Opens in a new tab
14 min 09 sec
Available in:English

If It’s Smart, It’s Vulnerable

A veteran malware hunter explains why every connected device can be attacked, who is attacking now, from ransomware gangs to governments, and which simple habits keep you out of the easiest group of targets.

Table of Content

Most people buy a smart watch or a connected fridge for convenience and never think of it as an open door. Mikko Hypponen, who spent more than three decades chasing malware at F-Secure and WithSecure, says that is exactly what it is. In If It’s Smart, It’s Vulnerable, he turns a line he once used on stage into a rule: any device called smart can be hacked. He believes we are the first generation of humans ever to go online, and that few of us see how unusual that makes this moment.

The book follows the attackers he met along the way, from bored teenagers with floppy disks to crime gangs paid in bitcoin and governments building digital weapons. Its case is that every new connection widens the target, so the burden of safety must move toward the companies that build our technology, while each of us closes the easiest doors. By the end, you will know who is behind modern attacks, why they work, and which habits keep you off their list.

An old wristwatch and a new smartwatch tell the same time, yet only one of them can be reached by a stranger on another continent. The reason explains why fixing this problem is harder than it looks.

The hackers of the 1990s were lonely teenagers who wanted attention. Then a single year changed the motive behind almost every attack, and it changed how far away your attacker could be.

Criminals discovered a buyer who will pay almost anything for stolen files, and then built a strange code of honor around the deal. Understanding that business tells you exactly where your defense should start.

A weapon cheaper than one bombing mission once wrecked a nuclear program, and another disguised itself as ordinary crime. When nobody knows who holds such weapons, the old rules that kept wars from starting stop working.

A missing button in early web browsers ended up shaping how the whole internet pays for itself. Hypponen tried to escape the result for himself and discovered how deep the dependence really goes.

Hypponen’s own staff have walked into supposedly secure buildings simply by talking their way past the guards. If people are the weakest link, who should carry the burden of keeping everyone safe?

Hypponen expects the internet to go the way of the electricity grid: invisible, taken for granted, assumed to be always on. That is the danger his career keeps pointing to. The more ordinary a connection feels, the less we notice that it is a door, and that behind the doors stand teenagers, gangs paid in bitcoin and governments hiding behind false flags. The mechanical watch he uses as an example and the single server Maersk saved by luck tell the same story. What is not connected cannot be reached, and what is connected needs a plan for the day it fails.

The book does not ask anyone to give up technology. It asks for clearer thinking about it. Before buying the next smart gadget, ask whether it truly needs the internet. Keep backups somewhere a ransom note cannot touch. Share less, because data behaves more like uranium than oil. And if you build or sell technology, accept that keeping customers safe is your job to carry.

We are the first generation to live online. Whether we are remembered as careless or careful depends on what we choose to connect next.

About this book

What is this book about?

Smart watches, smart TVs and connected fridges promise convenience. Mikko Hypponen, who spent more than three decades investigating malware, sees something else: a growing number of doors that strangers anywhere in the world can try to open. His rule, now known as Hypponen's Law, gives the book its title. If a device is smart, it can be hacked. Drawing on cases from his career at F-Secure, Hypponen traces how the attackers changed. In the 1990s they were bored teenagers trading viruses on floppy disks. After 2003 came organized gangs chasing profit, and bitcoin turned ransomware into their best business. From 2010, with the discovery of Stuxnet, governments joined in with cheap, deniable cyberweapons that have cut power to hundreds of thousands of people. Along the way, free online services paid for themselves with our personal data. Readers get a clear picture of who is behind modern attacks and why they succeed. They also hear Hypponen's argument that ordinary users should not carry the burden of security, along with the practical habits that make a person or a company harder to hit than the targets around them.

Book Information

Rating:

Genre:

Technology & the Future

Topics:

Artificial Intelligence, Internet & Society, Risk Management

Publisher:

Wiley

Language:

English

Narrator:

Walter

First published:

October 5, 2021

Pages:

288

Length:

14 min 09 sec

Get the book:

Amazon

Who it's for

  • Professionals using smart devices

    Professionals who use smart devices daily and want to know who might be attacking them.

  • Leaders guarding company data

    Founders and team leads responsible for company data, backups and staff security habits.

  • Curious about cybersecurity stories

    Curious readers who want the inside story of ransomware, cyberwar and online privacy.

Listen to Preview

About the Author

Mikko Hypponen

Mikko Hypponen has spent more than thirty years researching and investigating cyber security, including 34 years at F-Secure and WithSecure, before joining Sensofusion in 2025. He is best known for the Hyppönen Law of Internet of Things security, which holds that any appliance called smart is vulnerable, the idea behind this book. He is a sought-after lecturer, Vanity Fair has profiled him, and his TED Talk has been viewed more than 2 million times.

Ratings & Reviews

Ratings at a glance

3.7

Overall score based on 25 ratings.

What people think

Listeners find the book engaging and simple to follow, with one listener noting it chronicles decades of experience through 80 ultra-short stories. The work is praised for its high-quality cybersecurity information, with one listener emphasizing its ability to convey the essence of modern software without getting bogged down in technical details.

Top reviews

Sirinat

Wow. Mikko Hypponen has managed to turn what could have been a dry technical manual into a gripping history of the internet’s darker side. This isn't just a book about code; it feels like a collection of campfire stories for the digital age, spanning over thirty years of frontline defense. I was particularly fascinated by the journey to Pakistan to find the creators of the Brain virus—it’s rare to see that level of human connection in a tech book. The way he describes IoT devices as the 'asbestos of the internet' is a wake-up call that everyone needs to hear. Frankly, even if you don't know your IP address from your home address, you’ll find this easy to follow. He strips away the jargon and leaves you with a stark, sometimes scary, but ultimately hopeful view of our connected future. I finished this and immediately went to double-check my router settings. Highly recommended for anyone who owns a smartphone.

Show more
Adam

Finally got around to reading this and I'm genuinely impressed by how accessible it is. Most cybersecurity books are written by people who want to prove how smart they are by using the most complex words possible. Hypponen does the opposite. He writes for the average person, explaining why our current rush to connect every single appliance to the web is a looming disaster. The chapter on the Brain virus was a standout, showing the human face of the people who started it all. Look, the internet is broken in many ways, but Mikko’s passion for it still shines through every page. It's a quick read, maybe too quick, but the insights stay with you. Not gonna lie, I’m a bit more paranoid about my smart home setup now. It’s a fascinating, scary, and essential look at the digital world we’ve built for ourselves.

Show more
Hang

The chapter on the history of viruses really puts our current situation into perspective. We’ve come a long way from the Brain virus to the massive ransomware attacks we see today. Mikko Hypponen has been there for all of it, and his perspective is invaluable. I loved the way he broke down complex ideas into simple analogies, like the asbestos comparison. It's a fast-paced journey through thirty years of digital history that never feels like a lecture. Gotta say, his optimism about the internet, despite seeing the worst of it, is actually quite refreshing. This book doesn't just scare you; it educates you on the 'why' behind the vulnerabilities. It’s a must-read for anyone curious about how the web actually works under the hood. Absolutely brilliant work from a true veteran.

Show more
Kom

This book is a fascinating, if somewhat frightening, look at the world we live in. Mikko Hypponen has a way of making you realize that every convenience we have comes with a hidden cost. His 'Law' is becoming more true every single day as we connect more of our lives to a network that wasn't built with security in mind. The writing style is punchy and direct, which I really appreciated. In my experience, most books on this topic are either too academic or too alarmist, but Mikko strikes a good balance. He clearly loves the internet, which makes his warnings about its vulnerabilities carry more weight. It's not a perfect book—some sections feel a bit repetitive—but it's an important one. If you use a computer, you should probably read this just to understand the risks you're taking every day.

Show more
Sai

Picked this up on a whim after seeing Mikko speak online, and it’s a solid, breezy read. The structure is unique, consisting of dozens of bite-sized stories that make it perfect for a commute or a quick lunch break. He moves effortlessly from the early days of floppy disk viruses to the complex cyber warfare of today. Truth is, some of the chapters felt a bit too short, like he was just scratching the surface before jumping to the next anecdote. I would have loved a deeper dive into the technical side of a few cases. That said, his perspective as the Chief Research Officer at F-Secure gives him a level of authority that most tech writers lack. To be fair, he does lean into the 'tech-bro' vibe occasionally with some name-dropping of industry giants like Tesla or SpaceX. It’s an entertaining memoir masked as a security guide, and it definitely makes you rethink your smart toaster.

Show more
Mattanee

As someone who works in IT, I didn't learn a massive amount of new technical information, but I thoroughly enjoyed the storytelling. Hypponen’s Law—'If it’s smart, it’s vulnerable'—is the central pillar here, and he defends it with decades of experience. The book feels very personal, almost like you're sitting at a bar with him while he recounts his greatest hits from F-Secure. Personally, I found the sections on the evolution of cybercrime from hobbyists to state-sponsored actors to be the most compelling. My only real gripe is that it occasionally feels a bit self-indulgent with the 'I was there' anecdotes. However, the writing is sharp and the message is clear: we are trading security for convenience at an alarming rate. It’s a great gift for that one friend who thinks their smart lightbulbs are perfectly safe and secure.

Show more
Samuel

Ever wonder why your smart fridge needs an internet connection? Mikko Hypponen explains exactly why that’s a terrible idea in this engaging, if somewhat fragmented, book. It’s a very easy read, avoiding the dense jargon that usually plagues this genre. I found the '80 ultra-short stories' format to be both a blessing and a curse; it keeps things moving, but I often wanted more detail on the specific hacking cases. The tone is conversational and the insights into the early internet are fantastic. Frankly, it’s more of a memoir about the life of a cybersecurity expert than a technical guide, but that’s what makes it so readable. I did notice some of the slightly outdated views on gender that other reviewers mentioned, which was a bummer. Overall, it's a solid 4 stars for being an eye-opening look at our digital dependencies.

Show more
Felix

Not what I expected given the title. I was looking for a more practical guide on how to secure my personal devices, but this is much more of a career memoir and a collection of essays. Mikko is clearly a legend in the field, and his stories about tracking hackers are genuinely interesting, yet the book lacks a cohesive structure. It jumps around chronologically, and some of the entries feel like recycled blog posts from the early 2010s. Also, some of the casual gendered language—calling every reporter 'he' unless specified—was a bit grating for a modern publication. In my experience, the '80 short stories' format works against it because you never get enough momentum. It’s a decent enough overview of the history of malware, but it’s more of a coffee table book for techies than a deep educational resource. If you already follow cybersec news, you probably know half of these stories already.

Show more
Sureerat

After hearing so much hype about Mikko, I expected something a bit more substantial. The book is definitely entertaining and he is a great storyteller, but it felt a bit disjointed at times. It’s less of a cohesive argument and more of a 'greatest hits' compilation of his career at F-Secure. The truth is, it’s very easy to read, which is great for beginners, but more experienced tech folks might find it a bit too basic. I enjoyed the historical context, especially the bits about Linus Torvalds and the early virus scene in the 80s and 90s. However, the constant jumping between topics—from IoT to crypto to personal anecdotes—made it hard to stay engaged. It’s a decent introduction to the world of cybersec, but don’t expect to come away with any new technical skills. It’s more about the mindset than the mechanics.

Show more
Yulia

Disappointed by the lack of depth here. While the title promises a deep dive into vulnerabilities, the book is really just a series of surface-level anecdotes and name-dropping. It feels like a collection of LinkedIn posts stitched together. To be fair, the stories are okay, but they lack any real technical substance for someone looking to actually learn about security protocols. Plus, the way he discusses things like Bitcoin and Tesla feels very 'tech-guru' without acknowledging the massive environmental or social downsides. It’s very 'look at me and the famous people I know.' If you want a light, entertaining read about a guy's career in Finland, sure. But if you're looking for a serious analysis of modern cybersecurity threats, this isn't it. It's too shallow and far too repetitive for my taste. Look elsewhere for actual expertise.

Show more
Show all reviews

Questions about this book

Hypponen’s Law says that if a device is smart, it is vulnerable. It began as a line Mikko Hypponen used in a talk, and audiences repeated it until it was named after him. His example is the watch: a mechanical one cannot be hacked, but adding connectivity and features to a smartwatch makes it hackable. Since he expects nearly everything that uses electricity to go online, the number of targets keeps growing.

Hypponen argues that bitcoin made ransomware explode, because it gave criminals an easy way to get paid. The trick is selling stolen data back to its owner, who is usually the most willing buyer. Gangs even protect their reputation by restoring files after payment. The 2013 Cryptolocker gang collected more than 40,000 bitcoin, and Hypponen knows of at least two police agencies that paid ransoms.

It suits anyone who relies on connected devices and wants to understand the risks without technical jargon. Business owners and managers get a clear view of ransomware, the human weak spots that penetration testers exploit, and why backups matter. Readers interested in politics get Hypponen’s account of cyberweapons such as Stuxnet and NotPetya and the attacks on Ukraine’s power grid.

Use strong, unique passwords in a password manager and turn on two-factor authentication. Be suspicious of emails asking for login details and contact companies through information you find yourself. Install software only from official stores, keep devices updated, back up files in more than one place, avoid unknown USB drives and use encrypted messaging. Before buying a smart gadget, ask whether it really needs the internet.

Mostly not. He divides security problems into technical ones, which can be fixed, and human errors, which can never be fully solved. For that reason he argues the burden should move to operating system makers, software companies, telecom operators and security firms. He also suggests that household devices, already regulated for fire and electrical safety, might need rules for software safety too.

AUDIO SUMMARY AVAILABLE

Listen to If It’s Smart, It’s Vulnerable in 15 minutes

Get the key ideas from If It’s Smart, It’s Vulnerable by Mikko Hypponen, plus 5,000+ more nonfiction titles.

  • 5,000+ titles
  • Listen as much as you want
  • 7-day free trial
  • Cancel anytime

If It’s Smart, It’s Vulnerable

Preview · Full summary 14 min 09 sec
Home

Discover

Open app

Log in