October is Cybersecurity Awareness Month
Throughout the month we will take on cybersecurity subjects that continue to be challenging in healthcare today and ask our experts to weigh in.
Topic #2: Legacy Technology and Medical Device Vulnerabilities
Healthcare runs on a patchwork of:
- Outdated operating systems (Windows 7/XP still appear in clinical environments)
- Unsupported medical devices with hard‑coded credentials
- Fragmented EHR ecosystems that don’t share security standards
Why it’s a challenge:
Clinical devices are regulated, so patching or updating them is slow and expensive. Many devices were never designed with cybersecurity in mind, making them easy entry points for attackers.
Chris Logan, Healthcare CISO, Zscaler
LinkedIn: Christopher Logan
Healthcare will always have technology that can’t be patched or replaced on somebody else’s schedule. You can’t tell a clinical team to stop using a device they depend on because it runs an old operating system. Security has to work around the realities of patient care. That means limiting what those devices can communicate with and making sure a compromise doesn’t give an attacker a path across the network.
John Atkinson, CTO & COO at AxisCare
LinkedIn: John Atkinson
No matter the age of a technology platform, leaders should be asking whether their technology partners are continuously modernizing their infrastructure, strengthening security practices, and adapting to emerging threats. A platform that remains actively developed, regularly updated, and built to meet today’s security and compliance expectations is very different from technology that has simply been left behind. As cyber threats evolve, the technology organizations rely on must evolve with them.
Lesley Berkeyheiser, Senior Director of Accreditation Strategy and Development, DirectTrust
LinkedIn: Lesley Berkeyheiser
Legacy technology and medical devices need to be part of an organization’s cybersecurity planning because attackers will look for systems that are easier to compromise, including older technologies that have not been kept current.
We are seeing healthcare organizations reconsider architectures built around a single, highly interconnected system. When everything depends on the same environment, a compromise can have a much wider operational impact. Breaking systems into more manageable components can make it easier to identify where a problem occurred, isolate the affected area, and begin recovery.
Organizations also need a complete picture of the devices and systems that create, receive, maintain, or transmit health information. That is why legacy platforms, medical devices, and other connected technologies should be captured as part of the security risk assessment and asset inventory.
Keeping software and operating systems current is a key part of reducing exposure. Older technology that cannot be adequately updated or protected should prompt a broader conversation about replacement and long-term risk.
Jeremy Carriger, Chief Information Security Officer, Arcadia
LinkedIn: Jeremy Carriger
Healthcare organizations face a unique vulnerability-management challenge because security teams are responsible for increasingly complex technology environments that include systems supporting critical patient care. Vulnerabilities are increasing while the time available to patch and remediate them is shrinking, and many organizations simply can’t patch as quickly as attackers can exploit. Healthcare also has to be thoughtful about how aggressively it tests those systems. For example, I wouldn’t want an AI-driven penetration test potentially impacting an operating room system. The opportunity is to use AI to augment security teams through areas like alert monitoring and threat triage, helping them identify risk faster without introducing additional risk to critical clinical technology.
Dan Stoke, Chief Growth Officer, Med Tech Solutions
LinkedIn: Daniel Stoke
Healthcare organizations are being asked to defend increasingly connected environments while still relying on technology that may be years, or even decades, old. Legacy systems and medical devices can create significant security challenges because they weren’t necessarily designed for today’s threat landscape, and replacing them isn’t always operationally or financially feasible. Healthcare leaders need a risk-based approach that identifies where their greatest exposures exist and puts appropriate safeguards around technology that can’t immediately be modernized. That means improving visibility into the environment, strengthening access controls, segmenting critical systems where appropriate, and incorporating legacy technology into ongoing risk management. Cybersecurity in healthcare is ultimately about protecting continuity of care. Healthcare organizations have to balance modernization with the reality of keeping essential clinical systems available, secure, and reliable for the people who depend on them.
Russell Teague, Chief Security and Strategy Officer, Fortified Health Security
LinkedIn: Russell Teague
Healthcare organizations often depend on legacy systems and connected medical devices that cannot be replaced or patched on a conventional IT schedule. Unsupported software, limited security capabilities, and connections to other critical systems can create risks to data, device availability, and care delivery. When immediate remediation is not possible, leaders need to reduce exposure and restrict the blast radius.
That starts with an accurate inventory, documented ownership and support status, and prioritization based on clinical importance and exposure. Network segmentation can limit unnecessary communication and lateral movement, while restricted vendor access and monitoring can help reduce and detect misuse. These controls should be developed and validated with clinical engineering, care teams, and device manufacturers to preserve essential clinical functions.
Organizations can reduce risk before the next capital cycle, but compensating controls are not a permanent answer for every device. Leaders need to reassess their effectiveness and establish clear criteria for when the remaining risk requires replacement or removal from service. Architecture, access controls, monitoring, and coordination with device manufacturers can materially improve resilience.
Dr. Nick van Terheyden aka Dr. Nick
Host of News You Can Use
LinkedIn: Nick van Terheyden, MD
Patch it or pitch it.
That infusion pump has been running the same software since flip phones were cool, is not cool anymore. And just because “Flip Phones” are back in doesn’t mean that the software still is. Vintage is great for wine, design, and armchairs, but not for clinical systems. Unsupported software means unsupported patients who are being put at even more unnecessary risk. When your vendor stopped supporting it, that was your signal to drop it, not to put out a welcome mat for uninvited guests. Scan your network and you might find devices nobody remembers buying or attaching. Then ask yourself did you buy them? Inventory every connected device. You can’t protect what you forgot you owned. I have lost track of the number of unsecured Ethernet ports I’ve found in healthcare facilities – how about you?