the S in IoT stands for security
expressionsecurity
The joke that the S in IoT stands for security - there is no S, and too often no security either.
A one-line audit of an industry: default passwords, unpatchable firmware, devices that outlive their vendors. Botnets like Mirai turned the punchline into an operational fact.
The S in IoT stands for security is a joke that works because there is no S in IoT. It names a real and structural condition rather than a series of individual failures.
The economics explain it completely. Connected devices compete on price in a market where security is invisible at purchase, so the manufacturer's incentive is to omit it. The firmware is frequently assembled from vendor code with unknown provenance, updates require infrastructure the manufacturer must fund for the life of the device, and that life is often longer than the company's interest in the product. A camera bought today may be running unpatched software in a decade because there is no mechanism and no obligation.
That the joke has survived unchanged for years is itself the point. Mirai demonstrated the consequences, regulation has begun to address the incentive with default password bans and mandatory update periods, and the installed base of devices that predate any of it will remain connected for a very long time. The practical position for anyone running a network is to assume these devices are compromised, segment them accordingly, and not depend on the manufacturer for anything.