TL;DR: Automated dispensing cabinets are networked Windows systems whose security depends on authentication, segmentation, and account lifecycle controls, not just physical locks, according to Crayonic. The access model breaks when stale accounts, shared logins, or hard-coded credentials outlive the ward workflow they were meant to protect.
At a glance
What this is: This is an analysis of automated dispensing cabinets as identity-governed computers, with the central finding that access controls matter as much as the locked drawers they protect.
Why it matters: It matters because hospitals must govern cabinet access like any other privileged system, including identity proofing, offboarding, segmentation, and auditability.
By the numbers:
- 74.5% of hospitals in the United States use automated dispensing cabinets as their primary method for drug distribution.
- In a 2016 test, researchers found 1,418 known vulnerabilities in one version of the Pyxis SupplyStation.
- A 2022 bulletin covered hard-coded credentials across 24 product lines.
- The same May 2022 bulletin said default credentials may presently still operate on installed cabinets.
Context
Automated dispensing cabinets are not just lockboxes on wheels. They are networked ward computers that authenticate users, exchange patient and pharmacy data, and sometimes rely on the hospital directory as part of the access path. In identity terms, that makes them part of the privileged estate, not a standalone appliance.
The security problem is lifecycle, not just hardware: if a cabinet trusts old directory permissions, shared logins, or credentials that were never changed, the control boundary shifts from the drawer to the account. Treat NHI key challenges and risks as the baseline lens for why access sprawl and weak offboarding matter here.
Key questions
Q: What breaks when automated dispensing cabinet access is not tied to identity lifecycle controls?
A: The cabinet can continue to trust accounts that should no longer exist, including expired directory permissions, shared logins, or credentials that were never changed. That breaks the assumption that authentication state and governance state are the same. In practice, the organisation ends up with access that looks operationally valid but is no longer authorised.
A: Because the cabinet inherits trust from other systems. If directory membership, patient data feeds, or network placement are weakly governed, access failures can move across the clinical workflow rather than staying inside the device. The risk is not just local compromise. It is identity drift across connected systems.
Q: What are the signs that access governance is failing in practice?
A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems. If governance teams rely on manual audits, they often struggle to see access granted to non-human identities or systems adopted outside normal IT cycles. That usually means the organisation lacks reliable visibility and consistent enforcement of least privilege.
A: No. Biometric login helps verify who is at the cabinet, while audit review helps reveal what was done after the fact. They solve different parts of the problem. A strong programme uses both, but it still has to remove shared credentials and enforce immediate offboarding or the control model remains incomplete.
Technical breakdown
Why a cabinet behaves like a privileged endpoint
An automated dispensing cabinet is effectively a specialised Windows endpoint with locked physical storage layered on top. It authenticates through the hospital directory, exchanges records with pharmacy and patient systems, and may use biometric verification as a second factor. That means compromise paths are not limited to the device console. Directory trust, network placement, and local credential handling all become part of the attack surface. When the cabinet is domain-joined or tightly coupled to clinical systems, identity failures can persist even when the physical unit itself remains intact. Practical implication: model each cabinet as a managed endpoint with identity dependencies, not a standalone medical device.
Practical implication: Treat cabinets as privileged endpoints and apply the same authentication and segmentation controls you would expect for a sensitive workstation.
How stale permissions and hard-coded credentials create access drift
The recurring failure mode is access drift. A user account expires, but the cabinet keeps accepting the old permissions. A vendor ships a credential that is shared across installations. Or a default password remains active because the device was deployed into clinical service before the credential lifecycle was enforced. In all three cases, the drawer is not the problem. The problem is that the identity behind the action no longer matches the governance state the organisation believes it has. Practical implication: the cabinet’s effective access model must be reviewed as a living entitlement set, not a one-time deployment setting. Read Top 10 NHI Issues.
Practical implication: Review cabinet entitlements, credential status, and default-password removal as part of ongoing identity governance, not implementation.
Why downtime procedures widen the identity control gap
Cabinets are designed to fail open into a manual process when interface disruption lasts long enough. That shift is operationally necessary, but it weakens the identity controls that normally prevent diversion: biometrics, second-check workflows, and system-enforced logs. Once paper forms and override drawers take over, the access path becomes less deterministic and less auditable. That does not mean the cabinet is insecure by design. It means the control model changes under stress, and the organisation must know exactly which governance assumptions disappear during downtime. Practical implication: treat fallback workflows as a separate access regime with explicit accountability and review.
Practical implication: Document and test the downtime access model separately so the fallback process does not become an ungoverned privilege path.
Threat narrative
Attacker objective: The objective is to obtain unauthorised medication access or diversion while preserving the appearance of legitimate ward workflow.
- Entry occurs when an insider, stale account, or unrotated credential reaches the cabinet through the ward network or local console rather than through the internet.
- Credential access happens when the cabinet continues to trust expired directory permissions, shared usernames and passwords, or hard-coded credentials that were never changed.
- Impact follows when the trusted cabinet path is used to remove controlled medication without the normal second check, especially during prolonged downtime or override conditions.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Automated dispensing cabinets expose the identity security gap between physical control and logical trust: the drawer may be locked, but the access path is still governed by accounts, directory membership, and credential lifecycle. That means hospitals are not protecting a device alone; they are governing a privileged identity surface embedded in clinical operations. The practitioner conclusion is straightforward: physical security without identity governance leaves the real control plane exposed.
Standing access is the wrong mental model for ward automation: the article shows that cabinet access can survive account expiry, default credentials, and hard-coded credentials across deployments. That is a classic lifecycle failure, not a hardware failure, and it maps directly to NHI key challenges and risks in a clinical setting. The practitioner conclusion is that access must be continuously revalidated, not assumed safe because the device is inside the hospital.
Identity proofing, not just login strength, determines whether cabinet access is trustworthy: the pharmacy guidance cited in the article pushes biometric use, immediate suspension on separation, and prohibition on shared passwords because the real risk is borrowed or stale access. In practice, this is a governance problem about who can still act inside the cabinet after the organisation believes access should have ended. The practitioner conclusion is to treat offboarding and witness controls as part of medication safety.
Downtime creates a temporary governance vacuum unless it is explicitly modelled: fail-open procedures, paper logs, and disaster keys keep care moving, but they also relax the normal identity checks that make diversion harder. That is why the control question is not whether downtime should exist, but which identities, approvals, and audit trails remain authoritative while the cabinet is in fallback mode. The practitioner conclusion is to predefine the fallback trust boundary before the ward has to use it.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Top 10 NHI Issues
What this signals
Identity governance now reaches into clinical operations: when medication cabinets rely on directory accounts, biometric verification, and connected workflows, the access boundary stops at the login and starts at the ward process. Hospitals should expect cabinet governance to be reviewed alongside endpoint management, offboarding, and incident response, not as a facilities-only concern.
Downtime is a governance state, not just an operations state: once a cabinet falls back to paper forms or override drawers, the organisation is running a different access model with weaker evidence and fewer built-in checks. That makes the pre-approved fallback workflow as important as the normal login path, especially where controlled substances are involved. The programme implication is to rehearse the fallback trust boundary before it is needed.
Clinical automation creates a privilege surface that behaves like any other machine identity problem: the cabinet’s trust in directory membership, default credentials, and local access settings creates the same kind of lifecycle exposure seen in other connected systems. The practical signal for IAM and PAM teams is that medication access reviews belong in the same governance conversation as privileged workstation and third-party access reviews.
For practitioners
- Inventory cabinets as privileged endpoints Map every automated dispensing cabinet to its authentication path, directory dependency, network segment, and local credential store so it is governed as part of the privileged estate.
- Eliminate shared and default access paths Remove any shared username, shared password, or untouched vendor default from cabinet access and verify that local and directory-backed credentials are both covered.
- Test immediate access removal on separation Confirm that access is revoked the same hour employment ends or role changes, and that the cabinet no longer accepts old permissions after directory updates.
- Separate normal and downtime governance Write the manual override process, paper log ownership, and pharmacist approval chain as a distinct control model so fallback access is still auditable.
Key takeaways
- Automated dispensing cabinets are governed access systems, not just locked storage, so identity and network controls matter as much as physical security.
- The article points to real failure patterns including stale permissions, hard-coded credentials, and fallback workflows that weaken oversight during downtime.
- Hospitals should manage cabinet access as a lifecycle problem, with segmentation, offboarding, biometric verification, and audit review all treated as part of the same control model.
Related NHI Mgmt Group resources: Ultimate Guide to NHIs: Key Challenges and Risks · Top 10 NHI Issues · Breach and Attack Simulation (BAS) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Cabinet access depends on directory, biometric, and local authentication paths that can fail or drift. |
| NHI-05 — Overprivileged NHI | Domain-joined cabinets can retain access beyond the role or account state intended by governance. | |
| NHI-07 — Long-Lived Secrets | Hard-coded and default credentials across cabinet lines represent persistent secret exposure. | |
| Recommendation — Review cabinet authentication paths and remove any login mode that still accepts stale or shared credentials. Reconcile cabinet entitlements against current role needs and revoke any excess access immediately. Rotate or replace cabinet secrets that remain valid across deployments and eliminate defaults from production use. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Borrowed credentials and shared access enable abuse of connected clinical systems. |
| Recommendation — Map cabinet abuse to credential access and lateral movement tactics to improve detection coverage. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who can access the cabinet and under what conditions. |
| Recommendation — Apply PR.AA-05 to continuously govern cabinet entitlements, revocation, and access review. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The source highlights shared, default, and hard-coded credentials that should be managed as authenticators. |
| Recommendation — Use IA-5 to control cabinet credential issuance, rotation, and revocation across the lifecycle. | ||
Key terms
- Automated Dispensing Cabinet: An automated dispensing cabinet is a secure medication storage system used in clinical settings to control access, track withdrawals, and support inventory management. It can be a valuable source of evidence in diversion monitoring when paired with electronic records, because discrepancies between cabinet activity and documentation often reveal suspicious behavior.
- Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
- Downtime Governance: The set of controls that remain authoritative when a digital workflow falls back to paper, manual approval, or local override. For identity programmes, the key question is which approvals, logs, and separation-of-duties checks survive the fallback state.
- Identity-Bound Medication Access: A control model in which medication release is tied to a specific authenticated person or account rather than to shared ward access. This reduces borrowing and ambiguity, but it only works when offboarding, witness controls, and audit review are enforced consistently.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org