A modern house contains somewhere between forty and three hundred networked devices. Cameras, locks, TVs, speakers, thermostats, robot vacuums, an EV charger, a solar inverter, several appliances that had no business being connected.
In the overwhelming majority of houses, all of them sit on one flat network alongside the laptops with the bank details on them.
Why that is worse than it sounds
The problem is not that a smart plug is likely to be attacked. It is what a compromised device can reach.
A flat network means any device can talk to any other. It can scan for open shares, attempt default credentials against the NAS, watch traffic, and pivot. The plug does not need to be interesting; it needs to be a doorway.
And these devices are, as a class, poorly maintained. Firmware ships with known vulnerabilities. Updates stop after a couple of years. Manufacturers go out of business and their cloud services get sold. You are installing hardware with a defined support life into a house with a twenty-year horizon.
What actually helps
Segmentation, first and by a distance. Separate networks for separate trust levels:
- Trusted — family laptops, phones, work machines
- Home systems — the control system, lighting, heating, the rack
- IoT — everything cheap and cloud-dependent
- Cameras — kept apart because they see the most and are frequently the worst maintained
- Guest — internet only, no visibility of anything else
Then default-deny between them, and open only what is actually needed. The control system needs to reach the IoT network; the IoT network never needs to reach the family laptops. A compromised bulb should be able to talk to its manufacturer's cloud and nothing else in the building.
Keep camera recording local. An NVR in the rack, with the cameras firewalled from the internet entirely. Most consumer cameras phone home constantly and store footage on somebody else's servers under terms that change. There is no reason a camera covering your children's garden needs an outbound route.
Block outbound, not just inbound. Everyone firewalls inbound. Few people restrict what devices can initiate. Outbound rules are how you find a device that has started reporting somewhere new — and how you stop it.
Assume no updates. Specify on the basis that firmware will stop being maintained. If a device becomes a liability in five years, the network design should mean you can leave it in place, contained, rather than rip it out.
Change the credentials. Tedious, obvious, and routinely skipped on the twelfth device of a long install day. The default password on a rack-mounted switch is not less serious for being boring.
What does not help much
Consumer "smart home security" subscriptions. Largely a scanner and a monthly fee. They do not segment anything.
VPNing everything. Adds complexity and a new single point of failure without addressing lateral movement inside the house.
Choosing a single brand. Better than nothing, but it substitutes one vendor's judgement for a design decision. Their breach is then your breach.
The uncomfortable part
Doing this properly means managed switches, a real firewall, VLANs, and an hour or two of thought at design stage. It is genuinely not expensive — the hardware cost is trivial against a lighting budget — but it has to happen when the network is designed, because retrofitting segmentation into a finished house means re-addressing every device in it.
It is also completely invisible. Nobody has ever walked into a house and admired the VLAN layout. It remains the single highest-value decision on the network, and the one most often skipped because it does not show.