A Comprehensive Taxonomy and Empirical Analysis of IoT Cybersecurity Attack Vectors: A Systematic Review

The proliferation of the Internet of Things (IoT) has transformed the digital ecosystem, enabling seamless connectivity across industries, smart homes, healthcare, transportation, and critical infrastructures. However, this rapid adoption has also expanded the attack surface for cyber adversaries. Despite substantial research, the fragmented understanding of IoT attack vectors continues to impede the design of holistic security solutions. This systematic review provides a comprehensive taxonomy of IoT cybersecurity attack vectors, classifies them across multiple dimensions—including device, network, application, and human-centric layers—and conducts an empirical analysis of the frequency, techniques, and impacts reported in the literature. Using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) methodology, 176 peer-reviewed studies published between 2013 and 2025 were examined. Findings reveal that denial-of-service (DoS), eavesdropping, malware injection, and privilege escalation remain the most recurring vectors, with an increasing trend of AI-driven and supply chain attacks. The paper identifies critical gaps in adaptive defense, context-aware intrusion detection, and resilience mechanisms. The study concludes by proposing a research agenda emphasizing explainable security models, federated IoT defense strategies, and standardized threat taxonomies.