January is when we hear about all the new things that got plugged in over the holidays—cameras, video doorbells, smart plugs, thermostats, robot vacuums, a TV that wanted the Wi-Fi password before it would show a picture. Each of those is a small computer, and most of them will never get the attention a laptop gets.
That's the whole problem in one sentence. Not that smart devices are bad, but that they're computers nobody looks at again after setup.
Change the password, and change the account
Two different passwords matter here. The one on the device itself, if it has an admin login, and the one on the cloud account that controls it from your phone.
Device defaults are the classic weak spot: a factory password printed in the manual, identical across every unit sold. The cloud account is the one people underrate—whoever has that login can see your camera feed from anywhere in the world. Give it a unique password and turn on multi-factor authentication if it's offered.
Let them update themselves
Cheap gadgets ship with whatever software was current the month they were boxed. Manufacturers do patch real problems, but only devices that check in ever hear about it.
Dig through the app's settings once and switch on automatic firmware updates. Then, honestly, check back a couple times a year—plenty of devices quietly stop getting updates after a few years, and a camera nobody supports anymore is worth retiring.
Put them on the guest network
This is the highest-value thing on the list. A device on your guest network can reach the Internet and do its job, but it can't see your laptop, your phone's backups, or the shared drive with your tax returns.
We walked through setting one up last summer for actual guests, and the same network does double duty here. Most of the routers we install handle it in a couple of taps. It costs you nothing and it means an off-brand plug with sloppy software has nowhere interesting to go.
One pass, then leave it alone
Unique account password, MFA where offered, auto-updates on, guest network for anything that doesn't need to talk to your computers. That's twenty minutes for the whole pile of new gear, once, and it's the difference between a smart home and thirty unattended computers on your network.