A method implemented on a backend server computer for securing internet of things, IoT, devices on a plurality of local area networks, each one of the plurality of the local area networks comprising a router and multiple computing devices, the method comprising: receiving, by the backend server computer from the routers of the multiple ones of the plurality of local area networks, information concerning monitored activities of multiple IoT devices on the multiple ones of the plurality of local area networks; amalgamating, by the backend server computer, information concerning monitored activities of multiple IoT devices received from the routers of the multiple ones of the plurality of local area networks over time; calculating, by the backend server computer for each specific IoT device for which information concerning monitored activities is received, a dynamic reputation score quantifying trustworthiness of the specific IoT device, based on at least amalgamated information concerning monitored activities of the specific IoT device; determining, by the backend server computer for each specific IoT device for which information concerning monitored activities is received, activities the specific IoT device performs in order to execute authorized functionality, based on at least amalgamated information concerning monitored activities of the specific IoT device; creating a constraint profile for each specific IoT device for which information concerning monitored activities is received, based on at least a corresponding reputation score and corresponding determined activities, by the backend server computer, each constraint profile comprising local area network level directives specifying how to enable the corresponding IoT device to execute authorized functionality while maintaining local area network level security, wherein: creating the constraint profile for each specific loT device based on at least the corresponding reputation score and corresponding determined activities further comprises: testing the specific loT device for security vulnerabilities; and configuring the constraint profile to protect against at least one discovered security vulnerability, and transmitting the created constraint profiles to the routers of the plurality of local area networks, by the backend server computer. receiving, by the backend server computer from the routers of the multiple ones of the plurality of local area networks, information concerning monitored activities of multiple IoT devices on the multiple ones of the plurality of local area networks; amalgamating, by the backend server computer, information concerning monitored activities of multiple IoT devices received from the routers of the multiple ones of the plurality of local area networks over time; calculating, by the backend server computer for each specific IoT device for which information concerning monitored activities is received, a dynamic reputation score quantifying trustworthiness of the specific IoT device, based on at least amalgamated information concerning monitored activities of the specific IoT device; determining, by the backend server computer for each specific IoT device for which information concerning monitored activities is received, activities the specific IoT device performs in order to execute authorized functionality, based on at least amalgamated information concerning monitored activities of the specific IoT device; creating a constraint profile for each specific IoT device for which information concerning monitored activities is received, based on at least a corresponding reputation score and corresponding determined activities, by the backend server computer, each constraint profile comprising local area network level directives specifying how to enable the corresponding IoT device to execute authorized functionality while maintaining local area network level security, wherein: creating the constraint profile for each specific loT device based on at least the corresponding reputation score and corresponding determined activities further comprises: testing the specific loT device for security vulnerabilities; and configuring the constraint profile to protect against at least one discovered security vulnerability, and transmitting the created constraint profiles to the routers of the plurality of local area networks, by the backend server computer.