How to Harness AI for IoT Security

By Eden Faingold, Product Manager

Attackers now move faster than teams can patch. AI is helping attackers turn newly disclosed device flaws into working attacks faster, and scan for vulnerabilities across thousands of devices at once. Teams know they need AI to keep up at the same speed and scale. AI can take on more than ever. But how can teams safely hand over control?

From what AI can do to what AI can be trusted to do

The conversation around AI has shifted. A year ago, the race was about finding the AI tool that could do everything. Today, the real question isn’t what AI can do. It’s what AI can be trusted to do.

When it comes to IoT device management and remediation, that question is critical. Firmware upgrades, password rotations, and device restarts have real consequences on a live fleet. A single wrong action can take a site offline or open a door that should stay locked. Give an AI assistant those actions without guardrails and you’ve added an attack surface.

What teams need is AI that works within the same rules, permissions, and accountability as the rest of their operation.

The SecuriThings MCP Server

The SecuriThings MCP Server is how we bring the power of AI to IoT security.

Built on the Model Context Protocol (MCP), the SecuriThings MCP Server lets you work with your device fleet from any MCP compatible AI assistant. Real time availability data, vulnerabilities, firmware upgrades, and every other visibility and remediation capability SecuriThings provides are now available right from your AI assistant.

But the most important part isn't what the MCP Server lets AI do. It's how.

AI under your control

Every task executed through the SecuriThings MCP Server runs through the same platform, with the same controls, as if you executed it directly in SecuriThings:

• Permissions: Every task runs under the permissions of whoever executes it, so AI can never reach a device or action that a user couldn’t reach on their own.
• Approval: Tasks initiated through AI require explicit approval, given on demand or in advance, keeping a human in the loop for every change made to your devices.
• Auditing: Every task executed through AI is recorded in the audit log, so you always know who did what, when, and on which devices.
• Rollback: Every task keeps its built in rollback mechanism, exactly as it works when executed from the platform.

AI comes in through the same front door as your operators, and the same locks apply.

Toward autonomous operations

As AI matures, teams are moving beyond assistants that respond to requests toward autonomous agents that continuously monitor, investigate, and remediate.

SecuriThings brings this approach to IoT device management and remediation through a dedicated skill. It sweeps the fleet for security, availability, and hygiene issues, correlates affected devices to identify root causes, triages vulnerabilities, and recommends fixes matched to each cause. Once approved, it executes the fixes and verifies the results. Findings can be routed to the tools your team already uses, and sweeps can run on a recurring schedule, always within the permissions you've granted.

From single tool to full orchestration

Most teams run several tools - management, security, ticketing, messaging - and moving work between them is slow and manual. The SecuriThings MCP Server works alongside the other tools connected to your AI assistant, so one request can find affected devices, open a ticket, queue the fix for approval, and notify the team. Every step keeps the permissions and controls of the tool it runs in.

Attackers are already using AI at scale. Now your team can too, without giving up control.