Medical Device Cybersecurity: Insights on Incidents and Risks

A recent report indicates that the increasing integration of artificial intelligence (AI) into medical technology is introducing cybersecurity risks that many healthcare facilities are unprepared to address. The findings, stemming from a cybersecurity software vendor’s assessment of decision-makers, highlight a growing vulnerability as medical devices become more connected and reliant on AI-driven functionalities.

The report, initially flagged by a Google Alert for cybersecurity, doesn’t name the specific vendor or detail the methodology used to gather its data. However, it points to a significant gap between the adoption of AI-enabled medical devices and the cybersecurity measures in place to protect them. This disconnect leaves hospitals and healthcare providers susceptible to potential breaches and disruptions.

Rising Healthcare Cybersecurity Threats

The healthcare sector has become a prime target for cyberattacks, with ransomware incidents surging by 30 percent in 2025, according to a March 3, 2026 report from the Los Angeles Times. These attacks frequently target operational technology and medical devices, disrupting patient care and potentially compromising sensitive data. The interconnected nature of modern healthcare systems, facilitated by the Internet of Medical Things (IoMT), exacerbates these risks, as a vulnerability in one device can expose entire networks.

The Los Angeles Times report also notes that over 20 percent of healthcare organizations reported experiencing a cyberattack that directly impacted medical devices in the past year. This underscores the real and growing threat to patient safety and operational efficiency.

SBOMs and Regulatory Scrutiny

In response to these escalating threats, the Food and Drug Administration (FDA) is tightening its cybersecurity guidance for medical devices. A key component of this effort is Section 524B, which mandates that manufacturers provide a Software Bill of Materials (SBOM) for all new connected medical devices. An SBOM is essentially a detailed inventory of the software components used in a device, allowing security professionals to identify and address potential vulnerabilities more effectively.

The FDA’s increased scrutiny reflects a broader recognition of the need for proactive cybersecurity measures throughout the medical device lifecycle. This includes not only new devices but also legacy systems, which often present a critical vulnerability due to running on unsupported operating systems that cannot receive modern security patches.

The Challenge of Legacy Devices

The Los Angeles Times report emphasizes the particular risk posed by legacy medical devices. These older devices, often lacking modern security features, can serve as entry points for attackers. Addressing this challenge requires a multi-faceted approach, including network segmentation to isolate vulnerable devices and robust threat modeling to identify potential attack vectors.

Effective threat modeling, as outlined in the Los Angeles Times article, involves hospitals carefully mapping their networks to understand how different devices and systems interact. This allows them to identify critical vulnerabilities and implement appropriate security controls.

Cloud Computing, AI/ML, and Post-Quantum Cryptography

A discussion paper published by MITRE on April 22, 2026, further explores cybersecurity considerations for medical devices incorporating evolving technologies. The paper, authored by Melissa Chase, Steven Christey Coley, Moses Liskov, and Margie Zuk, focuses on three specific areas: cloud computing, artificial intelligence and machine learning (AI/ML), and post-quantum cryptography (PQC). Cloud computing and AI/ML are identified as technologies that present new cybersecurity risks, while PQC is presented as an emerging technology to mitigate the risks posed by quantum cryptography.

The MITRE report notes that medical device manufacturers (MDMs) are increasingly adopting both established and emerging technologies, each introducing unique cybersecurity challenges. Addressing these challenges requires a proactive and comprehensive approach to security, encompassing both general cybersecurity principles and technology-specific considerations.

AdvaMed® Cybersecurity Summit

Industry stakeholders are actively working to address these challenges. The Advanced Medical Technology Association® (AdvaMed®) recently held a Cybersecurity Summit, indicating a growing focus on collaboration and knowledge sharing within the medical technology sector. Details about the summit’s specific outcomes and discussions were not immediately available.

As AI continues to permeate medical technology, the need for robust cybersecurity measures will only become more critical. Healthcare facilities must prioritize investment in security infrastructure, training, and proactive threat modeling to protect patient safety and maintain the integrity of their systems. The FDA’s increased regulatory oversight and the industry’s collaborative efforts, such as the AdvaMed® Cybersecurity Summit, represent important steps in addressing this evolving threat landscape.