Topic starter
11/07/2026 1:56 pm
TL;DR: Claroty’s medical-device trust model turns IoMT governance into continuous visibility, evidence-based risk scoring, and network enforcement, according to Elisity research, with Team82 research showing over 650 disclosed vulnerabilities and KEVs in 99% of 351 healthcare organisations studied. The governing question is not whether devices can be found, but whether identity-aware controls can keep pace with clinical reality.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “What Is Claroty and How Does It Protect Medical Devices (IoMT & Healthcare OT)”.
Key questions
Q: How should healthcare teams govern connected medical device identity?
A: Treat connected medical devices as managed identities with their own lifecycle.
Q: Why do connected medical devices create such a difficult segmentation problem?
A: They mix long-lived clinical functions with changing exposure conditions, proprietary protocols, and patch constraints.
Q: What breaks when IoMT inventory is incomplete?
A: Remediation prioritisation becomes guesswork, and security teams end up protecting what they can see rather than what is most exposed.
Practitioner guidance
- Map every connected medical device to a current trust state Classify IoMT, OT, BAS, and related assets by type, firmware, communication pattern, exposure, and clinical criticality so policy is based on current context.
- Prioritise KEV-bearing and internet-exposed devices first Use exploitability, internet reachability, and ransomware linkage to rank remediation and containment so the riskiest devices are addressed before lower-exposure assets.
- Feed device attributes into segmentation policy Pass device identity, risk score, and role data into network enforcement so pumps, monitors, and imaging systems only reach the clinical services they require.
Bottom line: IoMT governance fails when medical devices are treated as static assets rather than changing trust objects with clinical and network context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
IoMT trust is a governance model, not a product feature. Healthcare teams do not need another static asset list. They need a way to continuously translate device identity, exposure, and clinical criticality into control decisions. That makes trust an operational state that must be recalculated as devices, firmware, and network paths change, not an approval stamp that lasts indefinitely. The practitioner conclusion is straightforward: if trust does not change with exposure, it is not governing risk.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: When should organisations prioritise compensating controls over immediate patching?
A: They should prioritise compensating controls when the patch is likely to disrupt production, requires extended testing, or cannot be safely deployed before the exposure window closes. In those cases, containment reduces immediate risk while preserving time for controlled remediation. This is a scenario decision, not a replacement for patching.
👉 Read our full editorial: Claroty's medical device trust model raises the bar for IoMT governance