Notifications
Clear all
Topic starter
19/08/2026 3:33 pm
TL;DR: Hospital networks now contain 10,000 to 15,000 connected medical devices on average, while 53% of those devices have at least one critical vulnerability and 75% of infusion pumps have known unpatched flaws, according to Sprocket Security's analysis of healthcare IoT risk. The security problem is no longer perimeter protection, but visibility, segmentation, and safe testing for unmanaged devices that attackers can use as pivot points.
NHIMG editorial — based on content published by Sprocket Security: medical device security gaps in hospital networks
By the numbers:
- 53% of connected medical devices contain at least one critical vulnerability.
- 75% of infusion pumps have known, unpatched security flaws.
- Only 20% of respondents said they had a mature program for assessing and managing medical device security.
Questions worth separating out
Q: What breaks when medical devices are left outside normal security controls?
A: The main failure is not just device compromise.
Q: Why do connected medical devices increase lateral movement risk in hospitals?
A: They often sit on networks that connect to EHR, directory services, and other high-value systems, yet they lack EDR, strong logging, and routine patchability.
Q: How do security teams know whether medical device segmentation is working?
A: A good test is whether a compromised device can reach patient records, directory services, or backup systems without an explicit, monitored control point.
Practitioner guidance
- Map the medical device attack surface Inventory every connected clinical device, including firmware, network path, owner, and patchability, so exposure is visible before an incident exposes it for you.
- Segment device traffic from identity and record systems Place infusion pumps, monitors, and other high-risk devices in tightly controlled network zones that cannot directly reach EHR, Active Directory, or backup infrastructure.
- Test pivot paths, not just device exploits Include the device VLAN in penetration tests and validate whether a compromised device can reach higher-value systems through allowed routes or weak trust relationships.
What's in the full article
Sprocket Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Device-network penetration testing methods that account for clinical safety constraints and realistic pivot paths
- Attack surface monitoring approaches for OT and IoT assets with limited agent support
- Examples of how hospitals can segment medical device VLANs without breaking care delivery
- Practical guidance on validating whether an infected device can reach EHR or backup systems
👉 Read Sprocket Security's analysis of medical device attack surface risk in hospitals →
Medical device security gaps: what healthcare teams need to fix?
Explore further
19/08/2026 4:15 pm
Connected medical devices are now part of identity-adjacent governance, not just clinical engineering. Once a device can be used as a pivot point, it becomes a security-controlled asset even if it is not a person, workload, or conventional endpoint. That puts inventory accuracy, network trust boundaries, and lifecycle ownership into the same governance conversation as access review. Practitioners should treat unmanaged clinical devices as a governed population, not a separate exception set.
A question worth separating out:
Q: Who is accountable when a medical device cyber issue affects patient safety?
A: Accountability sits with the manufacturer for ensuring cybersecurity does not compromise clinical performance, but healthcare operators also need ownership for deployment, monitoring, and maintenance. The practical question is not who caused the weakness alone, but who controls the patch path, the risk decision, and the response when patient harm becomes plausible.
👉 Read our full editorial: Medical device security gaps are now hospital security gaps
