Research reports illuminating the poor security of Internet of Things (IoT) devices appear with what might be described as alarming regularity. We hear tales of poor password control, read descriptions of security breaches, and then we often hear calls for regulators and governments to do more to stop devices with poor security getting onto the market. With security problems so widely publicised, why isn’t the problem getting fixed, and where does the responsibility lie for taking action?