1. Did you change default admin passwords on each device?

Yes No / Not sure

#1 IoT botnet recruitment path.

2. Is each device running current firmware?

Yes No / Not sure

Old firmware = known CVEs.

3. Is the IoT network segmented from your laptops?

Yes No / Not sure

One compromised doorbell should not see your banking tabs.

4. Is MFA enabled on the associated cloud account?

Yes No / Not sure

Most brands support it — turn it on.

5. Is the brand still receiving firmware updates?

Yes No / Not sure

Abandoned no-name brands are a ticking clock.

6. Are app permissions reviewed (mic, camera, location)?

Yes No / Not sure

Many IoT apps grab permissions they do not need.

7. Do you disable features you don't use (two-way audio, voice)?

Yes No / Not sure

Reduce attack surface to what's actually needed.

8. Is the device model not on any known-vulnerable list (Shodan, CISA)?

Yes No / Not sure

Look up the model number before buying.

9. Do you physically unplug / power-down the device when away?

Yes No / Not sure

For cameras especially — simple off switch.

10. Can you export or delete cloud-stored recordings?

Yes No / Not sure

Data portability matters if the brand dies.

IoT Device Risk Checker