When it comes to security, most smart home device makers are paying attention to basic cybersecurity best practices with 84% of 80 manufacturers providing security researchers with an easy-to-find method to contact them to report security vulnerabilities. Two-thirds are following industry best practices, and have a formal vulnerability disclosure program that details exactly how they communicate with security researchers. 

For the third year, Consumer Reports has investigated how smart home companies handle security vulnerabilities and those who report them. For the first two years we tracked the same companies, but this year we added a few companies (bolded in the lists below) and took out a few that have been purchased or shut down. This change left us with 80 companies, a slight rise from 75 tracked in the prior two years.

To discover what companies had dedicated security contacts, we searched Google and the search term ”[company name] report a security vulnerability.” If the search didn’t turn up anything we scanned the site’s privacy policies, terms of service, and forums for dedicated points of contact to report bugs.

We then followed up with letters to each manufacturer, including a questionnaire designed to assess how mature their vulnerability disclosure program is. We gave companies 15 days to respond and then nudged them again via email, giving them an additional two weeks. Then we compiled the data and created this blog post. We heard from 25 of the 80 companies we contacted—a huge drop from last year when we heard back from 52. In cases where the company did not respond, if there was a vulnerability disclosure program available, we used it to fill out our questionnaire.

Why this research matters

Each year we conduct this research because having an easy-to-find security contact can improve overall cybersecurity for consumers, but also everyone else. Foreign agents are increasingly targeting smart home devices to help launch attacks on US businesses, healthcare and even water utilities. So when security researchers find vulnerabilities in smart home gear, having an easy way to tell the company can lead to faster patches. It also is a good barometer for how much a company cares about securing their products.

“Having a dedicated security contact is essential to ensure that reported vulnerabilities don’t fall through the cracks and reach the right people. Efficiency has become increasingly critical, as AI enables less technical actors to execute more sophisticated attacks that can require rapid response,” says Steve Blair, Privacy and Security Test Program Leader at CR. 

While the number of companies without a dedicated security contact is 11 this year, up from 10 last year, we did see sprinkler company Orbit/B-hyve and the maker of Genie garage doors add a dedicated security contact. This is great. Disappointingly, we have seen a few companies persistently fail to add a dedicated security contact despite being called out in the prior two years. They include three fitness companies, a lock maker and a smart TV manufacturer. Those companies are marked with an asterisk. 

Aerogarden*
Hydrow*
Lockly*
Moes
Rachio (now owned by Rain Bird)
SleepNumber*
Tempo*
Third Reality
Tonal*
Vizio*
Wulian

Moes, Third Reality and Wulian are new to the survey, but are popular purveyors of smart home gear made in China. We have seen The Overhead Door Company, the maker of Genie garage door openers and connected sprinkler maker Orbit/B-Hyve add dedicated security contacts since 2025, possibly in response to new mandatory reporting requirements associated with the EU’s Cyber Resilience Act that went into effect last month. The law requires companies to have a vulnerability disclosure program which would include a dedicated security contact.

We’re seeing more Vulnerability Disclosure Programs 

Letting a company know about a potential vulnerability is just the first step. Consumer Reports also likes to see companies lay out their process for handling reported vulnerabilities. That’s why we also look for companies to have a formal vulnerability disclosure program (VDP). These programs explain how security researchers can report a vulnerability to a company and describe how the company plans to research and remediate the vulnerability.  

A good VDP will dictate how a security researcher should share their findings, and explain how the company typically handles a vulnerability report. Ideally, the VDP should lay out how long the researcher will take to hear from the company after making a report and how the company would like to handle responsible disclosure of the vulnerability. 

This year we’ve seen a general improvement in how quickly companies respond to researchers. Many are responding within three days. This is good, given that AI is shortening the time frame between reports of vulnerabilities and their exploitation. Companies still have to assess, develop, and then apply patches for these vulnerabilities. 

Vulnerability disclosure programs also lay out the company’s idea of ethical behavior for security researchers and assure researchers that if they follow the guidelines, the company will not sue. Some give time frames on how long it will take to mitigate a vulnerability.

This is such an accepted and core tenet of good cyber hygiene that it is part of National Institute of Standards and Technology (NIST) recommendations for consumer IoT products, and will likely be required for companies seeking to get certified to use the planned  U.S. Cyber Trust Mark. The U.S. Cyber Trust Mark is a program created by the Federal Communications Commission that will indicate that a connected device meets certain security standards after undergoing testing by a third-party lab.

The following companies have a dedicated security contact, but do not yet have a formal vulnerability disclosure program leaving 27 of the 80 companies we surveyed without a formal VDP. Some of these companies have some elements of a good vulnerability disclosure program, such as disclosed response times or whether or not they sue researchers, but not both. Others provide most aspects of a formal vulnerability disclosure program through a bug bounty program. A robust VDP will:

• communicate receipt of a vulnerability report with the reporting security researcher within one week;
• share the company bug mitigation plan with the researcher including if they plan to mitigate it and communicate the bug to consumers;
• avoid non-disclosure agreements for researchers;
• and encourage researchers to report by pledging not to pursue legal action against those who conduct their research while following the best practices listed in the publicly available VDP.

Additionally as part of good cyber hygiene, a manufacturer should create a program to track vulnerabilities over time in their products. When vulnerabilities are found, they should test other products that may use the same software for the vulnerability and plan mitigation for those products. Only a third of the 80 companies we investigated are definitively doing this. 

AssaAbloy (Kwikset)
Delta
Ecobee
EightSleep
Eufy/Anker
Fortune Brands (Yale/August)
Garmin
Ge Cync (Savant)
Hasbro
Kohler
Lutron
NordicTrak
Orvibo
Sony
Trane
Vivint 

Finally, a limited 21% of the 80 companies we surveyed use security.txt, which is a default “contact us” page for security researchers. These web pages are created by adding  /.well-known/security.txt to the site. Security.txt is an official standard under RFC 9116 by the Internet Engineering Task Force (IETF). This is a relatively new standard, but it’s helpful because it allows security researchers to avoid searching for contacts or vulnerability programs. In an era where searches can lead to hallucinated AI results, having a security.txt file saves time and provides confidence. 

The remainder of the 80 companies listed below have both a dedicated security contact and a formal vulnerability disclosure program. Ideally we’d like to see all companies have these. 

Abode
ADT
Afero/Home Depot
Allegion plc (Schlage Lock Company)
Amazon
Apple
Aqara
Arlo Technologies
Bissell
Bosch
Chamberlain Group
Comcast
D-Link
Dreame/Mova
Ecovacs Robotics Co., Ltd.
Electrolux/Frigidaire
Eve
Feit Electric Company Inc
FisherPrice/Mattel
GE Appliances, a Haier company
Genie / Overhead Door
Google Nest
Govee
Hisense
Home Assistant
Ikea
IRobot
Kidde/Carrier
LG Electronics USA
Meross
Miele
Nanoleaf
Orbit/B-hyve
OwletCare
Peloton
Reolink
Resideo Technologies
Roborock
Roku
Samsung
Schneider Electric
Shark
Shelly
Signify
SimpliSafe
SwitchBot
Sylvania / Ledvance
TP-Link Systems Inc.
Tuya
Whirlpool Corporation
Wyze
Yeelight (Xiaomi)
YoSmart (YoLink)

Details matter too

As part of the research, we also asked 14 questions designed to understand how mature manufacturers’ vulnerability programs were and how they treat security researchers. Not all companies answered every one of the questions, and many of the published vulnerability disclosure programs don’t include all the information we were looking for. So the results only cover 25 of the companies we had information for. This was less than last year, when we had information from 52 companies.

Below are the questions that we asked and the results from the survey. We also provide information on why each of these elements are important for boosting the overall cybersecurity of consumer IoT products. We included this information in last year’s report too.

The first step in creating any form of vulnerability disclosure program (VDP) is ensuring that reports of security vulnerabilities make it to a monitored inbox in the company, and that researchers can find this point of contact. No researcher wants to see their vulnerability report end up in a spam filter or junk folder, and no company wants to miss out on a potentially big vulnerability simply because a researcher couldn’t find out how to tell anyone at the company about the problem. However, simply having a dedicated, findable point of contact isn’t enough. A company should also have a process and resources in place to respond to security vulnerability reports. This is why we ask the following questions.

Security.txt is a proposed standard (RFC 9116) that allows websites to define security policies, and provides contact information for security researchers to report vulnerabilities. 

Having a dedicated point of contact for researchers to share vulnerabilities is only the first step. A strong VDP also needs to have a process in place for accepting, validating, and responding to vulnerability reports. A simple acknowledgement of receipt is a good first step, but a stronger program will include a statement indicating that the company will validate the bug and issue some kind of response within a set time frame. Ideally the response will also note how long the company plans to take to remediate the problem. 

As mentioned above, it’s not enough to simply accept the report of a security bug. A responsible company will let the researcher know how long it will take before the researcher hears back from the manufacturer. This step is even more important if the vulnerability is actively being exploited.

This time frame can vary. Security researchers typically wait to hear back from a company before publishing their findings, absent follow-up from a manufacturer, often providing weeks or months before publishing results. The length of time it takes to respond can drag this process out even longer, so consumers are not only left vulnerable but can be left unaware of how they’re vulnerable. 

Some companies have a deadline by which they must respond but work faster in practice, while others repeatedly miss the time frames they have set. Looking at the average response time can give a better sense of how long responses take.

When a vulnerability is reported, how long does it take for your company to fix the vulnerability?

Companies were given the option to fill in the blank for this question, and most answers were some variation of “it depends on the severity and complexity of the vulnerability.” This makes sense. More severe bugs are often fixed faster, and more complicated vulnerabilities can take more time to mitigate. We did see a little more than a dozen companies provide a classification system for bugs and provide a specific time frame based on the criticality of the bug, which is in line with best practices.

Researchers participate in vulnerability disclosure programs for a variety of reasons, but a big reason to report a bug is to ensure that the bug gets fixed. Providing a commitment to mitigate a vulnerability within a reasonable time frame (most programs use 90 days and can also provide a 14-day grace period) shows that the company is committed to fixing the problems that researchers share with them.This ultimately protects the end users, and improves security outcomes broadly across society by eliminating weak links that can be exploited. 

Researchers may come to a company reporting a vulnerability in a specific product. But that vulnerability might extend to other products as well. A robust vulnerability disclosure program will take steps to assess whether or not the vulnerability extends across the company’s product portfolio and then commit to fixing it.

While not strictly necessary, active engagement with the security community indicates a recognition that securing connected products is an ongoing effort, and that the company wants to ensure its products stay secure. Additionally, participation in a bug bounty program where a company pays “bounties” to security researchers when they report vulnerabilities, can incentivize researchers to report found vulnerabilities as opposed to selling them to the highest bidder. Such programs also provide the exact terms of how the vulnerability disclosure program works, making it easier for researchers to see what they can expect from a program. BugCrowd and HackerOne are services that can help your company create and manage a bug bounty program. 

It is great for companies to proactively reach out to security researchers and solicit feedback, or even incentivize it. But what’s more important is using the research after it’s collected and compiled to make improvements.

Most VDPs provide researchers an assurance that if they tell the manufacturer about the bug, document it, and give the manufacturer time to remediate the bug, they will not take legal action against the researcher. This creates a beneficial relationship between the manufacturer and the security research community, and ensures that when people find problems, they feel safe reporting them. Having a set and delineated policy also helps ensure that researchers come to the manufacturer first when they find vulnerabilities.
Forcing researchers to sign non-disclosure agreements will lead security researchers to avoid reporting vulnerabilities. It can signal an adversarial relationship with researchers, and also can tie researchers’ hands should the company decide not to fix a vulnerability, although ideally companies would issue security advisories after they validate reports of a vulnerability and issue a patch.

Tracking vulnerabilities over time can help a company understand how well it (or its partners) are incorporating security into their design processes, as well as ensuring that there is a record of potential vulnerabilities that can be shared with other organizations if merited. Additionally, tracking vulnerabilities helps prevent the same vulnerabilities from popping up again and again.

Consumer Reports often finds sets of common vulnerabilities across products using the  same third-party software provider. We’d like to see companies have a mechanism in place for communicating vulnerabilities back to their software providers and then implementing patches when they become available.

The next steps

Given laws passed in the EU and absent laws passed in the U.S., it’s hard to imagine the companies that have persistently failed to adopt the bare minimum required for addressing security vulnerabilities found by outside researchers will suddenly do so. Still we encourage smart TV maker Vizio, connected lock maker Lockly, connected gym equipment makers Hydrow, Tonal and Tempo, and other businesses making smart home gear to post dedicated security contacts somewhere. 

And while they are doing so, they should also adopt a vulnerability disclosure program, along with the 16 other companies who have not done so yet. Hackers are using artificial intelligence to find and exploit vulnerabilities with more rapidity, so it’s essential that companies give security researchers the tools to help them report found flaws quickly.