In this guide
- What “hacked” realistically means, ranked by likelihood
- The five layers of a smart home's attack surface
- How the radio is protected: Zigbee encryption vs Wi-Fi devices
- Router and Wi-Fi hygiene
- Accounts, phones and two-factor authentication
- Cameras and smart locks: the high-stakes devices
- Updates, end-of-support and moving out
- A 15-point smart home security checklist
- How Pert delivers it (designed, not DIY)
- FAQs
This article is part of our wider coverage of home automation in Hyderabad. It builds on what a smart home gateway does and how to plan Wi-Fi and the home network for a smart home. Those explain how the system is connected. This one explains how to keep it secure.
What “hacked” realistically means, ranked by likelihood
Security starts with an honest threat model: who might try, how, and what they would get. For a typical Hyderabad flat or villa, the risks look roughly like this, from most to least likely:
| Risk | How it happens | Likelihood | What it exposes |
|---|---|---|---|
| Account takeover | The smart home app or the email behind it uses a password leaked from another site; no two-factor authentication | Highest | Everything the app can do: lights, curtains, locks, camera feeds, alerts |
| Weak router | Default admin password, old firmware, WPS left on, ports opened for a camera or DVR | High | Every device on the home network, including phones and laptops |
| Cheap, unsupported device | An off-brand camera or plug with hard-coded passwords and no updates | High | A foothold on the network; camera footage |
| People who should no longer have access | Ex-staff, a tenant, or an installer's personal account still linked to the system | Medium | Remote control and, worst case, door unlock |
| Phishing | A fake “your smart home account is locked” message asks for your password or OTP | Medium | Same as account takeover |
| Radio attack | Someone near the house with specialist equipment targets the Zigbee mesh, usually while new devices are being paired | Low | Limited, and requires being physically close |
Most of the real risk is in the top three rows. They are also the cheapest to fix: unique passwords, two-factor authentication, a properly configured router and a short list of devices from makers that still issue updates.
The five layers of a smart home's attack surface
An automated home is not one device. It is a set of layers, and each needs its own protection. The radio layer gets the most attention but is usually the least exposed.
| Layer | What lives there | Main protection | Who is responsible |
|---|---|---|---|
| 1. Device radio | Keypads, lights, curtain motors, sensors talking over Zigbee | Network encryption; joining only when pairing is deliberately opened | Installer, at commissioning |
| 2. Gateway | The gateway that runs scenes and schedules and connects the mesh to your network | Firmware updates, secure placement, no open ports | Installer and manufacturer |
| 3. Home network | Router, Wi-Fi, cameras, TVs, phones, laptops | Strong router admin password, WPA2/WPA3, updates, separate network for IoT devices | Household, with the installer's advice |
| 4. Cloud and app accounts | The smart home app, camera cloud, voice assistant accounts, the email behind them | Unique passwords, two-factor authentication, the right owner | Household |
| 5. People and phones | Family, staff, guests; the phones that hold the app | Role-based access, phone screen locks, removing people who leave | Household |
An installer can make layers 1 and 2 solid and set up 3 to 5 properly on day one. But layers 3 to 5 stay with the family afterwards. That is why a good handover includes a short security briefing, not just a demo of the scenes.
How the radio is protected: Zigbee encryption vs Wi-Fi devices
How a Zigbee network keeps strangers out
Pert's system is built on Zigbee. Three properties of Zigbee matter for security:
- Encrypted traffic. Messages on a Zigbee 3.0 network are encrypted with AES-128 using a network key held by the coordinator in the gateway. A neighbour's radio can pick up the signal but cannot read or forge the commands without that key.
- Controlled joining. A new device can only join while pairing is deliberately opened on the gateway, normally for a few minutes during installation. Outside that window, an unknown device cannot join the mesh. Zigbee 3.0 also supports per-device install codes, so the key is handed over securely during joining.
- Off the internet by design. Individual lights, keypads, sensors and curtain motors do not have IP addresses. They are not on your Wi-Fi and cannot be reached directly from the internet. Only the gateway is a network device.
The weakest moment for any mesh is pairing, which is why it should happen during a planned installation with the window closed again afterwards, not left open for days while devices are added one at a time. For how the coordinator, routers and end devices fit together, see how a Zigbee mesh network works.
A fair comparison with other protocols
| Approach | Encryption | Devices directly on your network | Security trade-off |
|---|---|---|---|
| Zigbee via a gateway | AES-128 network encryption | One (the gateway) | Small attack surface; security depends heavily on the gateway and its account |
| Wi-Fi smart devices | WPA2/WPA3 on the link, plus each maker's own cloud security | Every bulb, plug and switch | Each device is a small computer on your network with its own firmware and cloud account to keep updated |
| Bluetooth SIG Mesh | AES-CCM with separate network and application keys | None directly; reached via a phone or bridge | Strong design; how good it is in practice depends on how the brand handles provisioning and its bridge |
| Matter (over Thread or Wi-Fi) | Modern encryption plus device certificates checked at setup | Wi-Fi devices yes; Thread devices via a border router | Strong security model; still maturing in the Indian market |
| Wired KNX / RS-485 | Classic installations often unencrypted; KNX Secure adds it | None, until an IP interface is added | Physical wiring limits access; the IP interface needs the same care as any gateway |
No protocol is “unhackable”. Zigbee's advantage is architectural: one well-protected gateway instead of thirty separately maintained Wi-Fi devices. That is one of the reasons we chose it; the full comparison is in Zigbee vs Wi-Fi vs Bluetooth Mesh vs Matter.
Router and Wi-Fi hygiene
The router is the front door of the home network, and in many Hyderabad homes it is still the ISP's box exactly as the technician left it. Before or during a smart home installation:
- Change the router's admin password (the one for its settings page, not the Wi-Fi password). Default admin credentials are publicly listed for most models.
- Use WPA2 or WPA3 with a long Wi-Fi password, and turn off WPS, the push-button or PIN pairing feature that is easy to abuse.
- Update router firmware, or ask the ISP to replace a model that no longer receives updates.
- Do not open ports. Port-forwarding to view a camera or DVR from outside is one of the most common ways homes get compromised. Use the maker's secure remote-access app instead. Turn off UPnP if nothing needs it, because it lets devices open ports on their own.
- Separate guests and gadgets. Put visitors on a guest network. Where the router supports it, put cameras, TVs and other internet-connected gadgets on their own network, away from the laptops and phones that hold banking apps. The gateway's placement and wired connection are covered in the network planning guide.
Security and reliability also overlap here. Local control means scenes, keypads and schedules run on the gateway inside the home. That keeps the house working during an internet outage, as explained in do smart homes work during power cuts and internet outages. It also means the internet is needed only for remote access, notifications and voice assistants, not for everyday control.
Accounts, phones and two-factor authentication
Because account takeover is the most likely risk, the account deserves the most care.
- The right owner. The homeowner, not the installer's or contractor's personal phone, should hold the main administrator account. Installers should have their own, removable access for support.
- Unique password plus two-factor authentication on the smart home app if it offers 2FA, and always on the email address behind it. Whoever controls that email can usually reset everything else.
- Separate users, not a shared login. Each family member gets their own user, and domestic staff get limited access if they need any. Removing one person should not mean changing the password for everyone. Roles, time-limited access and what to do when someone leaves are covered in managing smart home access for family, staff and guests.
- Lock the phones. A phone with the app open and no screen lock is a house key. Use a PIN or biometric lock on every phone that controls the home.
- Watch for phishing. No genuine service will ask you to read out an OTP over the phone or on WhatsApp. If a message says your smart home account is locked, open the app directly rather than tapping the link.
Cameras and smart locks: the high-stakes devices
Most smart home devices are low-stakes: a hacked cove light is an annoyance. Cameras and the main door are different, so they deserve extra rules. Placement and hardware choice are covered in CCTV and sensor placement and planning a smart main door. Here are the security rules.
| Device | Do | Avoid |
|---|---|---|
| Indoor cameras | Use privacy zones; set them to switch off or turn away in Home mode; keep them out of bedrooms and bathrooms | Cameras that record family spaces all day with nobody reviewing who can see the footage |
| Outdoor cameras and NVR/DVR | Change every default password; choose makers that still issue updates; view remotely through the maker's app | Open router ports; recorders still on the default password; unknown brands with no update history |
| Smart main door lock | Keep a mechanical key or other fallback; require a PIN or in-app confirmation for remote unlock; review the lock's access log | Voice unlock without a PIN; auto-unlock triggered only by a phone being nearby; shared PINs that never change |
| Door and window sensors | Low-battery and offline alerts, so a dead sensor does not fail silently | Relying on a sensor for security without any check that it is still reporting |
Pert's security range is designed to work alongside the rest of the system, so a Good Night press can check that doors are closed and arm sensors. Lighting and curtain buttons, by contrast, never unlock a door. Keep the convenience automations and the security functions separate.
Updates, end-of-support and moving out
Firmware updates
Security problems get found in every kind of software, and the fix is an update. Ask who applies updates to the gateway and devices, how you will be told, and whether updates are tested before they reach a live home. An update that breaks a scene at 7pm is a support problem; a device that never gets updated is a security problem.
End-of-support
Every connected product eventually stops receiving updates. Inexpensive Wi-Fi plugs and cameras often reach that point within a couple of years, and some never receive an update at all. A designed system keeps the number of internet-facing devices small, so there are fewer of these to track and replace. When a camera or gadget is out of support, replace it or take it off the network rather than leaving it running.
Selling, renting out or moving
Treat the house like a phone you are handing over. Remove your account and every family member, delete lock PINs and fingerprints, factory-reset or hand over cameras with recordings deleted, and change the Wi-Fi password if the router stays. The new owner then becomes the main administrator. If you are a landlord, do the same between tenants.
A 15-point smart home security checklist
Use this at handover, and run through it again once a year:
| # | Check | Layer |
|---|---|---|
| 1 | Zigbee pairing closed after installation; no unknown devices in the device list | Radio |
| 2 | Gateway on current firmware, wired to the router, in a ventilated spot that is not easy to reach | Gateway |
| 3 | Configuration backed up, so a replacement gateway does not mean re-pairing everything | Gateway |
| 4 | Router admin password changed from default | Network |
| 5 | WPA2/WPA3 with a long Wi-Fi password; WPS off | Network |
| 6 | No port-forwarding for cameras or recorders; UPnP off unless needed | Network |
| 7 | Guest network for visitors; cameras and gadgets separated where the router allows | Network |
| 8 | Homeowner holds the main admin account | Account |
| 9 | Unique passwords and two-factor authentication on the app (where offered) and its email | Account |
| 10 | Each person has their own user; staff access limited and time-bound | People |
| 11 | Installer and ex-staff access reviewed and removed when no longer needed | People |
| 12 | Screen lock on every phone with the app | People |
| 13 | All camera and recorder default passwords changed; indoor privacy rules agreed | Devices |
| 14 | Smart lock: fallback key kept, remote unlock needs confirmation, no voice unlock without a PIN | Devices |
| 15 | Offline and low-battery alerts on for sensors and locks | Devices |
If you are comparing installers, ask how they handle points 1, 2, 8 and 11. It is a quick way to see whether they think about security at all, and it fits well with the questions in best home automation companies in Hyderabad.
How Pert delivers it — a designed solution, not a DIY kit
Pert's Stella keypads, tunable and dimmable lighting, motorised curtains and security devices work together as one Zigbee system through the Pert gateway. We design and install the whole system rather than handing over a kit, so security is part of the design rather than an afterthought. We pair devices during a planned installation and close the joining window. We place and connect the gateway properly, set up the homeowner as the main administrator, create separate users for family and staff, and keep security functions such as door locks apart from convenience scenes. At handover we walk the family through the checklist above, including router settings and account protection, so the parts that stay with the household are set up right from day one.
Planning home automation for a Hyderabad flat or villa? We will design the whole system, from keypads, lighting and curtains to security and the account setup that keeps it yours, around how your household actually lives. Request a consultation →
Frequently asked questions
Can someone hack my smart home and switch my lights on and off?
It is possible in principle but rare in practice, and it almost never happens through the lighting radio. Zigbee traffic is encrypted, and attacking it needs someone physically close with specialist equipment. The realistic routes in are a stolen or reused app password, a router on its default admin password, or a cheap internet-connected device that never gets updates. A unique password, two-factor authentication and an updated router close most of the real risk.
Is Zigbee more secure than Wi-Fi smart devices?
Zigbee has a structural advantage. The individual lights, keypads and curtain motors are not on your Wi-Fi or the internet; they talk only to the gateway over an encrypted mesh. So only the gateway has to be protected as a network device. With Wi-Fi smart devices, every bulb and plug is its own computer on your network with its own firmware and usually its own cloud account. Well-made Wi-Fi devices can be secure, but there are more of them to look after.
Are smart cameras and smart locks safe to use?
Yes, if they are chosen and set up carefully, because they carry the highest stakes. Use cameras from makers that still issue updates, change every default password, avoid opening router ports for remote viewing, and keep indoor cameras out of bedrooms. For locks, keep a mechanical key or fallback, require a PIN or confirmation for remote unlocking, and never allow voice unlock of the main door without one.
What should I do with my smart home when I sell or move out of the flat?
Treat it like handing over a phone. Remove your account and every family member, delete lock PINs and fingerprints, factory-reset or hand over cameras with recordings deleted, and change the Wi-Fi password if the router stays. The new owner then creates their own account as main administrator. A professional installer can do this as a formal handover so nothing stays linked to you.