Espressif's range now spans dual-band Wi-Fi 6 with Thread on one chip, Thread-only parts for Matter networks and a 400 MHz media processor with no radio at all. Which chip fits which product, and the device-to-cloud design (identity, transport, updates) that keeps a fleet secure after it ships.
From Espressif's product pages and datasheets.
Mains-powered, on Wi-Fi, nothing exotic: S3 if you need the processing, C6 if you want Wi-Fi 6 and Matter options.
In offices, factories or apartment blocks where 2.4 GHz is congested: C5, for 5 GHz.
Battery sensor in a smart-home or building network: H2 on Thread, with a border router doing the IP side.
A screen or camera is the product: P4, with a C-series chip alongside for connectivity.
Whatever you choose, buy it as a pre-certified module — it is the difference between a certification budget in the thousands and one in the tens of thousands.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The device side is the part people prototype; the fleet side is the part that decides whether the product is still secure in year three. Three decisions matter more than the protocol.
Every unit gets its own credential — ideally a private key generated or injected at manufacture and protected by flash encryption — and the cloud authenticates each one individually, so a single compromised device can be revoked without touching the rest. A shared API key compiled into firmware is the most common and most expensive mistake in connected products.
MQTT over TLS suits devices that stay connected and receive commands; HTTPS suits devices that wake, report and sleep. You can use a managed IoT service such as AWS IoT Core, which handles per-device certificates and MQTT at scale, run your own broker, or post to an ordinary HTTPS API with per-device tokens. Pick the one your team can run and observe — the protocol matters less than knowing, at any moment, which devices are online and which firmware they run.
Signed over-the-air updates with rollback, staged rollouts (one percent, then ten, then everyone) and a record of which version every device runs. In the EU, the Cyber Resilience Act will require security updates for a defined support period from December 2027 — the update pipeline is not optional infrastructure; it is how you meet that obligation.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Certifying an ESP32 Product in 2026: FCC, CE, RED Cybersecurity and the CRA, for Small Teams
A pre-certified ESP32 module makes certifying your product much easier, though it doesn't do it for you. What the FCC's modular approval actually covers, what the EU's RED cybersecurity rules have required since August 2025, how the Cyber Resilience Act takes over in December 2027, and a realistic path for a small hardware team.
Read
The EU Cyber Resilience Act and AI Act in 2027: What Software and Connected-Device Teams Need to Do
CRA vulnerability reporting has applied since September 11, 2026; its main obligations apply on December 11, 2027. AI Act high-risk obligations moved to December 2, 2027. A practical, engineering-side reading of what each means for software products and connected devices sold in the EU, and what to have in place a year early.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.