Device identity is the quiet foundation everything else in IoT and edge security stands on. A smart-city traffic controller, a factory gateway, a 5G-connected sensor, or a fleet of point-of-sale terminals is only as trustworthy as its ability to prove what it is, prove that the software it runs has not been tampered with, and prove it to a remote system that has never physically touched it. When that proof is weak or absent, a shared default credential, an unsigned firmware image, or a private key sitting in flash, every downstream control collapses. In 2026, with connected devices numbering in the tens of billions and pushing into critical infrastructure, the industry has decisively shifted from perimeter thinking to identity-first thinking, and from trusting devices to continuously verifying them.
Two forces are accelerating this shift. First, regulation: the EU Cyber Resilience Act is turning security-by-design, coordinated vulnerability disclosure, and software transparency from best practice into legal obligation for products with digital elements. Second, cryptographic reality: the NIST post-quantum standards finalized in 2024, ML-KEM for key establishment and ML-DSA for signatures, begin a migration that long-lived devices cannot ignore, because a sensor shipped in 2026 may still be authenticating in 2040, well inside the window where quantum attacks against today's public-key cryptography become plausible. Getting device identity and the firmware supply chain right now is what keeps that fleet governable for its entire lifespan.
The trust problem at the connected edge
The edge breaks the assumptions that cloud and enterprise security quietly rely on. Devices sit in physically accessible places, roadside cabinets, retail floors, factory walls, where an attacker can open the enclosure. They ship in volumes that make manual configuration impossible. They connect over networks the operator does not own. And they often run for a decade on hardware chosen for cost and power budget, not cryptographic headroom. Any identity scheme that assumes a guarded data center, a human administrator, or an annual hardware refresh is the wrong tool. What works is identity rooted in the silicon itself and verified continuously, so that a stolen device, a cloned image, or a swapped component fails to authenticate rather than blending in.
Rooting identity in silicon: secure boot to attestation
A credible device identity starts below the operating system. The goal is an unforgeable, hardware-anchored identity plus a guarantee that only trusted code runs.
- ▸Hardware root of trust: A TPM, secure element, or trusted execution environment stores keys that never leave the chip, so identity survives even a fully compromised operating system.
- ▸Secure and measured boot: Each boot stage cryptographically verifies the next and measures it into the root of trust, so tampered firmware either refuses to run or is detectable.
- ▸DICE for constrained devices: The Device Identifier Composition Engine derives layered identities from immutable hardware secrets, bringing strong identity to microcontrollers too small for a full TPM.
- ▸Remote attestation: The device presents signed evidence of its firmware state to a verifier before it is trusted with data or commands, the practical core of zero trust for machines.
- ▸Per-device keys, provisioned early: Unique identities injected at manufacture, ideally following an IEEE 802.1AR secure device identity model, kill the shared-secret failure mode that dooms so many fleets.
The firmware supply chain, SBOMs, and the Cyber Resilience Act
Firmware is where supply-chain risk concentrates, because a single poisoned build or compromised update server can reach every device at once. The defenses are now well understood and, under the Cyber Resilience Act, increasingly mandatory. A software bill of materials, expressed in a standard format such as SPDX or CycloneDX, lets operators answer the question every incident now demands: does this vulnerable component appear anywhere in my fleet. Signed updates with rollback protection stop attackers from pushing malicious or downgraded images. Reproducible builds and a hardened, access-controlled build pipeline close the door on the tampering that made supply-chain attacks the defining threat of the decade. The regulatory frame ties these together: the CRA expects manufacturers to handle vulnerabilities across a defined support lifetime, disclose them in a coordinated way, and ship products that are secure by default rather than secured later by the customer.
Preparing device identity for the post-quantum era
Long device lifespans make post-quantum cryptography an edge problem, not just a server one. The migration is not a single flag day but a multi-year engineering exercise, and 2026 is when serious teams begin.
1. Inventory your cryptography: Know where every device and service uses RSA or elliptic-curve keys, for identity, for secure-boot signatures, and for transport. 2. Prioritize the long-lived and the signed: Firmware-signing keys and device identities that must remain valid for a decade or more are the first candidates for ML-DSA, because signatures trusted tomorrow must resist future attackers. 3. Adopt hybrid key establishment: Combine a classical exchange with ML-KEM so sessions stay secure even if one algorithm is later broken, a pattern already appearing in mainstream protocol stacks. 4. Demand crypto-agility: Design update mechanisms so algorithms can be swapped in the field, and refuse to ship devices whose signing scheme is frozen in read-only memory. 5. Watch the standards: Track NIST and IETF guidance so your migration matches where the ecosystem is actually converging rather than a one-off in-house scheme.
5G, edge computing, and the expanding attack surface
Two architectural trends are reshaping where risk lives. 5G brings network slicing, private campus networks, and direct cellular connectivity for devices that once hid behind a corporate firewall, powerful for smart factories and connected infrastructure, but it means each device is reachable and must defend itself with its own identity rather than borrowing the perimeter's. Edge computing pushes processing to the device and the on-site gateway, cutting latency and keeping data local, which is excellent for privacy and resilience but multiplies the number of places where code runs, secrets live, and patches must land. The common thread is that the network boundary can no longer be the primary control. Strong per-device identity, attested firmware, mutually authenticated transport such as TLS with client certificates, and least-privilege authorization at every hop are what hold up when the perimeter dissolves.
A device-identity hardening roadmap and a build-versus-buy view
For teams shipping or operating connected devices, a sane order of operations beats chasing features. First, give every device a unique, hardware-anchored identity and eliminate shared credentials. Second, enforce secure boot and signed updates with rollback protection. Third, generate and retain an SBOM for every firmware release. Fourth, stand up attestation so backends verify device state before trusting it. Fifth, plan crypto-agility and a post-quantum path. On the perennial build-versus-buy question: building your own identity and update stack gives control but is slow and easy to get subtly wrong, while established IoT platforms and silicon-vendor security frameworks provide provisioning, attestation, and update machinery out of the box at the cost of dependence and portability. For most organizations the pragmatic answer is to buy the cryptographic plumbing from reputable silicon and platform vendors, then own the policy, the SBOM discipline, and the incident response, because those cannot be outsourced.
The nearshore edge: Tunisia, North Africa, and Monday-morning moves
For Tunisia and the wider North African technology sector, device identity and firmware integrity are a genuine opportunity rather than a compliance burden. European clients placing IoT design, embedded engineering, and edge-deployment work with regional partners increasingly require Cyber Resilience Act readiness, SBOM delivery, and secure provisioning as contract terms. Firms that build this competence early become the obvious nearshore choice: close in time zone, strong in embedded and firmware talent, and cost-competitive, while offering the data-residency and GDPR-aware handling that European buyers now insist on. The regional angle is concrete, an embedded team in Tunis that can hand a European customer a signed firmware image, a CycloneDX SBOM, and an attestation story is selling assurance, not just labor.
As for Monday: pick one product line and confirm whether its firmware updates are cryptographically signed and whether they can be rolled back to a vulnerable version. Check whether any device in the field still ships with a shared default credential, and open a ticket to kill it. Ask your build team for an SBOM of the current release, and if none exists, that is the first thing to fix. These are small moves, but they map directly onto where regulation and attackers are heading.
The direction of travel through the rest of the decade is unambiguous: identity moves into silicon, transparency about software becomes law, cryptography begins its quantum-resistant migration, and the network perimeter fades as the primary defense. Devices that can prove who they are and what they run, continuously, cheaply, and for their entire operational life, will be the ones allowed into critical systems. For builders and operators across Europe and North Africa alike, investing in device identity and a clean firmware supply chain in 2026 is the difference between fleets you can govern for a decade and fleets you will spend that decade fighting.