--- title: "Connected devices playbook · Agent Wranglers" url: https://agentwranglers.se/playbook/connected-devices parts: 8 tokens_total: 6807 updated: 2026-10-22 tokens: 1473 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Connected devices playbook For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Playbook](https://agentwranglers.se/playbook.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. A connected devices playbook for any product with firmware that talks to a network. That covers smart home gadgets, wearables, sensors, meters, trackers and the cloud service and app behind them. The chapters run from the factory to the end of support. They cover device identity, onboarding, firmware updates, the link to the cloud and the local network. Then come fleet monitoring, sensor data, support periods and vulnerability reports. A device sits in someone's home for years, often unwatched. One shared password or one unsigned update can turn a whole product line into a botnet overnight. Most rules here keep each device separate, so a stolen key or a hijacked unit stays one problem instead of a million. Laws now set a floor for these products. ETSI EN 303 645 is the European baseline for consumer devices. The EU's radio equipment rules have required cybersecurity for internet-connected radio products since 1 August 2025. The Cyber Resilience Act takes over from 11 December 2027, and the [compliance playbook](https://agentwranglers.se/playbook/compliance/product-and-sector-laws.md) holds those duties. Start with [Give every device its own credentials](https://agentwranglers.se/playbook/connected-devices/device-identity/unique-device-credentials.md). Then read [Verify the firmware signature on the device](https://agentwranglers.se/playbook/connected-devices/firmware-updates/signed-firmware.md) before your first update ships. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers connected devices playbook`. In code you write, add a comment next to it with the same link. ## Chapters 1. [Device identity](https://agentwranglers.se/playbook/connected-devices/device-identity.md) · 4 rules · 726 tokens · updated 2026-10-22 Give every device its own password and key, kept in secure hardware. Ship no shared secret in firmware, and plan certificates for the device's whole life. 2. [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md) · 4 rules · 819 tokens · updated 2026-10-22 Register every device at the factory and let only the person holding it claim it. Send network details encrypted, and wipe everything on reset. 3. [Firmware updates](https://agentwranglers.se/playbook/connected-devices/firmware-updates.md) · 6 rules · 1,016 tokens · updated 2026-10-22 Install only signed firmware and keep the old version until the new one works. Refuse old versions, and roll out in stages that stop on bad numbers. 4. [Device to cloud](https://agentwranglers.se/playbook/connected-devices/device-to-cloud.md) · 8 rules · 1,243 tokens · updated 2026-10-22 Connect each device with its own certificate and topics. Spread reconnects, notice who is offline, keep working without the cloud and distrust the device clock. 5. [Local network exposure](https://agentwranglers.se/playbook/connected-devices/local-network-exposure.md) · 4 rules · 749 tokens · updated 2026-10-22 Open no port the product does not need and never ask the router to let the internet in. Lock debug ports at the factory, and announce little. 6. [Fleet monitoring and control](https://agentwranglers.se/playbook/connected-devices/fleet-monitoring-and-control.md) · 4 rules · 796 tokens · updated 2026-10-22 Know each device's version and last contact, and alert on fleet-wide changes. Cut off one device alone, and switch risky features off with a signed command. 7. [Sensor data and privacy](https://agentwranglers.se/playbook/connected-devices/sensor-data-and-privacy.md) · 4 rules · 792 tokens · updated 2026-10-22 List every sensor and every field a device sends, and compute on the device. Keep location coarse, and ask before a camera or microphone turns on. 8. [Support and vulnerability reports](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports.md) · 3 rules · 666 tokens · updated 2026-10-22 Publish an end date for security updates on every model and plan what happens after it. Make every report and advisory name model and firmware. See all 37 rules on one page in the [checklist](https://agentwranglers.se/playbook/connected-devices/checklist.md). This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md). ## Related playbooks - [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws.md) in the Compliance and governance playbook. The Cyber Resilience Act and the Data Act set legal duties for devices sold in the EU. That chapter holds the scope, reporting and support rules. - [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md) in the Desktop apps, extensions and CLIs playbook. Desktop updates face the same attacks as firmware. Signatures, refusing old versions and staged rollouts work the same way. - [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup.md) in the Adversarial testing playbook. Firmware is built from many third-party parts. Lock and audit them, and keep a bill of materials for every release. - [Alerts and on-call](https://agentwranglers.se/playbook/operations/alerts-and-on-call.md) in the Operations and observability playbook. A fleet of devices needs the same alerts as a server fleet. Alert on what owners feel, and make every alert actionable.