Healthcare report exposes IoMT device vulnerabilities risks

A recent report by Claroty has highlighted significant vulnerabilities within Internet of Medical Things (IoMT) devices connected to healthcare networks.

The "State of CPS Security: Healthcare Exposures 2025" report reveals that 89% of healthcare organisations have the riskiest 1% of IoMT devices on their networks. These devices are actively targeted by ransomware groups due to their known exploitable vulnerabilities (KEVs) and insecure internet connections.

The study analysed over 2.25 million IoMT devices and more than 647,000 operational technology (OT) devices across 351 healthcare organisations. The focus was on how cyber adversaries exploit vulnerabilities in critical medical assets, with a lens on the escalating severity of cyberattacks in the healthcare sector against limited prevention resources.

Key findings show that 9% of all IoMT devices have KEVs, impacting 99% of surveyed organisations, while 1% of these devices are linked to active ransomware campaigns, affecting 89% of organisations. Additionally, 8% of imaging systems such as X-rays, CT scans, MRI, and ultrasound devices possess KEVs, making them the riskiest category, impacting 85% of organisations.

Hospital information systems are not exempt, as 20% carry KEVs tied to ransomware, affecting 58% of the surveyed healthcare entities.

Ty Greenhalgh, Industry Principal for Healthcare at Claroty, stated, "Hospitals are under immense pressure to digitally transform while ensuring the security of critical systems that support patient care. Cybercriminals, especially ransomware groups, exploit outdated technology and insecure connectivity to gain footholds in hospital networks. To counter these threats, healthcare security leaders must take an exposure-centric approach, prioritising the most critical vulnerabilities and aligning remediation efforts with industry guidelines to protect patient safety and ensure operational continuity."

The report emphasizes the importance of hospitals and healthcare delivery organisations focusing on a targeted approach to addressing vulnerabilities, particularly where insecure internet connections in combination with KEVs present the most significant risk.

As part of the methodology, Team82, Claroty's threat research team, in collaboration with data scientists, provided a snapshot of vulnerability and exposure trends in IoMT and OT devices. This comprehensive analysis aims to guide healthcare organisations in managing and prioritising real, not theoretical, areas of risk.

The report also details disruptions to operational continuity and patient care, with a specific look at how certain medical device risk factors, including ransomware-linked KEVs, can create accessible entry points for cyber threats. By adopting an exposure management-based strategy, the healthcare sector can better manage risks associated with vital medical systems.