Topic starter
19/08/2026 3:33 pm
TL;DR: Hospital networks now contain 10,000 to 15,000 connected medical devices on average, while 53% of those devices have at least one critical vulnerability and 75% of infusion pumps have known unpatched flaws, according to Sprocket Security's analysis of healthcare IoT risk. The security problem is no longer perimeter protection, but visibility, segmentation, and safe testing for unmanaged devices that attackers can use as pivot points.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Why Connected Medical Devices Are Your New Perimeter”.
Key questions
Q: What breaks when medical devices are not included in security governance?
A: Hospitals lose visibility into a large internal attack surface, and attackers can use unmanaged devices as quiet pivot points into EHR, directory, and backup systems.
Q: Why do unpatched medical devices create such a high ransomware risk?
A: They sit inside trusted hospital networks, often with outdated firmware and default access patterns, so compromise on one device can enable lateral movement without re-entering the perimeter.
Q: What are the signs that medical device segmentation is failing?
A: Warning signs include clinical devices reaching directory services or backup networks, unusual outbound traffic from device VLANs, and security tools that cannot explain which devices are present or how they are configured.
Practitioner guidance
- Inventory every connected medical device Build and maintain a complete inventory of pumps, monitors, imaging systems, ventilators, and nurse call devices, including firmware version, ownership, network location, and support status.
- Segment clinical devices from critical systems Place medical device networks on tightly controlled segments that cannot directly reach EHR platforms, directory services, or backup infrastructure without explicit, monitored pathways.
- Replace default and shared device credentials Find devices still using vendor defaults or shared admin accounts and remove those trust assumptions before they become a lateral movement path.
Bottom line: Connected medical devices have shifted from a peripheral concern to a core hospital attack surface because many are unmanaged, old, and still reachable from critical internal systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:15 pm
Medical device fleets have become a governance problem, not just a clinical engineering problem. Once connected devices share internal networks with identity systems and EHR platforms, their access paths become part of the hospital trust model. That means the security programme has to account for network reach, credential state, and device lifecycle together. Practitioners should treat unmanaged clinical technology as a first-class governance domain, not an exception.
A question worth separating out:
Q: Should healthcare teams prioritise safe device testing over aggressive scanning?
A: Yes, because intrusive scanning can disrupt patient care and still miss the attack paths that matter most. The practical priority is passive discovery plus controlled validation of reachability, credential exposure, and pivot paths, so teams can reduce risk without creating clinical downtime.
👉 Read our full editorial: Medical device security gaps are now hospital security gaps