What Is IoT? Definition, How It Works, and Examples

The Internet of Things (IoT) is a system of physical devices that use sensors or actuators, software, and network connections to exchange data and support an action. The action might occur on the device, through a nearby gateway, in a remote service, or after a person reviews the information.

NIST's practical boundary is useful: an IoT device has at least one transducer—a sensor or actuator—that interacts with the physical world and at least one network interface that connects it to the digital world (NIST Cybersecurity for IoT FAQ).

That definition covers a temperature logger, connected valve, smart lock, industrial vibration node, vehicle tracker, and many other devices. It does not mean that every object with electronics is IoT.

The four-part IoT model

Most IoT systems can be understood as four connected parts.

1. Device, sensor, or actuator

The physical device contains one or more inputs and outputs. A sensor observes the physical world—for example temperature, movement, light, position, or pressure. An actuator changes something—for example a relay, motor, valve, display, or speaker. NIST uses “transducer” as the umbrella term for sensors and actuators (NISTIR 8259 glossary).

The device also needs computing hardware and firmware. A microcontroller may sample a sensor and sleep between readings; a Linux single-board computer may aggregate cameras, run a local database, or act as a gateway.

2. Connectivity

Connectivity moves commands and observations between system components. The right connection depends on range, data volume, latency, power, coverage, installation, and who operates the network.

Connection	Common fit	Important limitation
Wi-Fi	Buildings with existing local networks and moderate data needs	Coverage, credentials, and power use must fit the device
Bluetooth Low Energy	Nearby phone setup, wearables, beacons, and local sensors	Usually depends on a nearby controller or gateway for remote access
Ethernet	Fixed gateways, industrial cabinets, and reliable local backhaul	Requires cable installation and compatible electrical design
Cellular	Mobile or remote devices that need operator coverage	Subscription, coverage, antenna, certification, and energy planning matter
LoRaWAN	Small, infrequent messages from wide-area, battery-operated nodes	Not designed for high-bandwidth streaming; regional parameters and network access matter

The Bluetooth SIG describes Bluetooth LE systems as using advertising, point-to-point connections, or both (Bluetooth LE Primer). The LoRa Alliance describes LoRaWAN as a low-power wide-area architecture for connecting battery-operated things and publishes separate link-layer, backend, regional, and certification specifications (LoRaWAN for developers).

3. Processing and decision

Software turns readings into meaning. Processing can happen:

• on the device, such as debouncing a switch or calculating a rolling average;
• at the edge, such as a local gateway recognizing an abnormal pattern;
• in a service, such as comparing many devices over time; or
• across all three, with local safe behavior and remote fleet analysis.

Devices often exchange application messages rather than raw electrical signals. MQTT is one option: OASIS defines it as a lightweight client-server publish/subscribe messaging transport used in constrained and IoT environments (MQTT Version 5.0). MQTT does not select the sensor, create security policy, or guarantee delivery by itself; those are broader system decisions.

4. Action and feedback

An IoT system becomes useful when the data changes what happens next. It might:

• notify a person;
• update a maintenance queue;
• adjust a non-safety-critical setpoint;
• record evidence for later analysis; or
• command an actuator within defined limits.

Good systems also feed the outcome back into the loop. A valve command should be followed by position or flow evidence; an alert should be acknowledged; a failed transmission should be retried or stored locally.

How IoT works step by step

Consider a connected room-temperature monitor:

1. Measure: the sensor converts a physical condition into a digital reading.
2. Validate: firmware checks range, timing, and sensor status.
3. Package: the device adds an identifier, timestamp or sequence, and useful context.
4. Transmit: Wi-Fi, Bluetooth LE, Ethernet, cellular, or LPWAN carries the message.
5. Authenticate and receive: a gateway or service identifies the device and applies access rules.
6. Store or analyze: software displays the reading, derives a trend, or evaluates a rule.
7. Act: a person receives a notification or an approved controller changes an output.
8. Observe the result: the system records whether the action occurred and whether conditions changed.

Real designs also account for clock drift, duplicate or delayed messages, power loss, full local storage, network outages, firmware updates, device replacement, and retirement. A successful demo on a desk is only the beginning of a maintained product.

IoT device vs ordinary connected device

Not every networked product is usefully described as IoT.

Question	Ordinary networked endpoint	IoT system
Interacts with the physical world?	Not necessarily	Uses a sensor, actuator, or both
Produces physical observations?	May only display or transfer information	Commonly measures state or events
Causes a physical or operational action?	May not	Often alerts, schedules, controls, or records
Designed as part of a device fleet?	Optional	Frequently needs provisioning, monitoring, updates, and retirement

A laptop visiting a website is connected, but the website does not make the laptop an IoT deployment. A networked sensor that measures a freezer and creates an inspection task is clearly part of one. A smartphone often acts as an IoT controller, gateway, user interface, and sensor platform even though it is normally categorized as a general-purpose computer.

Six practical IoT examples

Smart thermostat

It measures temperature and possibly occupancy, receives user preferences, and controls compatible heating or cooling equipment. The useful outcome is responsive comfort control. The design still needs equipment compatibility, safe local behavior, and a way to operate when remote services are unavailable.

Connected plant monitor

It samples soil moisture and room conditions, sends readings to a dashboard, and reminds a person to inspect or water the plant. This is a suitable learning project because the action can remain human-led. Soil readings depend on probe type, placement, salinity, and calibration, so one threshold is not universal.

Industrial vibration node

It captures acceleration on a supervised machine, calculates features or sends samples, and highlights a change for maintenance review. It can improve visibility between inspections, but it is not automatically a predictive-maintenance system and must not bypass machinery safety procedures.

Asset tracker

It combines a location source, motion sensing, and cellular or LPWAN connectivity to report a test asset's position and device health. Coverage, antenna orientation, indoor location uncertainty, battery state, privacy, and data retention limit what the map can prove.

Smart irrigation monitor

Field nodes send soil and environmental readings to a gateway. Software combines readings with agronomic rules and weather information to recommend watering. The benefit is more informed scheduling; the limitation is that sensor depth, soil type, crop stage, hydraulic performance, and local expertise remain essential.

Building energy dashboard

Approved meters or interfaces provide interval data that software groups by area or equipment. Operators use trends to investigate unusual loads. Electrical measurement and installation require appropriate equipment and qualified work; a hobby sensor is not a billing or protection instrument.

For a broader set of use cases, see 20 real-world Internet of Things examples.

Benefits of IoT

IoT can create value when the physical question and action are clear:

• Visibility: observe equipment, rooms, shipments, or environments between manual checks.
• Faster response: route a meaningful exception to the right person.
• Consistency: apply the same collection and decision rules across many devices.
• Remote operation: change approved settings without visiting every location.
• Evidence: keep time-series records for maintenance, research, or process improvement.
• New services: combine a physical product with monitoring, support, or usage-based workflows.

These are possible benefits, not automatic outcomes. Bad sensors create bad data; unnecessary alerts are ignored; automation without ownership creates new failure modes.

Limitations and design tradeoffs

Every IoT system adds dependencies. Teams should plan for:

• sensor accuracy, drift, cross-sensitivity, placement, and calibration;
• battery replacement or energy harvesting assumptions;
• radio coverage, interference, roaming, subscriptions, and gateways;
• cloud outages and product end-of-support;
• data volume, storage, retention, and deletion;
• firmware compatibility and staged updates;
• physical tampering and environmental exposure; and
• false positives, false negatives, and responsibility for action.

The full lifecycle matters. NIST's manufacturer guidance emphasizes considering customer cybersecurity needs before sale and supporting products through their lifecycle (NISTIR 8259 Rev. 1).

IoT security and privacy basics

IoT security is not a password added at the end. Start by deciding what the device can sense, control, store, and communicate—and what harm follows if any of those functions are misused.

NIST's core baseline describes a starting set of device capabilities: device identification, configuration, data protection, logical access control, software update, cybersecurity-state awareness, and device security (NISTIR 8259A). A real product tailors those capabilities to its risks and environment.

At minimum, a project plan should answer:

1. How is each device uniquely identified and provisioned?
2. Who can read data, change settings, or command actuators?
3. How are credentials protected and replaced?
4. What happens during a network, server, or power failure?
5. How are software vulnerabilities corrected?
6. What data is truly necessary, how long is it kept, and who can delete it?
7. How is a lost, sold, or retired device removed from the system?

Privacy analysis is separate from security. A secure occupancy sensor can still create an intrusive record. Collect the minimum useful data, communicate the purpose, limit access and retention, and consider whether local processing can avoid sending raw data away from the site.

Start an IoT project

Begin with the physical question, not a favorite board. Write the data, action, range, power source, environment, and failure response first. Then use the IoT Device Finder, Project Idea Generator, and Device Comparison to explore a learning prototype.

Frequently asked questions

What does IoT stand for?

IoT stands for Internet of Things: physical things that use sensing or actuation, computing, and network communication as part of a larger system.

Does an IoT device need a sensor?

It needs a way to interact with the physical world. That can be a sensor, an actuator, or both. A connected relay is an IoT device even if it mainly receives commands rather than measuring temperature or motion.

Is IoT the same as artificial intelligence?

No. IoT collects data and supports actions across connected physical devices. AI is one possible method for interpreting data or choosing an action. Many useful IoT systems use simple thresholds, schedules, and deterministic rules.

What is the best connectivity for IoT?

There is no universal best option. Choose based on range, data rate, latency, power, coverage, mobility, installation, cost, ownership, regional rules, and failure behavior. A battery field sensor and a mains-powered camera have fundamentally different needs.