admin / admin
That's the default password of a temperature sensor deployed on a West African IoT project I audited last year. The sensor was connected to the same network as the database server. No encryption. No segmentation. A three-line script was enough to access all the system's data.
This isn't an isolated case. It's the norm.
18.5 billion and a wide-open door
The African IoT market has exceeded 18.5 billion USD. Nine African cities rank in the Smart City Index 2026. Kigali deploys smart meters for 22,000 residents. Lagos is building Eko Atlantic with an autonomous energy network.
The continent is connecting at an impressive pace. The problem is that nobody's locking the door on their way out.
The painful numbers
| Indicator | Value | |---|---| | Annual GDP lost to cybercrime | 10% | | Cumulative losses 2019-2025 | > 3 billion USD | | Cybersecurity market growth | 13.3% / year through 2031 | | Professionals to train (Microsoft target) | 1 million |
Three vulnerabilities I see everywhere
I worked on Netflow & Security Optimizer. I deployed IoT sensors on GEOWATCH. Here's what I consistently find in the field:
1. Ghost firmware 👻
You deploy a sensor in March. In December, it's still running the same firmware. No automatic updates, no OTA push channel. Nine months of unpatched vulnerabilities. Multiply that by 200 sensors and you have a security nightmare.
2. Naked MQTT 📡
The MQTT protocol is everywhere in African IoT. Lightweight, efficient, perfect for limited bandwidth. But in the majority of deployments I've seen, it runs without TLS. Messages travel in cleartext. Anyone with a sniffer and ten minutes of patience can read the traffic.
# What we see too often:
mosquitto_sub -h 192.168.1.100 -t "sensors/#" -v
# What it should be:
mosquitto_sub -h 192.168.1.100 -t "sensors/#" -v \
--cafile ca.crt --cert client.crt --key client.key
3. The flat network 🔓
IoT sensors, application servers, database — all on the same VLAN. One compromised camera = the entire network compromised. I've seen architectures where a connected thermometer had access to the same resources as the production server.
What I learned in the Ivorian field
On GEOWATCH, IoT sensors face a cocktail of constraints that cybersecurity manuals never address:
-
⚡ Intermittent connectivity — the sensor loses network for hours. It stores data locally. When it reconnects, it sends everything at once. During this buffer period, data is vulnerable.
-
☀️ Unstable solar power — a sensor that restarts three times a day due to power cuts can't maintain a stable TLS session.
-
🌡️ Hostile physical environment — heat, humidity, dust. Hardware fails before software.
Security designed for a climate-controlled datacenter doesn't work in a field in Yamoussoukro. Protocols need to be rethought for degraded environments.
The solution isn't to slow down
I reject the alarmist narrative that says "stop connecting before you secure." No. The continent can't afford to wait. But it can integrate security from day one:
| Rule | Implementation | Additional cost | |---|---|---| | 🔐 Mandatory encryption | MQTT over TLS min. Otherwise DTLS/CoAP | ~5% | | 📦 OTA or nothing | If no remote updates, don't deploy | ~5% | | 🧱 Micro-segmentation | One VLAN per sensor type + firewall | ~5% |
Total: about 15% more on the initial budget.
The cost of a breach? Ask the companies that lost 3 billion USD.
The choice is quickly made.
Further reading: