A smart home does not end at setup: 8 questions about security support

A smart-home device is not a one-off purchase. It is a combination of hardware, an app, a user account, an update system and often a cloud service. If any one of these disappears, a physically sound thermostat, camera, doorbell, lock or smart plug may lose functions or security.

The reporting obligations under the EU Cyber Resilience Act (CRA) have applied since 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security. The regulation’s main product requirements will apply fully from 11 December 2027. These will include clearly stating the end of the support period, with month and year.

This does not mean that every device sold today was already designed to the 2027 rules, nor that an older product is automatically unsafe or unlawful. Buyers can nevertheless ask for the same information now to understand a product’s digital lifespan.

1. What is the exact model, and what makes up the system?

Do not record only the family name on the box. Find the exact model number, hardware revision and any required hub or bridge. Check which app it uses, whether an account is compulsory, and whether control happens locally or through the cloud.

Different generations sold under one family name may have different support dates, radio standards and apps. The exact model is the most useful detail when you need help later.

2. How long will security updates be provided?

Ask for an end date stated by month and year. Do not settle for “regular updates” or “lifetime support”. Check whether the commitment covers device firmware, the mobile app and the cloud service.

If the manufacturer does not publish an end date, ask in writing how long security fixes are promised for that specific model. A cheap device can become expensive if it loses support quickly.

3. Where are vulnerabilities and incidents communicated?

Look for an official security or vulnerability-reporting page, product advisories and a recall channel. Manufacturer reporting under the CRA is not the same as an automatic notice to every customer: you still need to know where fixes and instructions for your model will appear.

Save the product-support page and enable genuinely necessary security notices. You do not need to opt into marketing emails for this purpose.

4. Are there unique passwords and two-step verification?

Default passwords or credentials shared across devices are a risk. At first setup, create a unique, strong password for both the device and its associated account. If the app offers two-step verification, enable it.

Do not reuse the password from your email account or another home service. A device that ships with a fixed default password you cannot change is a serious warning sign.

5. How and when are updates installed?

Enable automatic security updates where available, but occasionally verify the installed firmware and app versions. Automatic installation can fail because of insufficient storage, interrupted power, infrequent restarts or network problems.

Read the manufacturer’s release notes before installation, especially for locks, alarms, heating controls or other critical functions. Know what happens during an update and whether safe manual control remains available if the device is temporarily offline.

6. Which remote functions do you genuinely need?

If you do not need to control the device over the internet, turn off remote access. Review app permissions, shared household accounts, voice-assistant links and third-party integrations. Remove connections you no longer use.

Security is not one switch. Fewer privileges, fewer linked accounts and less internet exposure reduce the attack surface.

7. What works without the internet or the provider?

Before buying, ask what remains functional during an internet outage, server failure, cancelled subscription or closure of the manufacturer’s service. Physical controls and local operation can be important for thermostats, locks, blinds and lighting.

A “compatible” badge does not answer whether the product works independently. Check the local protocol, required hub and whether basic functions need an active cloud account.

8. How can it be erased and transferred?

Check the factory-reset, account-unlinking and data-deletion process before purchase. Before selling, gifting or replacing the device, remove users, automations, camera footage, access codes and cloud-stored data, then perform the documented factory reset.

If the manufacturer does not clearly explain unlinking and erasure, that may indicate incomplete lifecycle support.

OtthonTrend quick checklist

• Exact model, hardware revision and required hub are identifiable.
• The end date for security support is known by month and year.
• There is an official vulnerability and product-security information channel.
• Unique passwords and, where possible, two-step verification are available.
• Automatic updates can be enabled and the installed version can be checked.
• Remote access and unused integrations can be disabled.
• Basic operation without internet or cloud service is understood.
• Factory reset, unlinking and data deletion are documented.

OtthonTrend did not perform a product test or penetration test, does not publish a brand ranking, and this article is not sponsored. The photographs are illustrations and do not verify the security or legal compliance of the devices shown.