Security Intelligence

Smart Home and IoT Security for HNW Residences | CloseProtectionHire

Q: "What is the PSTI Act 2022 and what does it require?"

"The Product Security and Telecommunications Infrastructure Act 2022 came into force in April 2024. It sets three minimum security requirements for all consumer smart devices sold in the UK: a ban on default passwords (each device must have a unique password or require the user to set one during setup), a mandatory public vulnerability disclosure policy, and a minimum period for which the manufacturer commits to providing security updates. The minimum update period must be disclosed at point of sale. Devices that do not meet these requirements cannot legally be sold in the UK."

Q: "How can a smart home system be used against a residential security programme?"

"A compromised smart home system provides an attacker with information and access that bypasses physical security measures. CCTV with known credentials reveals the security camera layout, patrol patterns, and blind spots. Smart locks with compromised credentials provide physical entry without forced entry evidence. Alarm systems on the same network as compromised IoT devices can be assessed and disabled. Voice assistants record ambient audio that can be accessed if the account is compromised. The attack surface of a modern smart home is substantially larger than it was ten years ago."

Q: "What are the risks of smart locks specifically?"

"Smart locks present several documented vulnerabilities. Z-Wave S0 downgrade attacks -- forcing a lock to communicate using the older, weaker S0 protocol rather than the current S2 standard -- were demonstrated by Pen Test Partners in research published in 2022. Bluetooth BLE replay attacks affect locks that use simple challenge-response authentication. Cloud-dependency means that a compromised cloud account (often via phishing or credential stuffing) provides remote access to the lock. Physical key override is generally maintained on quality smart locks but is sometimes absent on lower-cost devices."

Q: "How should IoT devices be managed on a residential network?"

"NCSC home network guidance recommends segregating IoT devices onto a separate network segment (VLAN) from computers, phones, and storage devices. This means that a compromised IoT device -- a smart TV, a connected printer, or a building automation controller -- cannot directly access the devices on the main network. All IoT devices should have their default credentials changed on setup, be placed on the dedicated IoT VLAN, and have firmware update schedules monitored. Devices that no longer receive manufacturer security updates should be removed or isolated."

Q: "What is Shodan and why is it relevant to residential security?"

"Shodan (shodan.io) is a search engine for internet-connected devices. It indexes IP addresses and open ports, allowing anyone to search for exposed CCTV cameras, smart home hubs, alarm panels, and other devices with internet-facing interfaces. Multiple research projects have demonstrated that significant numbers of residential CCTV cameras and home automation systems appear on Shodan with default credentials. A basic Shodan search for a property's IP address range will reveal which, if any, of its smart devices are exposed to the public internet."

Protecting high-net-worth residences from smart home vulnerabilities, IoT device compromise, and remote access exploitation. NCSC guidance, PSTI Act 2022, practical mitigations.

12 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

Smart Home and IoT Security for High-Net-Worth Residences

The modern high-end residential property has more internet-connected devices in it than most corporate offices had ten years ago. Smart lighting, CCTV with remote access, video doorbells, smart locks, voice assistants, automated blinds, HVAC controls, alarm systems, and building management platforms all share a network – and, in most installations, share it without any systematic security architecture.

This guide covers the specific risks that IoT and smart home systems introduce to a residential security programme, the legal baseline now in force in the UK, the most common vulnerabilities, and the practical steps that security managers and property owners can take to close the gaps.

The Regulatory Baseline: PSTI Act 2022

The Product Security and Telecommunications Infrastructure Act 2022 – in force from April 2024 – establishes minimum security requirements for consumer smart devices sold in the UK. The Act requires three things:

No default passwords. Each device must either ship with a unique password that cannot be used for a different device of the same type, or must require the user to set a password before the device can be used. This addresses the most common and most exploited vulnerability in IoT security.

A public vulnerability disclosure policy. Manufacturers must provide a published channel through which security researchers can report vulnerabilities, and must specify how they will respond.

A minimum security update period. Manufacturers must state, at the point of sale, the minimum period for which they will provide security updates. They cannot sell a device with a stated minimum period of zero.

The Act does not cover devices that are already installed. It applies to new devices sold into the UK market from April 2024. For existing smart home installations – which in most cases predate the Act – the responsibility for security falls on the property owner and their security team.

The Attack Surface of a Smart Home

The central point is this: every internet-connected device in a residential property is an access point. The physical security measures around the property – walls, gates, locks, alarm systems, guards – address the physical perimeter. Smart home security addresses a different perimeter: the network boundary. A compromised device on the residential network potentially provides access to other devices on the same network, to data stored on network-attached storage, and to the management interfaces of other connected systems.

In 2019, Bloomberg reported that Amazon employed teams of workers to review audio captured by Alexa devices (Bloomberg, April 2019). Google’s equivalent programme was disclosed in the same period. Both companies confirmed that a small percentage of interactions were reviewed by humans for quality and training purposes. Whether or not this represents a security risk depends on the content of those interactions – but for a high-value residence where sensitive conversations take place in rooms with voice assistants, it is a relevant data point.

WikiLeaks published documents in 2017 (Vault 7, CIA Hive/Weeping Angel) indicating that Samsung Smart TV microphones had been exploited to capture ambient audio when the device appeared to be in standby mode. Samsung confirmed the existence of always-on microphone functionality in its privacy policy the same year.

The point is not that every smart device in every home is actively compromised. It is that the attack surface exists, it is larger than most property owners recognise, and the tools to identify exposed devices are publicly available.

Shodan: The Public Exposure Problem

Shodan.io is a search engine for internet-connected devices. It crawls the internet and indexes every device it finds with an internet-facing port – CCTV cameras, home automation hubs, alarm panels, network-attached storage, smart printers, and building management controllers.

A 2021 investigation by Which? and researchers at Newcastle University identified thousands of UK home CCTV cameras and smart home devices accessible via Shodan with default credentials. The same research found that a significant proportion of identified devices had not received a manufacturer security update in over two years.

For a high-value residence with a static IP address or a known home automation platform, a Shodan search can reveal CCTV camera access, control interfaces for alarm systems, and in some cases full administrative access to building automation platforms. This is not theoretical. It is documented by Pen Test Partners, Tripwire, and multiple academic research teams in published research between 2018 and 2024.

The mitigation is straightforward: ensure that no device on the residential network has a public internet-facing interface with default credentials. A competent IT professional can audit this in a single session.

Smart Lock Vulnerabilities

Smart locks offer genuine convenience – remote access management, temporary codes for contractors, audit logs of entry and exit. They also introduce vulnerabilities that a traditional mechanical lock does not have.

Z-Wave protocol downgrade (Pen Test Partners, 2022). The Z-Wave home automation protocol, used by many smart locks and building automation systems, introduced S2 security in 2017. Pen Test Partners published research demonstrating that Z-Wave devices could be forced to downgrade to the older S0 protocol during the initial pairing process, and that S0 communications could be intercepted and decrypted in real time. Locks that support S2 but have not been configured to require it are vulnerable to this attack.

Cloud-dependency risk. Most smart locks are managed via a cloud account. Compromise of that account – via phishing, credential stuffing, or account takeover – provides remote access to the lock. Account security for the smart lock management platform (strong unique password, authenticator-app-based two-factor authentication, not SMS-based 2FA) is therefore a physical access security measure.

Bluetooth BLE replay. Some smart locks using Bluetooth Low Energy authentication are susceptible to replay attacks – capturing the authentication exchange and replaying it to unlock the device. This vulnerability has been demonstrated in multiple products in published research and applies to locks without rolling-code challenge-response mechanisms.

For a residential security programme that relies on smart locks for access management, a security review of the specific lock products installed – checking Z-Wave security level, cloud account security, and firmware currency – is not optional.

Voice Assistants and Audio Risk

Amazon Echo (Alexa), Google Home, and Apple HomePod are present in a significant proportion of high-end residential properties. They are always-on listening devices, waiting for a wake word. The audio they capture before and after the wake word is processed in the cloud.

For a residence where sensitive personal, commercial, or legal conversations take place – a family office meeting around the kitchen table, a phone call with a lawyer in the living room, a business conversation in a home office – the presence of an always-on microphone connected to a cloud platform is a consideration that a residential security review should address.

The practical approach: voice assistants should not be present in rooms where sensitive conversations regularly occur. Where they are used in other rooms, the muting function (hardware microphone disable, not software) should be used during sensitive periods. For very high-value principals, a network-level solution that blocks voice assistant traffic during specific times or in specific rooms can be implemented by an IT security professional.

Network Architecture for Residential Properties

The most effective technical mitigation for smart home security risk is network segregation. A properly configured residential network places IoT devices on a dedicated VLAN that is isolated from the devices that hold sensitive data and provide access to sensitive systems.

The architecture:

Primary network: Computers, phones, tablets, NAS storage, corporate-issued devices. Full internet access. Strict access controls.

IoT network (VLAN): Smart lights, CCTV, smart locks, thermostats, voice assistants, smart TVs. Internet access for necessary cloud functions. No direct access to the primary network or its devices.

Guest network: Separate from both. No access to any internal devices.

This configuration means that a compromised smart TV cannot directly reach the family office server. A compromised video doorbell cannot reach the network-attached storage. The blast radius of any single compromised IoT device is limited to the IoT VLAN.

Implementation requires a router and access point configuration that supports VLAN tagging – standard on enterprise-grade residential networking equipment (UniFi, Cisco Meraki for home, Eero Pro for simpler setups). A network professional can implement this in a single session for most residential properties.

Contractor and Staff Credential Management

The single most common gap identified in residential smart home security reviews is not a technical vulnerability. It is credential management.

Housekeepers, cleaners, property managers, interior contractors, AV installation teams, and letting agents routinely receive smart home access credentials – app access, PIN codes, Wi-Fi passwords, alarm codes – for legitimate operational reasons. In the majority of properties, those credentials are never revoked when the engagement ends.

An audit of who holds active credentials for every connected system in the property – smart home app access, alarm codes, video doorbell access, gate codes, lock PIN codes – and the revocation of access for anyone who no longer has a legitimate need, is the most important non-technical step in residential smart home security.

For the broader framework on integrating physical and digital security in residential and commercial settings, see our guide to physical and cyber security convergence. For the full approach to residential security for high-value principals, see our guide to residential security for executives.

Summary

Key takeaways

The attack surface of a modern smart home extends beyond the physical perimeter

A smart home system connected to the internet is, by definition, accessible from outside the physical property. Physical security measures -- locks, alarms, guards -- address the on-site threat. Smart home security addresses the remote access threat. Both are needed. A residence with a staffed gate and a compromised cloud-connected alarm system has a security gap that neither the gate nor the alarm individually resolves.

Default credentials are the most common and most avoidable vulnerability

The majority of smart home compromises documented in academic and commercial security research begin with default credentials -- the factory-set username and password that the device ships with. The PSTI Act 2022 bans default passwords on new devices sold in the UK from April 2024. For existing devices, auditing and changing all default credentials is the single highest-return security action available.

Network segregation is the most effective technical mitigation

Placing IoT devices on a separate network segment (VLAN) from computers and storage devices limits the damage from any single compromised device. A smart TV that has been compromised cannot reach the NAS drive containing sensitive documents if the two are on separate VLANs. This is a standard configuration for any competent IT team. For residential networks, a network professional can implement it in a single session.

Contractor and property manager access to smart home credentials is a routine gap

Housekeepers, cleaners, contractors, property managers, and letting agents routinely receive smart home access credentials for legitimate operational reasons and rarely have those credentials revoked when their engagement ends. An audit of who holds active credentials -- and the revocation of access for anyone who no longer needs it -- is a step that most residential security reviews find has not been done.

Firmware updates are the unglamorous backbone of smart home security

A Which? investigation published in 2022 found that approximately 30 percent of smart home devices receive no security updates within two years of purchase. Unpatched firmware contains the vulnerabilities that attackers exploit. A device that no longer receives manufacturer security updates should be removed from the network or replaced. The update schedule for every connected device in a high-value residence should be documented and maintained.

FAQ

Frequently Asked Questions

The Product Security and Telecommunications Infrastructure Act 2022 came into force in April 2024. It sets three minimum security requirements for all consumer smart devices sold in the UK: a ban on default passwords (each device must have a unique password or require the user to set one during setup), a mandatory public vulnerability disclosure policy, and a minimum period for which the manufacturer commits to providing security updates. The minimum update period must be disclosed at point of sale. Devices that do not meet these requirements cannot legally be sold in the UK.

A compromised smart home system provides an attacker with information and access that bypasses physical security measures. CCTV with known credentials reveals the security camera layout, patrol patterns, and blind spots. Smart locks with compromised credentials provide physical entry without forced entry evidence. Alarm systems on the same network as compromised IoT devices can be assessed and disabled. Voice assistants record ambient audio that can be accessed if the account is compromised. The attack surface of a modern smart home is substantially larger than it was ten years ago.

Smart locks present several documented vulnerabilities. Z-Wave S0 downgrade attacks – forcing a lock to communicate using the older, weaker S0 protocol rather than the current S2 standard – were demonstrated by Pen Test Partners in research published in 2022. Bluetooth BLE replay attacks affect locks that use simple challenge-response authentication. Cloud-dependency means that a compromised cloud account (often via phishing or credential stuffing) provides remote access to the lock. Physical key override is generally maintained on quality smart locks but is sometimes absent on lower-cost devices.

NCSC home network guidance recommends segregating IoT devices onto a separate network segment (VLAN) from computers, phones, and storage devices. This means that a compromised IoT device – a smart TV, a connected printer, or a building automation controller – cannot directly access the devices on the main network. All IoT devices should have their default credentials changed on setup, be placed on the dedicated IoT VLAN, and have firmware update schedules monitored. Devices that no longer receive manufacturer security updates should be removed or isolated.

Shodan (shodan.io) is a search engine for internet-connected devices. It indexes IP addresses and open ports, allowing anyone to search for exposed CCTV cameras, smart home hubs, alarm panels, and other devices with internet-facing interfaces. Multiple research projects have demonstrated that significant numbers of residential CCTV cameras and home automation systems appear on Shodan with default credentials. A basic Shodan search for a property’s IP address range will reveal which, if any, of its smart devices are exposed to the public internet.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.