Despite the extensive functionality and broad diversity of Internet of Things (IoT) devices, they remain vulnerable to cybersecurity attacks. Still, many of them are unable to protect themselves due to limited resources or missing security features. One solution is to delegate security functions to a “stronger” device “encapsulating” a “weaker” one in a secure environment. In order to identify a suitable IoT device within the system to take over security responsibilities, we propose a novel flexible multidimensional approach to IoT device categorization, named IoTCat, that considers not only the technical characteristics of devices (e.g., available memory) but also user experience (e.g., trust in the vendor). In this paper, we describe our approach, compare it with existing methods, and demonstrate its applicability by presenting a proof-of-concept software solution.