What should organisations do first when legacy medical devices are not fully supported?

What belongs in the first pass when support is uncertain

The first pass is a complete asset inventory, not a control decision. For legacy medical device, that means identifying every device, where it sits, what clinical or operational system it depends on, who uses it, and whether the vendor still supports it. Until that picture exists, segmentation, compensating controls, patch planning, and risk acceptance are all guesses.

A useful inventory has to be operationally specific. A simple list of model names is not enough if it omits network location, clinical ownership, software version, maintenance status, and any upstream or downstream dependency that could expand the blast radius of a compromise or outage.

For healthcare environments, this often includes shared workstations, clinical workflows, and device-adjacent access paths. NHI Management Group’s Healthcare Identity Security Guide is useful because it ties medical device security to the access and workflow realities that usually determine whether an unsupported device can be contained safely.

Why inventory comes before segmentation, isolation, or compensating controls

Legacy devices are usually hard to manage because they combine long service lives, vendor constraints, and dependencies that are not always documented. If you do not know which devices exist or how they connect, you cannot decide which network segments they belong in, which devices need monitoring, or which systems require exception handling.

Inventory also tells you what kind of support problem you actually have. Some devices are unsupported by the vendor but still function safely behind tight controls, while others depend on outdated protocols, shared credentials, or fragile clinical software that makes them materially harder to contain. That distinction changes whether the next step is isolation, replacement, or temporary risk acceptance.

Discovery is the place to identify where compensating controls will matter most. In healthcare networks, a strong inventory should reveal which devices can be segmented without disrupting care, which ones require additional logging or access restrictions, and which ones create immediate exposure because they are reachable from broader hospital networks.

What a usable legacy-device inventory should capture

A practical inventory should capture more than hardware names. At minimum, it should show device type, location, owner, business or clinical function, support status, operating system or firmware version, connectivity, dependencies, maintenance path, and any compensating control already in place.

That record should also distinguish between devices that are merely old and devices that are operationally exposed. A device that is unsupported but isolated, monitored, and used in a tightly bounded workflow is very different from a device that is unsupported, widely reachable, and administered through shared or weakly governed access.

Where inventory work is weak, the common failure is not missing one asset. It is missing the dependency chain that makes the asset risky. For example, a device may appear low risk until you discover it depends on a legacy server, a flat network zone, or a shared administrative path that enlarges the impact of compromise.

Practitioner Guidance

What to prioritise: Start with anything that is unsupported and business-critical, then move to devices that are network-reachable from broad segments or depend on shared infrastructure. Those combinations are usually the fastest route to meaningful risk reduction.

What to verify: Confirm that the inventory is tied to actual deployment, not procurement records. Teams often know what was bought, but not what is still in use, what has been repurposed, or which device is hidden inside a clinical workflow.

What good looks like: You can answer four questions for every device, where it is, who owns it, what it depends on, and whether support still exists. If any of those answers are missing, the organisation is not ready to make a defensible containment or replacement decision.

Practitioner takeaway: Unsupported medical-device management starts with visibility, because every downstream choice, segment, compensate, replace, or accept, depends on knowing exactly what is present and how much clinical exposure it creates.

Related resources from NHI Mgmt Group

• What breaks when healthcare organisations try to secure medical devices with legacy segmentation approaches?
• What should critical infrastructure teams do first when legacy internet-facing devices cannot be fully secured?
• What is the first step in managing non-human identities at scale?
• Should organisations retire legacy endpoint tools before Intune controls are fully validated?