Should healthcare teams prioritise segmentation or device replacement first?

Why containment usually comes before replacement in healthcare

In most healthcare environments, segmentation wins the first move because it reduces exposure immediately without waiting for capital approval, clinical downtime, procurement cycles, or vendor lead times. When a device is old, embedded in care workflows, or difficult to patch, the practical question is not whether it is risky, but how quickly you can shrink the attack path while continuity of care is preserved.

That makes segmentation a control decision as much as a network design choice. It can isolate vulnerable imaging, infusion, lab, or monitoring systems from broader clinical and administrative networks, which limits lateral movement if the device is abused or compromised. Replacement remains the durable fix, but it is usually slower than the threat window.

NIST SP 800-207 Zero Trust Architecture is relevant here because it frames access around explicit trust decisions, which supports segmentation, least privilege, and narrow communication paths for clinical systems.

When device replacement should move ahead of segmentation

Replacement moves to the front when the device is so unsafe, unsupported, or operationally brittle that it cannot be contained effectively or safely enough. If a device has no viable segmentation option, cannot be monitored reliably, or cannot be placed behind meaningful policy boundaries, then continuing to operate it may leave an unmanageable residual risk.

The key distinction is whether segmentation can materially reduce blast radius. If the answer is yes, it is usually the faster risk-reduction step. If the answer is no, or if the device is already at the edge of operational failure, then replacement becomes the more defensible priority even if it takes longer.

NIST SP 800-82 Rev 3, OT Security Guide is useful because it explains how constrained environments depend on network zoning, monitoring, and controlled conduits when asset replacement is not immediately realistic.

How to make the sequencing decision in practice

The best sequencing rule is simple: choose the control that reduces exposure fastest without disrupting patient safety or essential service delivery. In healthcare, that often means segment first, then schedule replacement as the permanent remediation. The exception is a device whose failure, compromise, or unsupported state creates immediate unacceptable risk that segmentation cannot meaningfully bound.

Operationally, teams should classify devices by criticality, support status, compensating controls, and replacement lead time. A ventilator, monitor, or lab device tied to clinical workflow may require a temporary containment pattern while procurement and validation proceed. A low-value workstation with an exploitable legacy service may be a better candidate for rapid replacement once its network exposure has been narrowed.

Good sequencing usually combines technical containment with business planning. Segmenting buys time, but it should not become a reason to defer replacement indefinitely.

CIS Controls v8 supports this prioritisation because asset inventory, access control, and vulnerability management are the practical building blocks for deciding which systems to isolate, which to retire, and which to monitor closely.

Risk and Threat Considerations

Healthcare devices are attractive targets because they often sit on flat networks, run legacy software, and support essential operations that cannot tolerate long outages. If compromise spreads beyond the device itself, the consequence can move from local exposure to broader service disruption, ransomware propagation, or interruption of clinical care.

Failure mechanism: Weak segmentation leaves a vulnerable device able to communicate too broadly, so compromise of one endpoint can become a route to adjacent systems, shared services, or operational disruption.

Impact: The likely result is increased blast radius, slower containment, and higher business and patient-safety impact, especially where devices are difficult to patch or replace quickly.

Practitioner Guidance

What to prioritise: Start with the devices that are both exposed and operationally hard to replace, then define the smallest viable trust zone around them. If a system is clinically critical, the goal is not perfect security, but immediate containment that is strong enough to preserve safe operation while remediation is planned.

What to verify: Confirm the device can only communicate with the systems it truly needs, that those paths are documented, and that the segregation is enforced at a point teams can actually observe and maintain. If you cannot explain the allowed traffic in one sentence, the segmentation is probably too loose.

Practitioner takeaway: In healthcare, segmentation is usually the first risk-reduction move because it cuts exposure quickly; replacement is the durable fix, but it should follow the containment plan rather than delay it.

Related resources from NHI Mgmt Group

• How should healthcare teams implement zero trust segmentation across mixed IT and medical device environments?
• Should security teams prioritise micro-segmentation or least privilege first?
• Should healthcare teams prioritise MFA coverage or identity provider integration first?
• Should healthcare teams prioritise vendor onboarding or access governance first?