While the code of practice is welcome, the voluntary approach has certain limitations, particularly for an IoT industry with a supply chain with varying security resources, according to Kevin Vanhaelen, regional director, Asia-Pacific, Vectra.