Technologies
Connected devices and the smart home
Nobody independent counts connected devices, and the household survey data that does exist shows the smart home is mostly televisions and speakers.
The number of connected devices in the world is not measured by any independent body. Every global figure in circulation, including the ones treated here as the best available, is a commercial analyst estimate built on a proprietary model. The most famous, Cisco's 2011 projection of 50 billion devices by 2020, overshot by more than a factor of two: the leading current estimate reached 21.1 billion only at the end of 2025, five years past the deadline. Household adoption is better documented, because Eurostat asks people directly, and it shows a smart home made mostly of televisions, speakers and consoles rather than appliances or heating. The security record is thinner but sharper: the largest measured consumer botnet was assembled almost entirely from default passwords. For a practical example of software used to turn activity into operational metrics, see this reference.
Every device count is a commercial estimate
There is no official statistical-office count of connected devices anywhere. National agencies count households, subscriptions and internet users; nobody counts things. Vendor forecasting fills the gap, and the most influential example is a 2011 Cisco white paper that fixed one round number into a decade of conference slides.
Cisco's Internet Business Solutions Group forecast that there would be 50 billion connected devices by 2020.
Direction: Increase. Strength of evidence: Strong.
Caveat Strong only as documentary evidence of what was claimed — a vendor white paper with no disclosed methodology or error bars, not a measurement.
Gartner made a smaller version of the same bet, forecasting 20.4 billion connected things by 2020 (Gartner, 2017). The current best guess comes from a third commercial source, so what follows is not a measurement correcting a forecast. It is one commercial model checking another.
The most widely cited current estimate puts global connected devices at 18.5 billion at the end of 2024 and 21.1 billion at the end of 2025.
Direction: Increase. Strength of evidence: Mixed.
Caveat Commercial analyst estimate with proprietary methodology; the same page notes the 2025 figure landed about 300 million below IoT Analytics' own 2024 forecast.
Definitions do most of the work. Whether smartphones, smart televisions and utility meters count can move a global total by billions, and no two trackers draw the line in the same place. Anyone citing a device count should name the firm and the year, not the number alone. The broader pattern is set out in how to read a technology forecast.
Household adoption is narrower than the headline suggests
The one good national-statistics series on smart homes comes from the European Union's household ICT survey. Its headline is large and its components are small, which is the useful part.
76% of EU internet users used internet-connected devices in 2024, but only 14% used smart home appliances, 13% home security systems and 15% smart energy meters.
Direction: Increase. Strength of evidence: Strong.
Caveat Self-reported household survey; the headline is inflated by smart televisions, speakers and consoles at 67%, and the denominator is internet users rather than all adults.
Country variation is wide, from 52% in Poland to 95% in the Netherlands (Eurostat, 2025). The gap between the headline and the low teens for appliances is the honest summary: connected screens and speakers are ordinary, connected everything else is not. Ofcom publishes no equivalent series — its Online Nation and Media Nations reports for 2025 contain no smart-home ownership tables.
The largest measured attack ran on default passwords
Security research is the one part of this subject with peer-reviewed measurement behind it. The Mirai botnet, which took down large parts of the web's naming infrastructure in 2016, was reconstructed by an academic team using telescopes, honeypots and scan data.
The Mirai botnet grew to a peak of roughly 600,000 infected consumer devices, built almost entirely from default-credential logins.
Direction: Increase. Strength of evidence: Strong.
Caveat A snapshot from 2016-17 assembled from external observation, so it undercounts devices never seen by the sensors.
The mechanism matters more than the total. These were not devices broken open by novel technique; they were devices shipped with a password printed in the manual. That is a manufacturing decision rather than a user error, which is why it became the first thing regulators legislated against, and why household password and account practice barely enters into it.
Vendor failures reach tens of thousands of households at once
The best-documented consumer case concerns one camera vendor and comes from a regulator rather than from research.
The FTC alleged that hackers obtained access to about 55,000 US Ring customer accounts, and Ring agreed to pay $5.8 million in consumer refunds in May 2023.
Direction: Increase. Strength of evidence: Strong.
Caveat Settled allegations rather than adjudicated findings, covering one vendor, so they cannot be generalised to a sector-wide breach rate.
Nobody publishes a sector-wide breach rate to compare it against, which puts connected devices in the same position as the wider record on data breaches and their costs: visible incidents, no denominator.
The rules arrived recently and their effect is unmeasured
Two regimes now apply to consumer connected products. Both are too new to have generated outcome data.
The UK's consumer connectable product security regime came into force on 29 April 2024, mandating no universal default passwords, a published vulnerability-reporting contact and a published minimum security-update period.
Direction: No detectable effect. Strength of evidence: Strong.
Caveat The duty is only to publish an update period, not to provide a minimum one, and no official compliance-rate measurement has been published.
The EU Cyber Resilience Act entered into force on 10 December 2024, with vulnerability-reporting duties applying from 11 September 2026 and the main manufacturer obligations from 11 December 2027 (European Union, 2024). Because those obligations are not yet in application, there is by definition no evidence about their effect. A device bought today may carry a security-update window of a few months and remain fully compliant.
The short version
- Cisco's 2011 white paper forecast 50 billion connected devices by 2020, more than double the 21.1 billion the leading commercial estimate reached at the end of 2025 (IoT Analytics, 2025).
- Gartner's 2017 forecast of 20.4 billion things by 2020 was also unmet, and neither firm has published a reconciliation.
- Eurostat's 2024 survey found smart appliance use at 14% of EU internet users, against 67% for smart televisions, speakers and consoles.
- The Mirai botnet reached roughly 600,000 consumer devices through default logins, a manufacturing decision rather than a user failure (Antonakakis and colleagues, 2017).
- The central limit is definitional: no statistical office counts these devices, so every total is a vendor or analyst product and should be cited with the firm's name attached.