Security in the Air: Understanding IoT Vendor Practices and the Economics of Over-the-Air Updates

Over-the-air (OTA) firmware updates are essential for maintaining IoT device security. However, vendors frequently reduce update frequency and discontinue support before devices reach end of life. Prior work has focused on protocol design and deployment measurements, but has not explained why vendors struggle to sustain long-term update support. Through interviews with 30 IoT vendors and a survey of over 100 practitioners, we examine OTA practices from the vendor perspective. We find that OTA failures stem from fragmented responsibility across multi-tier supply chains, economic constraints that determine support duration independent of security needs, and structural mismatches between component lifecycles and deployment periods. These organizational and economic factors create systematic barriers to security maintenance that technical solutions alone cannot address. Our findings reveal why current approaches to IoT security are insufficient and suggest policy interventions for sustainable update practices.