Abstract: A computer-implemented method and system for identifying and managing security incidents for IoT devices operating on a cellular network are disclosed. The method includes receiving device hardware identifier from one or more devices operating on a cellular network; using the received device hardware identifier to retrieve additional device information from the device information storage database; and initiating an action for the one or more devices when the retrieved additional device information does not match expected additional device information, wherein the expected additional device information is based on the received device hardware identifier.