What is the right approach to IoT security at scale?

Treat every device as untrusted, enforce strong identity for both devices and their workloads, segment networks aggressively, and assume any device could be compromised at any time. Physical security at edge sites is also part of the picture because remote locations are often less controlled. The blast radius of a single compromised device should always be small by design.