The Bedside Is A New Attack Surface: Securing Medical Devices In The Age Of AI
A new report reveals that 89% of healthcare organizations have internet-exposed medical devices with known vulnerabilities, as AI integration creates additional attack surfaces in healthcare systems.
When ransomware attacks hospitals, the focus typically lands on stolen records. However, the more concerning threat lies in bedside devices like infusion pumps, patient monitors, and imaging systems that now incorporate AI. These devices don't just store data—they actively influence clinical decisions, and their growing connectivity makes them prime targets for cyber attacks.
Widespread Vulnerabilities
Claroty's 2025 report examined over 2.5 million Internet of Medical Things (IoMT) devices across 351 healthcare organizations, finding that 89% had internet-exposed devices with vulnerabilities known to be exploited in ransomware campaigns.
In January 2025, the Cybersecurity and Infrastructure Security Agency (CISA) and the FDA issued warnings about Contec CMS8000 patient monitors containing hidden functionality that allowed remote file downloads and execution. While researchers debated whether this was a deliberate backdoor or insecure design, the risk to hospital networks remained equally dangerous.
AI Expands Attack Surfaces
The integration of AI into medical devices has created new vulnerabilities. The FDA's list of AI-enabled medical devices now includes over a thousand authorized products, primarily in radiology. These tools introduce threats traditional security programs weren't designed to address, including data poisoning, model inversion, evasion, data leakage, and performance drift.
In plain terms, an attacker may not need to 'break' the device at all. They could quietly degrade the model so it misses a tumor or flags the wrong patient, and nobody notices for months.
Regulatory Response
Regulators have raised security requirements through Section 524B of the Federal Food, Drug and Cosmetic Act, which mandates manufacturers submit vulnerability monitoring plans, maintain patch processes, and provide software bills of materials (SBOMs). In June 2025, the FDA finalized updated guidance on cybersecurity in medical devices, specifying documentation expectations for these obligations.
Critical Actions for Leaders
Healthcare leaders must implement several key measures: maintain real-time inventories of connected devices with firmware versions and AI models; implement strict network segmentation; require SBOMs and AI documentation from vendors; treat AI models as separate assets with dedicated threat models; and integrate clinical engineering, IT security, and clinicians in security planning.
Medical device security has evolved from a niche concern to a patient safety issue requiring board-level attention. While regulators have set expectations for manufacturers, healthcare organizations must close the operational gap to protect patients from increasingly sophisticated cyber threats.
Related
