Topic starter
19/08/2026 3:36 pm
TL;DR: Legacy medical devices remain a governance problem because they often outlive support periods, depend on older codebases, and can expose patient safety to security failures, according to Kusari. The practical lesson is that inventory, segmentation, vulnerability sharing, and continuity planning matter more than waiting for perfect patching.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “Securing Yesterdayâs Medical Devices against Cyber Threats: Addressing Legacy MedTech”.
Key questions
Q: What should organisations do first when legacy medical devices are not fully supported?
A: Start with a full inventory of every device, including where it is deployed, what it depends on, and whether it is still supported.
Q: Why do legacy medical devices create a different risk model from ordinary IT assets?
A: Legacy medical devices can affect patient safety directly, remain in use long after vendor support ends, and may be difficult or impossible to patch.
Q: What breaks when legacy medical devices are connected without isolation?
A: A compromise can spread beyond the device itself and create a broader operational incident.
Practitioner guidance
- Build a complete medical device inventory Record every device’s location, function, support status, dependencies, and end-of-life date so security decisions are based on an accurate asset picture.
- Segment legacy devices into constrained network zones Use the inventory to place devices behind tighter network boundaries so compromise cannot easily spread to clinical or administrative systems.
- Restrict removable media and external connectivity Apply policies that block unnecessary USB use and other inbound or outbound paths that legacy devices do not require for normal operation.
Bottom line: Legacy medical devices should be treated as high-consequence assets because a compromise can affect care delivery as well as system availability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:17 pm
Inventory is the control that makes legacy device governance possible. If organisations cannot identify every medical device, they cannot segment it, assess support status, or decide whether a compensating control is needed. The article correctly treats discovery as the first governance layer, because unmanaged devices create blind spots that undermine every other control. For security and clinical teams, the practical conclusion is that inventory quality is now a patient-safety issue, not just an asset-management issue.
A question worth separating out:
Q: Who should be accountable for securing connected medical devices across their lifecycle?
A: Accountability should be shared, but not blurred. Healthcare security teams, clinical operators, and medical device manufacturers all have defined roles. Providers must enforce onboarding, monitoring, and credential discipline. Manufacturers must build secure-by-design devices with unique identities and signed firmware. When ownership is unclear, gaps appear at the handoff points where breaches most often start.
👉 Read our full editorial: Legacy medical device security still depends on inventory and isolation