I&#x27;m confused by your first sentence. Read as you have written it, I think you mean that regulation will hurt <i>innovation</i> in the IoT space, not security in the IoT space, because you&#x27;ve already said that none of these companies have coherent plans for software security today. Regulation won&#x27;t hurt security; it may help it by creating incentive for standardization around secure infrastructure to chip away at the &quot;market rates for this kind of work&quot; which &quot;none of them can afford&quot;.<p>There is good regulation and bad regulation, but regulation <i>can</i> accelerate innovation. With or without regulation, addressing this problem with more standardization of secure software and hardware infrastructure would reduce the need for human assessors (or at the very least, push what they&#x27;re worrying about higher in the stack).  Addressing it with licensing and more humans is probably not the kind of regulation I&#x27;d look for. So could there be bar-raising regulation that encouraged infrastructural solutions that benefited the industry as a whole?<p>I&#x27;d hate to inject insurers into this world, but one way might be to require IoT manufacturers to carry some sort of indemnification against potential consumer damages, and the insurers drive the security quality. In the 1990s, it was insurers, tired of anesthesia-related malpractice losses, who created back-pressure on the profession to put better <i>clinical</i> standards in place, and errors related to anesthesia-related causes dropped, as did premiums for practitioners following the guidelines. Everyone benefited--especially the patients.<p>But in the IoT world today, there are no meaningful incentives around securing devices, and consumers have little influence.