The seven main security risks for medical devices are outdated software, weak credentials, insecure networks, missing encryption, poor device tracking, vendor and supply chain risk, and weak emergency response planning. Connected devices are also the weakest spot in one widely used set of practices: in the Healthcare Cybersecurity Benchmarking Study 2025, Network Connected Medical Device Security scored 48%, the lowest of ten HICP practices and well below the 70% average[1]. The same practice ranked last of the ten in all three editions of the study: 48% in 2025[1], 50% in 2024[2], and 54% in 2023 [3].

The study surveyed 69 healthcare and payer organizations from September to December 2024. The HICP section was optional, and 32 organizations answered it[1]. All coverage figures are average self-reported coverage. This article pairs each of the seven risks with the benchmark figure that bears on it, then covers who regulates what, the three-year device trend, the fixes, and where to start.

Quick summary: the 7 risks, the fix, and the benchmark figure

Seven medical device security risks, the main fix, and the 2025 benchmark figure
RiskWhat goes wrongMain fix2025 benchmark figure
1. Outdated softwareDevices lack critical security patchesPatch management and a software inventoryMitigate Known Vulnerabilities: 74% (n=69)
2. Weak passwordsDefault or shared credentialsMulti-factor authentication, role-based access, unique credentialsUnique Credentials: 81%; Multifactor Authentication: 83% (n=69)
3. Insecure networksUnsegmented or default-configured networksSegmentation and configuration managementNetwork Segmentation: 56%; Configuration Management: 61% (n=69)
4. Lack of encryptionPatient data sent without encryptionEncrypt data in transit and at restStrong Encryption: 77% (n=69)
5. Poor device trackingMissing or unmonitored devicesA maintained asset inventoryAsset Inventory: 62% (n=69); IT Asset Management: 66% (n=32)
6. Vendor riskWeak supply chain securityVendor evaluations and SBOM requestsSupply Chain Risk Management: 52%; Vendor/Supplier Cybersecurity Requirements: 65% (n=69)
7. Weak emergency responseSlow response worsens breachesTested incident response plansRespond: 85%; Basic Incident Planning and Preparedness: 78% (n=69)

‍

The HPH CPG and NIST CSF 2.0 figures in this table measure organization-wide practices, not devices alone. Only the HICP figures name medical devices directly[1].

Medical device security basics

What medical device security covers

Medical device security keeps patients safe, protects sensitive data, and keeps devices working as intended. It rests on three connected areas, and a weakness in one can undermine the others.

The three areas of medical device security
ComponentDescriptionKey focus areas
Data protectionProtecting patient informationHealth records, device logs, secure transmissions
Device operationMaking sure devices function properlySoftware integrity, access controls, operational safety
Patient safetyPreventing device tamperingReal-time monitoring, threat detection, incident response

‍

These areas matter most for devices such as insulin pumps and pacemakers that connect to hospital networks. The task for healthcare providers is to add strong security without getting in the way of how clinicians use the device.

Who is regulated for what

HIPAA applies to healthcare organizations and focuses on encryption, access controls, and audit trails to protect health information. The FDA's cybersecurity requirements apply to device manufacturers. Under section 524B of the FD&C Act, manufacturers of cyber devices must include three things in premarket submissions starting March 29, 2023: a plan to monitor, identify, and address postmarket vulnerabilities, processes that provide reasonable assurance the device is cybersecure, and a software bill of materials (SBOM) covering commercial, open-source, and off-the-shelf components[4]. The FDA defines a cyber device as one that includes software, can connect to the internet, and has technological characteristics that could be vulnerable to cybersecurity threats[4].

In November 2023 the FDA recognized the consensus standard ANSI/AAMI SW96:2023 on medical device security risk management, which gives sponsors direction on addressing cybersecurity risks in device design and development[5]. For a healthcare organization, the practical result is a lever in procurement. Ask manufacturers for the SBOM and for their process for handling postmarket vulnerabilities, and keep HIPAA safeguards in place on the devices you operate.

What the 2025 Benchmarking Study found about devices

The study measured HICP, a set of ten healthcare-specific cybersecurity practices, among the 32 organizations that opted in. Email protection was the strongest practice and medical device security the weakest.

Selected HICP practice coverage
HICP practice (selected)Coverage (n=32)
Email Protection Systems86%
Vulnerability Management77%
IT Asset Management66%
Network Connected Medical Device Security48%
Average of all ten practices70%

‍

The report says coverage of medical device security has lagged the other HICP practices for three consecutive years, and that this supports findings from NIST CSF 2.0 and the HPH CPGs that third-party risk management and asset management still lag in industry coverage[1]. In the HPH CPGs, Network Segmentation had the lowest coverage of any goal at 56%. The report notes that segmenting medical or legacy devices that no longer receive security patches restricts their access to the internet and other critical systems, which lowers risk[1].

Medical device security coverage across three editions

Censinet, KLAS, and the American Hospital Association have measured HICP coverage in each of the last three studies, and medical device security was the lowest-covered of the ten practices every time[1][2][3].

Medical device security coverage across three editions of the Benchmarking Study
Study editionPublishedOrganizations in studyOrganizations answering HICPMedical device security coverage
2023April 2023484854%
2024February 2024585450%
2025April 2025693248%

‍

Read this as three annual readings, not a tracked change in the same organizations. The samples differ: the 2024 HICP figure covers the 54 payer and provider organizations in that study, and the 2025 HICP section was optional[1][2][3]. Within those limits, the three readings sit within six percentage points of each other and none rises above 54%. The 2023 report described medical device security as "an area of industry-wide vulnerability, with average coverage barely over 50%"[3].

Ownership and device security coverage in 2023

The 2023 study asked how much of each practice area was owned by information security leadership, and it found a significant correlation between ownership and coverage for medical device security[3].

Medical device security coverage by ownership, 2023 study
Ownership of medical device securityOrganizationsCoverage
No ownership by information security leadership1845%
Shared between information security leadership and other departments1457%
Owned completely by information security leadership1663%

‍

Organizations with complete ownership reported coverage 18 percentage points above those with none[3]. This is a correlation in survey data and does not show that ownership causes higher coverage. It does suggest a low-cost question to ask first: who is accountable for the devices on your network?

7 main security risks for medical devices

1. Outdated software and lack of updates

Many legacy systems no longer receive regular security patches, which makes them easy targets. In an August 2023 report, Health-ISAC, Finite State, and Securin found 993 vulnerabilities across 966 medical products and devices, a 59% increase from 2022[6]. Across the organizations in the Benchmarking Study, coverage of the Mitigate Known Vulnerabilities goal was 74%[1].

2. Weak passwords and login practices

Default passwords and shared login credentials remain common and undermine both security and accountability. Organization-wide coverage of Unique Credentials was 81% and Multifactor Authentication 83%. These figures describe programs as a whole and are not device-specific, so confirm that the same controls reach devices that cannot easily support them[1].

3. Insecure network connections

Devices on unprotected wireless networks, unsegmented systems, and default configurations invite unauthorized access and the spread of malware. Network Segmentation (56%) and Configuration Management (61%) were among the lowest-covered HPH CPG goals[1].

Network issues and related 2025 benchmark coverage
Network issueMain concernRelated 2025 benchmark coverage (n=69)
Unsegmented networksSpread of malwareNetwork Segmentation: 56%
Unprotected wirelessUnauthorized accessNetwork Segmentation: 56%
Default configurationsEasy entry for attackersConfiguration Management: 61%

‍

4. Lack of data encryption

Sensitive patient data is often transmitted without encryption, which exposes it to interception. Coverage of the Strong Encryption goal across the 69 organizations was 77%[1].

5. Poor device tracking

Without a reliable inventory, facilities struggle to monitor device usage, spot unauthorized access, and maintain equipment on schedule. Asset Management was among the two lowest NIST CSF 2.0 categories at 53%, HPH CPG Asset Inventory was 62%, and HICP IT Asset Management was 66% among the 32 organizations that answered that section[1].

6. Risks from vendors and supply chains

Third-party vendors and suppliers can introduce vulnerabilities. Supply Chain Risk Management had the lowest coverage of any NIST CSF 2.0 category at 52%, and the Vendor/Supplier Cybersecurity Requirements goal was the weakest Essential Goal at 65%[1]. Because manufacturers of cyber devices must provide an SBOM in premarket submissions, buyers can ask for it during procurement[4].

Third parties also figure in ransomware. A January 2023 Ponemon Institute report sponsored by Censinet, based on 579 IT and IT security professionals in healthcare delivery organizations, found that 47% of respondents said their organizations had a ransomware attack in the past two years, and that 46% of those respondents said the attack was caused by a third party, up from 36% in 2021[7]. The survey covers ransomware generally and does not isolate medical devices, so treat it as context for vendor risk rather than a device statistic.

7. Poor emergency response planning

Inadequate incident response plans delay action and increase the damage from a breach. Respond was the strongest NIST CSF 2.0 function at 85%, and Basic Incident Planning and Preparedness scored 78%[1]. The task is to make sure those plans cover compromised devices, including how to isolate them without interrupting care.

The stakes for patients are documented. In the same Ponemon report, 53% of respondents whose organizations had a ransomware attack said it disrupted patient care. The report calls the increase in patients transferred or diverted to other facilities the most prevalent impact, at 70% of respondents, and 45% reported more complications from medical procedures, up from 36% in 2021[7]. A business continuity plan that includes a planned system outage in the event of a ransomware attack was in place at 60% of respondents' organizations, up from 54%[7]. These figures describe ransomware in general, not device incidents specifically.

Solutions for medical device security

Update and patch management

  • - Use automated patch management tools to streamline updates.
  • Apply critical security patches promptly.
  • Maintain a complete inventory of device software and schedule updates regularly.
  • Where the manufacturer supports it, configure devices to run only known processes and executables. In the 2023 study, fewer than two-thirds of organizations did this, and most of those did it for only some devices[3].
  • Wipe all data from devices when they are decommissioned. Almost all 2023 respondents reported doing this[3].

Passwords and access controls

Access control methods and their purpose
Access control methodPurpose
Multi-factor authenticationAdds layers of verification to block unauthorized access
Role-based accessLimits user permissions based on job duties
Biometric authenticationAdds protection for sensitive systems through unique traits
Password rotationRegularly updates credentials to reduce the risk of breaches

‍

Network security

  • Segment networks to isolate medical devices from other systems.
  • Deploy firewalls and intrusion detection tools.
  • Run frequent network security assessments.
  • Monitor device communications continuously for unusual activity.

Data encryption

  • Use asset management software to keep an inventory.
  • Track device location in real time where feasible.
  • Monitor device usage to detect anomalies.
  • Audit regularly to confirm every device is accounted for.
  • Name an owner for medical device security. In 2023, organizations where information security leadership owned it completely reported 63% coverage, against 45% where it did not[3].

Vendor security oversight

  • Evaluate vendors regularly.
  • Write specific security requirements into contracts, including SBOM delivery.
  • Coordinate incident response plans with vendors.
  • Monitor vendor compliance with the agreed standards.

Emergency response plans

  • Define clear protocols and assign dedicated response teams.
  • Set communication procedures for all stakeholders.
  • Build recovery strategies to resume normal operations quickly.

Conclusion

Key risk summary

Medical device vulnerabilities affect patient safety and hospital operations. The seven risks, from outdated software to weak emergency planning, each have a matching practice, and the 2025 benchmark shows where coverage is thinnest: medical device security (48%), network segmentation (56%), and supply chain risk management (52%)[1]. Medical device security has been the lowest-covered HICP practice in every edition, at 54% in 2023, 50% in 2024, and 48% in 2025[1][2][3].

Next steps

  1. Benchmark your program. Compare your own coverage of these practices with peers. You can join the benchmarking study to see where you stand.
  2. ‍Assign ownership. Decide who is accountable for medical device security, since the 2023 study found higher coverage where information security leadership owned it completely[3].
  3. Build a multi-layered approach. Combine device inventory, access control, network segmentation, and vendor oversight, and align them to the NIST Cybersecurity Framework and the standards above.
  4. Strengthen vendor and product oversight. Censinet describes its third-party risk capability as covering vendors and products "from medical devices and cloud software to robotics and consulting services," with a centralized vendor and product inventory.

FAQs

What are the main security risks for medical devices?
Outdated software, weak passwords, insecure networks, lack of encryption, poor device tracking, vendor risks, and inadequate emergency response planning.

How can healthcare organizations secure medical devices?
Update and patch software, use strong access controls, encrypt data, segment networks, track devices, evaluate vendors, and prepare and test incident response plans.

Why is medical device security important?
It protects patient safety, keeps devices working, and safeguards sensitive data. The 2025 benchmark found medical device security to be the lowest-covered of ten HICP practices, at 48%[1].

Has medical device security coverage improved?
No, not in the benchmark readings. Coverage was 54% in the 2023 study, 50% in 2024, and 48% in 2025, and it was the lowest of the ten HICP practices each time[1][2][3]. The samples differ between editions, so these are annual readings rather than a change tracked in the same organizations.

What regulations and standards apply?
HIPAA applies to healthcare organizations. FDA requirements under section 524B apply to device manufacturers and include an SBOM and a postmarket vulnerability plan[4]. The FDA recognized ANSI/AAMI SW96:2023 in November 2023[5].

What role does encryption play?
Encryption protects patient data in transmission and storage and lowers the risk of interception. Coverage of the Strong Encryption goal across 69 organizations was 77%[1].

How can vendors affect medical device security?
Weak supply chain security can introduce vulnerabilities. Evaluate vendors regularly, require an SBOM, and coordinate incident response. Supply Chain Risk Management had the lowest NIST CSF 2.0 coverage of any category, at 52%[1].

References

  1. KLAS Research and Censinet, with the American Hospital Association. Healthcare Cybersecurity Benchmarking Study 2025, Executive Summary (April 2025). https://censinet.com/2025-healthcare-cybersecurity-benchmarking-study-executive-summary
  2. Censinet, KLAS Research, the American Hospital Association, Health-ISAC, and the Healthcare and Public Health Sector Coordinating Council. Healthcare Cybersecurity Benchmarking Study 2024: Improving Cybersecurity Preparedness through NIST CSF & HICP Best Practices (February 2024). https://censinet.com/2024-healthcare-cybersecurity-benchmarking-study-executive-summary
  3. Censinet, KLAS Research, and the American Hospital Association. Healthcare Cybersecurity Benchmarking Study: How Aligned Is the Industry to NIST and HICP Best Practices? (April 2023). https://censinet.com/2023-healthcare-cybersecurity-benchmarking-study-executive-insights
  4. U.S. Food and Drug Administration. Cybersecurity in Medical Devices Frequently Asked Questions (FAQs), section 524B of the FD&C Act (content current as of June 26, 2025). https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs
  5. American Hospital Association. FDA recognizes ANSI/AAMI medical device standard to enhance cybersecurity (November 8, 2023). https://www.aha.org/news/headline/2023-11-08-fda-recognizes-ansiaami-medical-device-standard-enhance-cybersecurity
  6. Finite State, Health-ISAC, and Securin. Joint research report on medical device vulnerabilities (August 8, 2023). https://finitestate.io/blog/exploitable-vulnerabilities-that-expose-healthcare-facilities-surged-nearly-60-since-2022
  7. Ponemon Institute, sponsored by Censinet. The Impact of Ransomware on Patient Safety and the Value of Cybersecurity Benchmarking (January 2023). https://censinet.com/ponemon-research-report-the-impact-of-ransomware-on-patient-safety-and-the-value-of-cybersecurity-benchmarking