If It’s Smart, It’s Vulnerable
A veteran malware hunter explains why every connected device can be attacked, who is attacking now, from ransomware gangs to governments, and which simple habits keep you out of the easiest group of targets.

Table of Content
1. Introduction
1 min 01 sec
Most people buy a smart watch or a connected fridge for convenience and never think of it as an open door. Mikko Hypponen, who spent more than three decades chasing malware at F-Secure and WithSecure, says that is exactly what it is. In If It’s Smart, It’s Vulnerable, he turns a line he once used on stage into a rule: any device called smart can be hacked. He believes we are the first generation of humans ever to go online, and that few of us see how unusual that makes this moment.
The book follows the attackers he met along the way, from bored teenagers with floppy disks to crime gangs paid in bitcoin and governments building digital weapons. Its case is that every new connection widens the target, so the burden of safety must move toward the companies that build our technology, while each of us closes the easiest doors. By the end, you will know who is behind modern attacks, why they work, and which habits keep you off their list.
2. See the risk hiding in every smart device
1 min 54 sec
An old wristwatch and a new smartwatch tell the same time, yet only one of them can be reached by a stranger on another continent. The reason explains why fixing this problem is harder than it looks.
3. Know who is really attacking you today
1 min 53 sec
The hackers of the 1990s were lonely teenagers who wanted attention. Then a single year changed the motive behind almost every attack, and it changed how far away your attacker could be.
4. Learn how ransomware became crime's favorite business
2 min 03 sec
Criminals discovered a buyer who will pay almost anything for stolen files, and then built a strange code of honor around the deal. Understanding that business tells you exactly where your defense should start.
5. Understand the cyberwar that already reaches civilians
2 min 09 sec
A weapon cheaper than one bombing mission once wrecked a nuclear program, and another disguised itself as ordinary crime. When nobody knows who holds such weapons, the old rules that kept wars from starting stop working.
6. Treat your personal data like uranium
1 min 56 sec
A missing button in early web browsers ended up shaping how the whole internet pays for itself. Hypponen tried to escape the result for himself and discovered how deep the dependence really goes.
7. Close the easy doors before attackers find them
1 min 58 sec
Hypponen’s own staff have walked into supposedly secure buildings simply by talking their way past the guards. If people are the weakest link, who should carry the burden of keeping everyone safe?
8. Conclusion
1 min 15 sec
Hypponen expects the internet to go the way of the electricity grid: invisible, taken for granted, assumed to be always on. That is the danger his career keeps pointing to. The more ordinary a connection feels, the less we notice that it is a door, and that behind the doors stand teenagers, gangs paid in bitcoin and governments hiding behind false flags. The mechanical watch he uses as an example and the single server Maersk saved by luck tell the same story. What is not connected cannot be reached, and what is connected needs a plan for the day it fails.
The book does not ask anyone to give up technology. It asks for clearer thinking about it. Before buying the next smart gadget, ask whether it truly needs the internet. Keep backups somewhere a ransom note cannot touch. Share less, because data behaves more like uranium than oil. And if you build or sell technology, accept that keeping customers safe is your job to carry.
We are the first generation to live online. Whether we are remembered as careless or careful depends on what we choose to connect next.
About this book
What is this book about?
Smart watches, smart TVs and connected fridges promise convenience. Mikko Hypponen, who spent more than three decades investigating malware, sees something else: a growing number of doors that strangers anywhere in the world can try to open. His rule, now known as Hypponen's Law, gives the book its title. If a device is smart, it can be hacked. Drawing on cases from his career at F-Secure, Hypponen traces how the attackers changed. In the 1990s they were bored teenagers trading viruses on floppy disks. After 2003 came organized gangs chasing profit, and bitcoin turned ransomware into their best business. From 2010, with the discovery of Stuxnet, governments joined in with cheap, deniable cyberweapons that have cut power to hundreds of thousands of people. Along the way, free online services paid for themselves with our personal data. Readers get a clear picture of who is behind modern attacks and why they succeed. They also hear Hypponen's argument that ordinary users should not carry the burden of security, along with the practical habits that make a person or a company harder to hit than the targets around them.
Book Information
Who it's for
Professionals using smart devices
Professionals who use smart devices daily and want to know who might be attacking them.
Leaders guarding company data
Founders and team leads responsible for company data, backups and staff security habits.
Curious about cybersecurity stories
Curious readers who want the inside story of ransomware, cyberwar and online privacy.
About the Author
Mikko Hypponen
Mikko Hypponen has spent more than thirty years researching and investigating cyber security, including 34 years at F-Secure and WithSecure, before joining Sensofusion in 2025. He is best known for the Hyppönen Law of Internet of Things security, which holds that any appliance called smart is vulnerable, the idea behind this book. He is a sought-after lecturer, Vanity Fair has profiled him, and his TED Talk has been viewed more than 2 million times.
Ratings & Reviews
Ratings at a glance
What people think
Listeners find the book engaging and simple to follow, with one listener noting it chronicles decades of experience through 80 ultra-short stories. The work is praised for its high-quality cybersecurity information, with one listener emphasizing its ability to convey the essence of modern software without getting bogged down in technical details.
Top reviews
Wow. Mikko Hypponen has managed to turn what could have been a dry technical manual into a gripping history of the internet’s darker side. This isn't just a book about code; it feels like a collection of campfire stories for the digital age, spanning over thirty years of frontline defense. I was particularly fascinated by the journey to Pakistan to find the creators of the Brain virus—it’s rare to see that level of human connection in a tech book. The way he describes IoT devices as the 'asbestos of the internet' is a wake-up call that everyone needs to hear. Frankly, even if you don't know your IP address from your home address, you’ll find this easy to follow. He strips away the jargon and leaves you with a stark, sometimes scary, but ultimately hopeful view of our connected future. I finished this and immediately went to double-check my router settings. Highly recommended for anyone who owns a smartphone.
Show moreFinally got around to reading this and I'm genuinely impressed by how accessible it is. Most cybersecurity books are written by people who want to prove how smart they are by using the most complex words possible. Hypponen does the opposite. He writes for the average person, explaining why our current rush to connect every single appliance to the web is a looming disaster. The chapter on the Brain virus was a standout, showing the human face of the people who started it all. Look, the internet is broken in many ways, but Mikko’s passion for it still shines through every page. It's a quick read, maybe too quick, but the insights stay with you. Not gonna lie, I’m a bit more paranoid about my smart home setup now. It’s a fascinating, scary, and essential look at the digital world we’ve built for ourselves.
Show moreThe chapter on the history of viruses really puts our current situation into perspective. We’ve come a long way from the Brain virus to the massive ransomware attacks we see today. Mikko Hypponen has been there for all of it, and his perspective is invaluable. I loved the way he broke down complex ideas into simple analogies, like the asbestos comparison. It's a fast-paced journey through thirty years of digital history that never feels like a lecture. Gotta say, his optimism about the internet, despite seeing the worst of it, is actually quite refreshing. This book doesn't just scare you; it educates you on the 'why' behind the vulnerabilities. It’s a must-read for anyone curious about how the web actually works under the hood. Absolutely brilliant work from a true veteran.
Show moreThis book is a fascinating, if somewhat frightening, look at the world we live in. Mikko Hypponen has a way of making you realize that every convenience we have comes with a hidden cost. His 'Law' is becoming more true every single day as we connect more of our lives to a network that wasn't built with security in mind. The writing style is punchy and direct, which I really appreciated. In my experience, most books on this topic are either too academic or too alarmist, but Mikko strikes a good balance. He clearly loves the internet, which makes his warnings about its vulnerabilities carry more weight. It's not a perfect book—some sections feel a bit repetitive—but it's an important one. If you use a computer, you should probably read this just to understand the risks you're taking every day.
Show morePicked this up on a whim after seeing Mikko speak online, and it’s a solid, breezy read. The structure is unique, consisting of dozens of bite-sized stories that make it perfect for a commute or a quick lunch break. He moves effortlessly from the early days of floppy disk viruses to the complex cyber warfare of today. Truth is, some of the chapters felt a bit too short, like he was just scratching the surface before jumping to the next anecdote. I would have loved a deeper dive into the technical side of a few cases. That said, his perspective as the Chief Research Officer at F-Secure gives him a level of authority that most tech writers lack. To be fair, he does lean into the 'tech-bro' vibe occasionally with some name-dropping of industry giants like Tesla or SpaceX. It’s an entertaining memoir masked as a security guide, and it definitely makes you rethink your smart toaster.
Show moreAs someone who works in IT, I didn't learn a massive amount of new technical information, but I thoroughly enjoyed the storytelling. Hypponen’s Law—'If it’s smart, it’s vulnerable'—is the central pillar here, and he defends it with decades of experience. The book feels very personal, almost like you're sitting at a bar with him while he recounts his greatest hits from F-Secure. Personally, I found the sections on the evolution of cybercrime from hobbyists to state-sponsored actors to be the most compelling. My only real gripe is that it occasionally feels a bit self-indulgent with the 'I was there' anecdotes. However, the writing is sharp and the message is clear: we are trading security for convenience at an alarming rate. It’s a great gift for that one friend who thinks their smart lightbulbs are perfectly safe and secure.
Show moreEver wonder why your smart fridge needs an internet connection? Mikko Hypponen explains exactly why that’s a terrible idea in this engaging, if somewhat fragmented, book. It’s a very easy read, avoiding the dense jargon that usually plagues this genre. I found the '80 ultra-short stories' format to be both a blessing and a curse; it keeps things moving, but I often wanted more detail on the specific hacking cases. The tone is conversational and the insights into the early internet are fantastic. Frankly, it’s more of a memoir about the life of a cybersecurity expert than a technical guide, but that’s what makes it so readable. I did notice some of the slightly outdated views on gender that other reviewers mentioned, which was a bummer. Overall, it's a solid 4 stars for being an eye-opening look at our digital dependencies.
Show moreNot what I expected given the title. I was looking for a more practical guide on how to secure my personal devices, but this is much more of a career memoir and a collection of essays. Mikko is clearly a legend in the field, and his stories about tracking hackers are genuinely interesting, yet the book lacks a cohesive structure. It jumps around chronologically, and some of the entries feel like recycled blog posts from the early 2010s. Also, some of the casual gendered language—calling every reporter 'he' unless specified—was a bit grating for a modern publication. In my experience, the '80 short stories' format works against it because you never get enough momentum. It’s a decent enough overview of the history of malware, but it’s more of a coffee table book for techies than a deep educational resource. If you already follow cybersec news, you probably know half of these stories already.
Show moreAfter hearing so much hype about Mikko, I expected something a bit more substantial. The book is definitely entertaining and he is a great storyteller, but it felt a bit disjointed at times. It’s less of a cohesive argument and more of a 'greatest hits' compilation of his career at F-Secure. The truth is, it’s very easy to read, which is great for beginners, but more experienced tech folks might find it a bit too basic. I enjoyed the historical context, especially the bits about Linus Torvalds and the early virus scene in the 80s and 90s. However, the constant jumping between topics—from IoT to crypto to personal anecdotes—made it hard to stay engaged. It’s a decent introduction to the world of cybersec, but don’t expect to come away with any new technical skills. It’s more about the mindset than the mechanics.
Show moreDisappointed by the lack of depth here. While the title promises a deep dive into vulnerabilities, the book is really just a series of surface-level anecdotes and name-dropping. It feels like a collection of LinkedIn posts stitched together. To be fair, the stories are okay, but they lack any real technical substance for someone looking to actually learn about security protocols. Plus, the way he discusses things like Bitcoin and Tesla feels very 'tech-guru' without acknowledging the massive environmental or social downsides. It’s very 'look at me and the famous people I know.' If you want a light, entertaining read about a guy's career in Finland, sure. But if you're looking for a serious analysis of modern cybersecurity threats, this isn't it. It's too shallow and far too repetitive for my taste. Look elsewhere for actual expertise.
Show moreQuestions about this book
What is Hypponen's Law?
Hypponen’s Law says that if a device is smart, it is vulnerable. It began as a line Mikko Hypponen used in a talk, and audiences repeated it until it was named after him. His example is the watch: a mechanical one cannot be hacked, but adding connectivity and features to a smartwatch makes it hackable. Since he expects nearly everything that uses electricity to go online, the number of targets keeps growing.
Why does ransomware make so much money, according to the book?
Hypponen argues that bitcoin made ransomware explode, because it gave criminals an easy way to get paid. The trick is selling stolen data back to its owner, who is usually the most willing buyer. Gangs even protect their reputation by restoring files after payment. The 2013 Cryptolocker gang collected more than 40,000 bitcoin, and Hypponen knows of at least two police agencies that paid ransoms.
Who should read If It's Smart, It's Vulnerable?
It suits anyone who relies on connected devices and wants to understand the risks without technical jargon. Business owners and managers get a clear view of ransomware, the human weak spots that penetration testers exploit, and why backups matter. Readers interested in politics get Hypponen’s account of cyberweapons such as Stuxnet and NotPetya and the attacks on Ukraine’s power grid.
How can I protect myself based on the book's advice?
Use strong, unique passwords in a password manager and turn on two-factor authentication. Be suspicious of emails asking for login details and contact companies through information you find yourself. Install software only from official stores, keep devices updated, back up files in more than one place, avoid unknown USB drives and use encrypted messaging. Before buying a smart gadget, ask whether it really needs the internet.
Does Hypponen think users are responsible for security?
Mostly not. He divides security problems into technical ones, which can be fixed, and human errors, which can never be fully solved. For that reason he argues the burden should move to operating system makers, software companies, telecom operators and security firms. He also suggests that household devices, already regulated for fire and electrical safety, might need rules for software safety too.
Readers also enjoyed
AUDIO SUMMARY AVAILABLE
Listen to If It’s Smart, It’s Vulnerable in 15 minutes
Get the key ideas from If It’s Smart, It’s Vulnerable by Mikko Hypponen, plus 5,000+ more nonfiction titles.
- 5,000+ titles
- Listen as much as you want
- 7-day free trial
- Cancel anytime



















