Before buying a smart device, find its security update end date, check how you set a password, look for a published way to report security issues, and see whether it works without remote access. A product that answers these clearly is safer than one that does not.
The ten questions
- How long will the maker provide security updates? Look for an end date. The NCSC advises checking this before you buy.
- Does setup make me choose a password, or is it unique per device? In the UK, covered products must use unique per product passwords or let the user define them.
- Can the device update automatically? The NCSC advises turning on automatic updates where available.
- Does the maker publish how to report security issues? UK rules require this for covered products.
- Does it support two step verification on the account? The NCSC advises turning it on if offered.
- Can I turn off remote access? The NCSC advises doing so if you do not need it.
- Does it keep working at home if the internet drops? ETSI EN 303 645 says devices should remain operating and locally functional in the case of loss of network access.
- Are its sensors documented? The standard says all external sensing capabilities, such as cameras and microphones, shall be documented clearly.
- Can I erase my data from it simply? The standard says users shall be able to erase user data from the device in a simple manner.
- Is it from a brand I can identify? The FBI lists unrecognizable brands among the indicators in its BADBOX alert, alongside other signs.
How to score
Give one point for each clear yes. A device with fewer than seven is worth pausing on. Do not treat the number as scientific. It is a prompt to ask more questions and to prefer products whose makers are open.
Applying it to three common products
For a camera, put questions 1, 5, 6 and 8 first. It watches your home, so support, account protection, remote access and a clear statement of its sensors matter most.
For a smart speaker, questions 1, 8 and 9 lead. It has a microphone, so you want to know how it documents that and how you erase its data.
For a plug or bulb, questions 1, 2 and 10 are enough. The device does little, but it still sits on your network, so it should be updated and from a brand you can identify.
Where to find answers
- The product page, the box, and the manual.
- The maker's support and security pages.
- The companion app's settings screens before you buy, if the app is available.
- Customer questions on the retailer page, with care.
Weigh the rest
A good score does not replace the basics once you own it. Change the default password, turn on automatic updates, and keep a note of the support end date. Our other posts cover each step.
Quick check
Which single question matters most?
The update end date. Without updates, every other protection decays as new flaws are found.
What if the maker answers none of these?
That is information too. Consider a product whose maker publishes more.
Sources
- NCSC: Smart devices, using them safely in your home
- GOV.UK: The UK product security regime
- ETSI EN 303 645 V2.1.1 (2020-06)
- FBI IC3: BADBOX 2.0 public service announcement, June 2025
Last reviewed: 19 October 2026.
