These are particularly important because they connect all your other devices to the internet. Buy from reputable suppliers, change administrator passwords, install firmware updates, disable remote administration unless needed, and replace equipment that no longer receives security updates.

Check whether the product requires a cloud account, where recordings are stored, who can access them, and how long security updates will continue. Put devices with little need to communicate with your computer on a separate guest Wi-Fi network where possible.

Buy through established suppliers, keep operating-system and firmware updates current, and avoid unknown USB devices. For sensitive work, prefer devices with a clear support period and a manufacturer that provides security advisories and signed updates.

The UK's consumer smart-device rules, in force since April 2024, require covered products to avoid universal default passwords, provide a way to report security issues, and disclose the minimum period for security updates. These are useful baseline protections, not a guarantee that a product is free of malicious functions.National Cyber Security Centre

Software can be dangerous even when downloaded from a legitimate website. An attacker might compromise the supplier, an update server, a developer's account, or a third-party software component.

• Use official sources. Download applications from the developer's official website or a trusted app store. Avoid pirated software and unofficial installers.
• Keep software supported and updated. Turn on automatic updates where appropriate, including for browsers, phones, operating systems and website components.
• Limit permissions. A simple utility should not need access to all your files, contacts, microphone and location.
• Use multi-factor authentication. Prioritise email, financial accounts, cloud storage, website administration and password managers.
• Remove what you don't use. Unneeded applications and browser extensions increase the attack surface.
• Back up important information. Keep at least one backup separate from the computer or network it protects, and test that you can restore it.

For businesses, the UK's Software Security Code of Practice also recommends secure development, testing updates before distribution, and tracking third-party software components.GOV.UK

This is the issue about hostile foreign manufacturers.

Imagine a manufacturer supplies a perfectly functional internet router. There are several possible risks:

• Risk A - deliberate access

The device might contain undocumented remote-access functionality or collect more information than its owner expects.

• Risk B - compromised supply chain

A legitimate product, software library, update server or supplier account is compromised by an attacker. The manufacturer itself may be an innocent victim.

• Risk C - exploitation after sale

A vulnerability is discovered later, allowing criminals or state-sponsored attackers to take control of the device.

This is not merely theoretical. In April 2026, international cyber agencies warned that China-linked groups were using compromised everyday internet-connected devices, including routers, to conceal cyberattacks. That demonstrates the risk of compromised devices; it does not mean that every device made in China is malicious.Reuters

The difficulty is that an ordinary consumer cannot reliably inspect a device's firmware or prove that its hardware contains no hidden functionality.

The practical answer is to reduce how much you must trust any one manufacturer. Keep devices updated, restrict their network access, separate sensitive systems, monitor unusual behaviour where possible, and have a way to replace a supplier or product.

For certain sensitive uses, restrictions can be justified. But I would not apply the same rule to every product.

The country where a product is made is only one factor. Others include the manufacturer's ownership, legal obligations, relationship with the state, transparency, update practices, and whether an adversary could exploit the product's position in a network.

The UK's National Cyber Security Centre provides a framework for assessing connected-device security and supplier risks. NCSC supply-chain security guidanceNational Cyber Security Centre

Prioritise five measures:

1. Independent testing: test high-risk devices and software, including their update mechanisms and data flows.
2. Long-term support requirements: require manufacturers to provide security updates for a declared, appropriate period.
3. Supplier transparency: require vendors of critical systems to disclose important dependencies, security practices and ownership information.
4. Reduced dependency: avoid relying on a single supplier or country for technology essential to national infrastructure.
5. Replacement plans: ensure that government departments, utilities and businesses can remove a compromised supplier without losing essential services.

No test can prove that a complex product is completely free of hidden vulnerabilities. The aim is to make attacks harder, detect them sooner and limit the damage.

For a household or small business, I would start with the following checklist.

Security checklist

• Secure the router

  Change administrator credentials, update firmware and disable unnecessary remote access.

• Review connected devices

  List cameras, smart TVs, doorbells and appliances; check their update support.

• Secure important accounts

  Use unique passwords and multi-factor authentication, especially for email and banking.

• Review applications

  Remove unknown browser extensions and unnecessary apps; install updates.

• Separate devices

  Use guest Wi-Fi for smart devices where practical.

• Protect recovery

  Keep offline or otherwise isolated backups of important files and test restoring them.