The widening infrastructure gap in IoT: What professionals reveal in the latest industry report
July 27, 2026
Blog
The annual State of Industrial IoT Device Lifecycle Management report confirms what most professionals in the embedded space already sense: connected products are becoming more complex, regulations are tightening, and organizations still struggle to launch new products to market on time and fast.
However, the data also reveals a more pointed finding. More than 500 qualified respondents describe an industry whose ambitions for connected products are running well ahead of the infrastructure built to support them. Three in five OEMs expect their current device management infrastructure to be inadequate within three years or less. For more than one in ten, that point of failure is less than a year away.
For embedded engineers, that finding maps directly to the systems in the field today.
IoT products are multi-device systems
One data point keeps surfacing across the report: a mere 10% of OEMs describe their IoT products as single-device systems. The remaining 90% work on products comprising multiple devices — anywhere from 2 to 5 and up to more than 10. The typical IoT product is no longer a single endpoint to manage in isolation. It is a system of multiple devices, often heterogeneous in hardware, operating systems, functions, and capabilities, that must be managed as a coherent whole.
The increasing complexity of IoT products affects every lifecycle stage, from design to decommission. At the design stage, the validation, update, and recovery problem transforms entirely. Updating a uniform image to a fleet of identical endpoints is a fundamentally different exercise from coordinating a staged update across a product whose internal devices each have their own memory allocations, bandwidth constraints, and bootloader behaviors. Add an inter-device dependency where one device requires specific details from another, and the complexity increases exponentially. Failure modes multiply, and the consequences of an update going sideways are harder to contain.
Operating system environments are evolving
At the same time, the data indicate that the industry is expanding its operating system (OS) footprint rather than consolidating it. Among operating systems, the Zephyr real-time operating system (RTOS) leads in future growth expectations among the top six most common IoT operating systems. Nearly 60% of respondents anticipate increased adoption of Zephyr over the next 12 months.
Debian and FreeRTOS follow closely behind, with Buildroot and Yocto growth remaining stable. BareMetal stands out as the system respondents expect to use the least, with over one-fifth anticipating a decline in its use.
Not only are IoT products increasing in complexity, but engineers are also increasingly asked to support multiple operating systems simultaneously across an organization’s product portfolio.
Software issues remain the leading source of product delays, and regulation is second
The average IoT product today takes nearly 54 months to move from planning to general availability — 2.7 months longer than the prior year. Software issues (bugs, deployments, security patches, etc.) remain the dominant source of delays, according to more than half of respondents.
The most notable change is the rise of external and regulatory delays. Nearly two in five cited external and regulatory processes, such as compliance, as the reason for product launch delays. Naturally, this is where the EU Cyber Resilience Act (CRA) comes into play. Compliance requirements, certification processes, and documentation overhead are now an active, measurable friction in IoT product delivery. A challenge that, as the report notes, cannot be resolved through engineering effort alone. Treating the CRA as a late-stage activity, to address only after the product is otherwise ready, increasingly puts an on-time launch at risk.
OEMs must adapt how they build IoT products
Nearly half of respondents (48%) rely on in-house built solutions to manage software updates. Another 23% still use manual processes. These findings – when juxtaposed with existing infrastructure instability, increased product complexity, and continuous launch challenges – warrant closer examination.
Together, 71% of respondents rely on manual or bespoke infrastructure to manage updates to their device fleet. When 60% of organizations anticipate infrastructure inadequacy within three years, the critical question is whether these core systems are part of the problem. Will existing device infrastructure continue to work as fleets expand, as hardware architectures diversify, and as regulatory frameworks demand timely, documented, and verifiable updates?
OEMs must assess infrastructure capabilities and stability today to sufficiently manage the IoT products, fleet size, OS heterogeneity, and compliance requirements coming next. The compounding maintenance burden quietly competes for the engineering capacity needed for product innovation.
A candid market reaching maturity
The most interesting trend in this year's data is not the gap itself, but the honesty about it. Self-reported security capabilities declined across the board, even as external audit completion increased — the most plausible explanation being that organizations subjecting themselves to outside scrutiny are discovering issues that prior self-assessments missed. Confidence in EU CRA preparation dropped despite the deadline drawing closer, likely because OEMs are engaging more deeply with what full compliance actually entails. The IoT market is becoming more honest about the distance between ambition and execution. That, in itself, is progress.
For engineers and product leaders evaluating their own device management infrastructure or readiness for the EU CRA, the full report offers a benchmark for where the rest of the market sits — and a clearer view of where gaps are likely to emerge first.
The full 2026: The State of Industrial IoT Device Lifecycle Management report from Northern.tech is available at northern.tech.
Eystein Stenberg is the CTO of NorthernTech, a leader in device lifecycle management, and the creator of Mender, the market-leading solution for robust, secure, and customizable over-the-air (OTA) software updates. With over 15 years of experience in security and systems management, Stenberg has served on the frontlines of some of the largest production environments and possesses in-depth knowledge on solving real-world system security challenges.
