Topic starter
19/08/2026 3:36 pm
TL;DR: Legacy medical devices stay risky long after support ends, Kusari argues, because age, replacement cost, and patch limits leave them hard to protect. Without inventory and segmentation, healthcare teams face higher exposure to care disruption and longer recovery when problems surface.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “Securing Yesterdayâs Medical Devices against Cyber Threats: Addressing Legacy MedTech”.
Key questions
Q: Why do legacy medical devices create a different risk model from ordinary IT assets?
A: Legacy medical devices can affect patient safety directly, remain in use long after vendor support ends, and may be difficult or impossible to patch.
Q: What breaks when legacy medical devices are connected without isolation?
A: A compromise can spread beyond the device itself and create a broader operational incident.
Q: What should organisations do first when legacy medical devices are not fully supported?
A: Start with a full inventory of every device, including where it is deployed, what it depends on, and whether it is still supported.
Practitioner guidance
- Build a complete medical device inventory Record every device’s location, function, support status, dependencies, and end-of-life date so security decisions are based on an accurate asset picture.
- Segment legacy devices into constrained network zones Use the inventory to place devices behind tighter network boundaries so compromise cannot easily spread to clinical or administrative systems.
- Restrict removable media and external connectivity Apply policies that block unnecessary USB use and other inbound or outbound paths that legacy devices do not require for normal operation.
Bottom line: Legacy medical devices should be treated as high-consequence assets because a compromise can affect care delivery as well as system availability.
Glossary terms: Legacy Medical Device, Compensating Control, Network Segmentation, Business Continuity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:17 pm
Inventory is the control that makes legacy device governance possible. If organisations cannot identify every medical device, they cannot segment it, assess support status, or decide whether a compensating control is needed. The article correctly treats discovery as the first governance layer, because unmanaged devices create blind spots that undermine every other control. For security and clinical teams, the practical conclusion is that inventory quality is now a patient-safety issue, not just an asset-management issue.
A question worth separating out:
Q: Who should be accountable for securing connected medical devices across their lifecycle?
A: Accountability should be shared, but not blurred. Healthcare security teams, clinical operators, and medical device manufacturers all have defined roles. Providers must enforce onboarding, monitoring, and credential discipline. Manufacturers must build secure-by-design devices with unique identities and signed firmware. When ownership is unclear, gaps appear at the handoff points where breaches most often start.
👉 Read our full editorial: Legacy medical device security still depends on inventory and isolation