Methods, systems and computer program products for intrusion detection are provided. Aspects include receiving, by a processor, internet of things (IoT) device data from each of a plurality of IoT devices, wherein the IoT device data comprises operational data and non-operational data associated with each of the plurality of IoT devices. A security model is built for the plurality of IoT devices based at least in part on the IoT device data, wherein the security model comprises one or more IoT device data ranges. The plurality of IoT devices are monitored to identify a potential intrusion in any of the plurality of IoT devices based at least in part on the IoT device data exceeding any of the one or more IoT device data ranges.