IoT Year in Review: Medical Monitoring, Physical Security, and AI-Powered Threats

Healthcare IoT Expands: Connected Medical Devices Hit 160 Million by 2030

The global installed base of connected home medical monitoring devices is projected to grow from 92.7 million in 2025 to nearly 160 million by 2030, according to Berg Insight. This represents a compound annual growth rate (CAGR) of 11.5% and signals a fundamental shift toward continuous, data-driven healthcare outside hospital walls. As remote care becomes more established, the challenge is shifting from simply collecting patient data to integrating that information into clinical workflows and supporting timely medical interventions.

Three application areas account for much of the connected home medical monitoring market: sleep therapy, diabetes management, and implantable cardiac rhythm management (CRM). Sleep therapy remains the largest segment, with ResMed holding a dominant position alongside manufacturers including Philips, BMC Medical and Löwenstein Medical Technology. The number of remotely monitored sleep therapy patients has more than doubled since 2018, largely supported by treatment compliance monitoring requirements introduced in the US and Europe. Diabetes management has emerged as the second-largest segment, reaching 19.5 million connections worldwide in 2025. Growth is being supported by the expanding use of continuous glucose monitoring (CGM) and connected insulin delivery systems from companies including Abbott, Dexcom, Insulet, Tandem Diabetes Care and MiniMed. Cardiac rhythm management represents another established application, with manufacturers such as Medtronic, Abbott, Boston Scientific and BIOTRONIK having incorporated connectivity into implantable devices for more than two decades.

Looking ahead, Berg Insight expects diabetes management, remote electrocardiogram (ECG) monitoring and medication compliance monitoring to be among the fastest-growing categories through 2030. Importantly, these figures cover connected medical devices used by patients enrolled in structured healthcare programmes. Consumer fitness trackers and personal wellness devices used outside prescribed care regimens are excluded, making the forecast a more focused indicator of clinical IoT adoption rather than the broader wearable technology market.

Figure: Abbott Freestyle Libre 3 CGM applicator — a representative connected medical device in the home monitoring ecosystem [Abbott Freestyle Libre 3 CGM applicator.jpg].

One significant development highlighted by the research is the growing importance of software and service platforms within the mHealth ecosystem. While connected medical devices provide the underlying patient measurements, platforms from companies such as Huma Therapeutics, Doccla, Teladoc Health, CareSimple and Current Health support the collection, analysis and management of patient information across remote care programmes. This changes the requirements for healthcare IoT deployments. Reliable device connectivity remains essential, but delivering clinical value increasingly depends on the ability to consolidate information from different devices, present meaningful insights to medical professionals and integrate monitoring into existing care processes. For medical device manufacturers and IoT solution providers, this creates an important distinction between selling connected hardware and participating in a complete remote patient monitoring ecosystem. Device interoperability, dependable data delivery and integration with healthcare software become important considerations as deployments expand across multiple medical conditions and care providers.

The trend also has implications for system integrators and connectivity providers. Medical monitoring applications must support different device types, patient environments and data collection requirements, making end-to-end service reliability an important operational consideration. As the market matures, the opportunity set is expanding beyond device connections to the infrastructure and services required to deliver dependable, clinically relevant remote monitoring at scale.

Physical AI and the New IoT Security Frontier

As intelligent and critical applications move directly onto devices operating in the field — robots, drones, and industrial machines acting autonomously, often beyond the factory floor — device trust becomes the condition for scale. This is the central thesis of the Exein–Deutsche Telekom IoT partnership, announced in September 2026, which brings together a cybersecurity unicorn and a global connectivity provider to address a gap that is becoming more urgent as physical AI moves from the lab into the world.

Exein, a global leader in physical AI and runtime security, today announced a strategic partnership with Deutsche Telekom IoT to bring integrated security to connected devices across Deutsche Telekom IoT's ecosystem. The partnership pairs Exein's device-level security with Deutsche Telekom's IoT connectivity, giving customers a more integrated approach to connectivity and device security throughout the IoT lifecycle. With its own transatlantic network and around 600 roaming and satellite partners, Deutsche Telekom IoT provides worldwide connectivity for customers across industries and markets.

Exein will bring its on-device security expertise together with Deutsche Telekom IoT's global connectivity capabilities. One of Exein's key technologies is Photon, a kernel-level security layer that blocks malicious code before it executes, and keeps working even when a device is offline. Exein's security is already protecting more than two billion devices across sectors including automotive, robotics, energy, and industrial manufacturing. That same approach is what Exein now brings to devices running on Deutsche Telekom's network.

"From day one, our vision has been to build cybersecurity directly into devices. By combining that with Deutsche Telekom IoT's global connectivity, we are creating a secure ecosystem. The physical AI revolution will only happen if people can trust the technology they interact with. We are proud to partner with Deutsche Telekom IoT to make that possible." — Gianni Cuozzo, Founder and CEO of Exein

"As IoT devices take on increasingly critical roles in business operations, connectivity and security need to go hand in hand. With Physical AI, intelligent applications are moving directly onto devices – from robots and drones to industrial machines – making device and firmware security even more important. By combining Exein's expertise in device-level security with Deutsche Telekom IoT's global connectivity capabilities, we aim to give customers a stronger foundation for deploying and scaling connected devices securely and with confidence." — Christian Schwalbe, CEO of Deutsche Telekom IoT

The implications are significant. As physical AI moves autonomous machines out of controlled environments and into the world, device trust becomes the condition for scale. This partnership brings that trust to Deutsche Telekom's network, embedding security into connectivity rather than layering it on top. For enterprises deploying fleets of autonomous devices, the ability to secure devices at the kernel level while maintaining global connectivity represents a new paradigm in IoT security — one where protection is not an afterthought but a foundational layer of the connectivity architecture.

Figure: Outdoor wireless security camera — a typical IoT security deployment that benefits from kernel-level runtime protection [Outdoor wireless security camera at Nuthurst, Sussex 1.jpg].

The Deutsche Telekom partnership arrives on the heels of Exein's $270 million funding round, valuing the company at $1.7 billion and making it Europe's newest cybersecurity unicorn. The round was substantially oversubscribed, driven by Exein's performance and its newest technologies — including Photon, which provides runtime security at the kernel level. Exein's approach protects devices against firmware-level attacks, unauthorized code execution, and other threats that traditional security solutions cannot reach.

For IoT deployments spanning diverse environments — from smart cities and industrial facilities to connected vehicles and agricultural monitoring — this embedded security model addresses the fundamental tension between device resource constraints and the growing threat landscape. By securing the device itself, the partnership enables safer deployment of physical AI systems that can operate autonomously in production, transportation, and critical infrastructure settings.

When IoT Devices Become AI Propagators: Anthropic's Self-Replicating Threat Warning

Compounding the security challenge, new research from Anthropic suggests that small AI models could soon become capable of autonomously replicating across vulnerable IoT devices. Experiments involving inexpensive Android TV boxes reveal how distributed edge computing could support a new generation of adaptive malware that doesn't just spread — it reconfigures itself for different hardware platforms.

New research from Anthropic suggests that small AI models could soon become capable of autonomously replicating across vulnerable IoT devices. Experiments involving inexpensive Android TV boxes reveal how distributed edge computing could support a new generation of adaptive malware. IoT botnets have traditionally relied on relatively simple methods to spread, exploiting weak passwords, known vulnerabilities and poorly secured connected devices. But what happens when malicious software can independently figure out how to operate on unfamiliar hardware, configure its own computing environment and adapt its propagation strategy?

Research published by Anthropic on October 12, 2026, suggests that this scenario may be approaching technical feasibility. According to the company's Frontier Red Team, advances in small AI models could enable autonomous, self-replicating software to operate across networks of compromised IoT devices without requiring access to powerful datacenter infrastructure. The findings introduce a potentially significant shift in IoT cybersecurity: connected devices may become not only targets for malware but also distributed computing resources capable of running the AI systems responsible for spreading it.

One of the research's most notable demonstrations involved running Gemma4-26B-A4B, a 26-billion-parameter AI model, across 15 inexpensive Android TV boxes costing approximately $55 each. Each device contained 4GB of RAM and hosted a portion of the model using distributed inference. Together, the devices achieved an inference speed of 0.39 tokens per second. While this performance is far below that of modern datacenter GPUs, it demonstrates that relatively capable AI models can operate across networks of inexpensive, resource-constrained devices.

This distinction matters because traditional malware typically executes predefined instructions, whereas an AI-powered replicator could potentially interpret unfamiliar environments, troubleshoot software compatibility problems and determine how to establish inference on different hardware platforms. Anthropic tested this capability separately using several open-weight models. A 9-billion-parameter model successfully established inference on eight of nine hardware types evaluated, demonstrating a level of adaptability that conventional scripted malware generally lacks.

The researchers also evaluated whether AI agents could complete a replication cycle involving discovering target devices, transferring software and establishing a working inference environment. In a controlled experiment involving eight Android-emulated nodes, GLM-5.2 successfully propagated to all eight targets in four out of five trials, reaching seven in the remaining trial. However, an important limitation remains: the experiment deliberately simplified the initial compromise stage by providing access through an unauthenticated interface. Consequently, the results do not demonstrate that a fully autonomous AI worm can already spread through real-world IoT networks. Instead, they show that sufficiently capable models can coordinate the replication process under controlled conditions, while smaller models are increasingly able to perform the necessary inference tasks on constrained hardware.

Anthropic estimates that, if current improvements continue, small models could reach the required capability threshold by the end of 2026. This projection is based on general AI capability trends rather than direct evidence of an operational self-replicating IoT threat.

The more consequential difference is adaptability. Traditional IoT botnets such as Mirai and Kimwolf have largely depended on specific exploitation techniques and device categories. An AI-based replicator could potentially configure itself for different processors, operating systems and software environments, expanding the range of compatible targets. The research also examined whether agents could improve their performance by transferring information between successive instances. In one experiment, Qwen3.5-9B increased its inference-setup success rate from 45% initially to between 61% and 84% in subsequent generations when previous attempts' notes were retained. This suggests a potential mechanism through which AI-powered malware could become more effective at handling unfamiliar devices without requiring its underlying model weights to change.

The findings are particularly relevant as more connected products incorporate local AI processing capabilities. Smart cameras, conferencing systems, industrial gateways and other edge devices increasingly include processors capable of executing machine learning workloads. Greater local computing capacity could make compromised devices more useful to an attacker seeking distributed inference resources. Anthropic identifies these traffic patterns as potential detection opportunities, alongside established measures such as secure default configurations, network monitoring and quarantine of infected systems.

For IoT manufacturers and system integrators, this introduces an additional dimension to device security: protecting computing resources against unauthorized AI workloads, rather than focusing exclusively on data theft, remote control or disruption. For connectivity providers and enterprise IoT operators, monitoring unusual device-to-device traffic and unexpected data transfers could therefore complement conventional endpoint security.

Ultimately, Anthropic's research should be interpreted as an early warning rather than evidence of an existing autonomous AI epidemic. The experiments show that important technical barriers are becoming smaller, although reliable real-world replication remains unproven. The broader implication is clear: as edge AI capabilities expand, IoT cybersecurity strategies will increasingly need to account for software that can reason about its environment, adapt its behavior and potentially propagate without direct human intervention.

Toward a More Secure and Dependable IoT Ecosystem

The week's IoT news reveals three converging trends that together define the industry's current inflection point. For a deeper dive into how connected devices are reshaping healthcare and industry, see our coverage in the /category/iot section. First, healthcare IoT is scaling rapidly, with connected medical devices moving from specialty applications to mainstream remote patient monitoring at volumes that reshape the clinical landscape. Second, as devices become more capable and more connected, security can no longer be an afterthought — the Exein–Deutsche Telekom partnership demonstrates that kernel-level runtime security embedded at the connectivity layer is becoming a necessity, not a nice-to-have. Third, the emergence of AI-powered threats means that IoT security strategies must evolve beyond static configurations and known-vulnerability patches to account for adaptive, self-improving malware that can reconfigure itself for unfamiliar hardware.

For IoT operators and enterprise buyers, the practical takeaways are immediate. Ask suppliers whether their cellular modules will survive a switch to post-quantum key exchange, and whether their satellite-capable chips have a path to low-power handover between terrestrial and satellite links. Demand kernel-level runtime security as a baseline requirement for any device deploying physical AI in the field. And monitor device-to-device traffic patterns as an early indicator of compromise, since distributed AI inference creates communication requirements that can make malicious activity observable.

The decisions made in the current design cycle will determine which devices are still getting security updates in 2031 — and which become part of the next wave of adaptive, AI-powered botnets. The IoT industry has spent the last decade proving that connected devices can work; the next decade will prove whether they can stay trustworthy.

References

• Berg Insight: Connected Home Medical Monitoring Devices Forecast, 2025–2030
• Exein–Deutsche Telekom IoT partnership announcement, September 30, 2026
• Anthropic Frontier Red Team: Self-Replicating AI Threat to IoT Devices, October 12, 2026
• NIST Cybersecurity Framework (CSF)
• ISO/IEC 27001:2022 Information Security Management
• CISA Advisory on IoT Security
• Exein Runtime Security White Paper
• Deutsche Telekom IoT Global Connectivity Overview