Forescout Finds Most Medical Devices Cannot Support Post-Quantum Cryptography

A new assessment reveals that the vast majority of Internet of Medical Things and operational technology devices lack the capacity for post-quantum cryptographic upgrades.

Threat Times Intrusion DeskOctober 9, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek medical imaging monitor sits connected to tangled cables. — AI-generated illustration: Threat Times

Key points

Only 6% of Internet of Medical Things devices can support post-quantum cryptography.
Just 16% of medical operational technology devices are capable of PQC support.
The findings highlight a significant security gap in healthcare infrastructure ahead of quantum threats.

Forescout has released findings indicating that the overwhelming majority of medical devices currently in use are unable to support the transition to post-quantum cryptography (PQC). According to the cybersecurity vendor, only a small fraction of Internet of Medical Things (IoMT) and medical operational technology (OT) devices possess the necessary capabilities to implement these advanced security measures.

The data reveals a stark disparity in readiness across healthcare technology sectors. Forescout found that merely 6% of IoMT devices are capable of supporting PQC. In the medical OT sector, the figure is slightly higher but remains low, with only 16% of devices able to support the cryptographic transition. These statistics suggest that most healthcare organizations are operating with devices that cannot be easily updated to resist potential future attacks from quantum computers.

The Scope of the Vulnerability

The inability to support PQC is a critical concern for healthcare security professionals. As quantum computing technology advances, current cryptographic standards may become vulnerable to decryption. Devices that cannot be updated to PQC standards will remain exposed to these potential threats indefinitely, unless they are replaced entirely.

According to Infosecurity Magazine, the report underscores the difficulty healthcare providers face in securing their digital infrastructure. The low percentages indicate that legacy systems and older device models dominate the current landscape, limiting the ability to implement modern security protocols. This lack of flexibility forces organizations to rely on network-level protections rather than device-level security enhancements.

Impact on Healthcare Organizations

Healthcare providers must now assess their device inventories to understand the extent of this exposure. The findings imply that most hospitals and clinics are relying on devices that cannot be patched or updated to meet future security requirements. This creates a long-term risk that may require significant capital investment to resolve through hardware replacement.

The disparity between IoMT and OT readiness also suggests that different types of medical equipment pose varying levels of risk. IoMT devices, which often connect to broader networks, represent a particularly vulnerable surface area given their low PQC support rate. Medical OT devices, while slightly better prepared, still largely lack the necessary capabilities for a secure transition.

What should you do?

Security teams should prioritize inventorying all connected medical devices to identify those lacking PQC support. Organizations should evaluate the risk associated with each vulnerable device based on its connectivity and the sensitivity of the data it handles. Network segmentation can help isolate devices that cannot be updated, reducing the potential attack surface. Monitoring for vendor announcements regarding PQC compatibility updates is also essential, as some manufacturers may release patches for older models.

What to do and how to stay safe: Forescout

Conduct a comprehensive audit of all IoMT and medical OT devices to determine their current cryptographic capabilities and PQC readiness.
Implement strict network segmentation to isolate legacy medical devices that cannot support post-quantum cryptography from critical hospital networks.
Monitor vendor communications for any future firmware updates or patches that may enable PQC support on existing devices.
Develop a long-term replacement strategy for medical devices that are identified as incapable of supporting necessary security upgrades.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.