change after a second mishandled disclosure or a pattern of claims your engineers keep having to correct. One slow week is a staffing matter, while repeated accuracy failures teach your market to discount everything you publish. Record each failure as it happens so the decision rests on evidence.
How this guide was built
The guide rests on the ten sources listed below, spanning device connection counts, the documented Mirai attack and recall, staff level privacy analysis, standards work and the United Kingdom product security regime. Each statistic in the argument keeps the name of its publisher and its publication year directly alongside it, so a reader can trace any figure back to its origin without leaving the page. Connection forecasts are publisher estimates rather than audited totals, and the 2016 attack is used as a documented precedent, not as a measure of present day device security. No research was commissioned for this piece, so the selection criteria rest on published material about the market you operate in.
Sources
- IoT Analytics, number of connected IoT devices growing 14 percent to 21.1 billion, reporting 18.5 billion connected devices in 2024, 2025. https://iot-analytics.com/number-connected-iot-devices/
- IoT Business News, State of IoT 2025, reporting connected device growth to 21.1 billion globally, 2025. https://iotbusinessnews.com/2025/10/30/state-of-iot-2025-number-of-connected-iot-devices-growing-14-to-21-1-billion-globally/
- Tripwire, the 5 most significant DDoS attacks of 2016, describing a Mirai botnet of 100,000 infected devices used against Dyn, 2016. https://www.tripwire.com/state-of-security/5-significant-ddos-attacks-2016
- IT Pro, was Mirai malware behind the Dyn DDoS attack, reporting tens of millions of botnet addresses and a webcam recall, 2016. https://www.itpro.com/hacking/27449/was-mirai-malware-behind-dyn-ddos-attack
- National Institute of Standards and Technology, Internet of Things programme pages covering device cybersecurity and privacy, 2025. https://www.nist.gov/internet-things-iot
- Kelley Drye and Warren, FTC publishes Internet of Things report, summarising the Federal Trade Commission staff report on privacy and security in a connected world, 2015. https://www.kelleydrye.com/viewpoints/client-advisories/ftc-publishes-internet-of-things-report-best-practices-for-the-tools-that-track-your-health-your-home-and-everything-in-between
- Pinsent Masons, action needed as UK product security regime approaches, analysing duties for connectable products sold in the United Kingdom, 2024. https://www.pinsentmasons.com/out-law/news/action-needed-as-uk-product-security-regime-approaches
- Ericsson, Mobility Report, tracking connected devices and cellular IoT growth across global networks, 2025. https://www.ericsson.com/en/reports-and-papers/mobility-report
- GSMA, Internet of Things programme pages describing mobile IoT deployments and industry coordination, 2025. https://www.gsma.com/solutions-and-impact/technologies/internet-of-things/
- Internet Safety Statistics, IoT growth statistics, compiling IoT Analytics connection counts and the outlook toward 39 billion devices by 2030, 2025. https://www.internetsafetystatistics.com/internet-things-iot-growth/
XI Incipe
Aerovector starts an IoT account with the disclosure drill, not the launch party
Your installed base is already speaking to the market through every update, review and support thread, and Aerovector builds its work around that fact. The practice helps clients rank for AI search results and guarantees media coverage, which in turn generates leads from buyers who research connected products carefully before they commit. For an IoT company, ranking in answer results depends on the same discipline this guide demands: update periods stated plainly, claims tied to documents, and security language a reporter can verify.
The working tools are specific. A Media Map identifies the trade titles, security reporters and review programmes that shape your category, a Newsroom Calendar schedules communication around firmware and support milestones rather than announcement dates alone, and Coverage Reporting records what each placement said about your product. If a disclosure, recall or launch is approaching, put the product details and the dates into the form on the contact page so the first conversation can start with your evidence file open.
Aerovector gives connected products a public record that holds up on their worst day online.
Share your IoT launch or disclosure dates with Aerovector through the contact page form
Additional Details
Description: How to Choose a PR agency for Internet of Things (IoT): the evidence to demand, the trade offs to weigh, and the questions that separate a sound hire from.
Published: 2026-10-25