IoMT Vulnerabilities Statistics & Security Trends 2026

• Rising exposure: The rapid growth of IoMT networked medical devices such as monitors, pumps, and imaging systems has vastly expanded the attack surface of hospitals.
• Critical vulnerability stats:
  • Each medical device averages 6.2 known vulnerabilities, per 2021 research cited by the FBI.
  • More than 40% of medical devices at the end-of-life stage offer little to no security patches or upgrades.
  • 99% of healthcare organizations have IoMT devices with known exploited vulnerabilities (KEVs), per Claroty Team82's 2025 research.
• Financial & operational impact:
  • Average healthcare breach cost: $6.64M in IBM's 2026 report, down from $7.42M in 2025.
  • Only 36% of healthcare ransomware victims paid the ransom in 2025, down from 61% in 2022 (Sophos).
• Why it matters: IoMT weaknesses directly threaten patient safety, data integrity, and regulatory compliance (HIPAA, FDA, NIST CSF).
• Best-practice defenses:
  • Maintain SBOMs (Software Bills of Materials).
  • Enforce network segmentation and access control.
  • Conduct specialized IoMT penetration testing to identify exploitable flaws.
• Key takeaway: Securing IoMT ecosystems requires continuous visibility, patch governance, and targeted pentesting to prevent costly, life-impacting breaches.

What Is IoMT and Why It Matters

The Internet of Medical Things IoMT refers to all the connected medical devices and applications in healthcare from wearable heart monitors and infusion pumps to MRI scanners and hospital IT systems.

The scale is large: Claroty Team82's 2025 healthcare study alone analyzed more than 2.25 million IoMT devices and 647,000 OT devices across 351 healthcare organizations. The appeal is clear: real time patient monitoring and smarter treatment.

But complexity breeds risk. Unlike consumer IoT, these devices must not only handle data securely but also deliver life critical care. This means that even minor vulnerabilities like default passwords on an IV pump can have fatal consequences.

Why it matters now: Healthcare environments are under attack more than ever. Industry research shows known exploited vulnerabilities on IoMT devices in 99% of the healthcare organizations studied.

The stakes are high: ransomware and data breaches in healthcare disrupt patient care and expose millions of records every year. In 2026, IoMT security is a boardroom issue. Under section 524B of the FD&C Act, the FDA requires cybersecurity plans and SBOMs in premarket submissions for cyber devices, and insurers increasingly ask for evidence of testing and remediation.

This guide dives into the latest IoMT vulnerability statistics for 2025 and 2026, real world impact, and steps to protect your devices and data.

IoMT Vulnerability Landscape: Key Statistics 2025-2026

• Ubiquity of flaws:
  • Claroty Team82's State of CPS Security: Healthcare Exposures 2025 found that 9% of IoMT devices contain confirmed known exploited vulnerabilities (KEVs), and 99% of healthcare organizations have at least one such device.
  • The same research found 89% of organizations host the riskiest 1% of IoMT devices: those with KEVs linked to active ransomware campaigns and insecure internet connectivity.
  • An FBI private industry notification cited research finding that 53% of connected medical devices and other IoT devices in hospitals had known critical vulnerabilities. In other words, most healthcare networks have multiple ways in.
• Device exposure:
  • Research from Modat, highlighted in Health-ISAC's September 2025 newsletter, found 1.2 million healthcare devices and systems exposed online, putting patient records at risk.
  • This exposure means adversaries can reach some hospital devices directly over the internet.
• High flaw counts:
  • A 2021 research report cited by the FBI found an average of 6.2 vulnerabilities per medical device, far above typical enterprise hardware.
  • Many of these are critical bugs, and they persist: devices often stay vulnerable for years because patching clinical equipment is slow.
• Outdated systems:
  • IoMT gear tends to be old. More than 40% of medical devices at the end-of-life stage offer little to no security patches, per the FBI, and Forescout's 2026 research found legacy Windows versions more prevalent in healthcare (35%) than in any sector except retail (39%).
  • These legacy systems are the low hanging fruit that attackers love.
• Prevalence of weak credentials:
  • Default or hard coded passwords remain one of the most common IoMT weaknesses.
  • If these credentials are never changed, attackers can often log in immediately.
• Poor protections: Many IoMT devices cannot run endpoint security agents like antivirus. Most run special purpose operating systems, making them easy targets for malware.
• Increasing exploits:
  • New IoMT specific risks keep emerging. Forescout's Riskiest Connected Devices of 2025 report recorded a 15% year-over-year increase in average device risk and added four IoMT types: imaging devices, lab equipment, healthcare workstations, and infusion pump controllers.

Most Vulnerable Device Types

Some IoMT categories stand out:

• Infusion pumps:
  • A 2022 Unit 42 analysis of more than 200,000 infusion pumps found 75% had one or more known security gaps.
  • About 52% were susceptible to two 2019 CVEs, one critical and one high severity (CVE-2019-12255 and CVE-2019-12264), in a third party network stack.
  • These pumps run legacy firmware and often use hard coded passwords, making them ideal targets.
• Imaging equipment:
  • Radiology devices, CT/MRI scanners, X-ray machines are also riddled with bugs.
  • Claroty Team82 found 8% of imaging systems (X-ray, CT, MRI, ultrasound) carry KEVs linked to ransomware and insecure internet connectivity, affecting 85% of organizations, making imaging the riskiest medical device category.
  • Forescout ranked imaging devices the riskiest IoMT category in 2025, and its 2026 list includes MRI scanners, DICOM gateways, and medical image printers.
  • Many imaging systems run outdated Windows versions and unencrypted DICOM protocols by default.
• Patient monitors & IV controllers:
  • Networked vital sign monitors and IV drip controllers often run old OS too.
  • For example, Forescout added infusion pump controllers to its riskiest devices list in 2025, and medication dispensing systems joined the list in 2026.
  • Hospital pharmacy and lab systems similarly often lack patches.
• Wearables/implants:
  • Though harder to survey, certain implantables like pacemakers or insulin pumps have known Bluetooth and radio flaws.
  • The FDA has issued advisories and recalls for these devices.
  • However, most published IoMT stats focus on hospital equipment above.

DeepStrike's Mobile Application Penetration testing covers the clinician and patient apps that control IoMT devices, and the APIs behind them.

Impact on Healthcare: Breaches and Costs

The consequences of these vulnerabilities are real and growing:

• Major data breaches: Healthcare breaches have exploded.
  • In 2025, more than 770 large breaches (500+ records) were reported to the HHS OCR breach portal, a record, affecting about 138.5 million individuals. Hacking and IT incidents caused more than 80% of them.
  • Top breaches, like the 2024 BlackCat attack on Change Healthcare, hit about 192.7 million individuals, and the company paid a $22M ransom.
  • More than 289 million individuals were affected by large breaches reported in 2024, driven by Change Healthcare (HIPAA Journal analysis of OCR data).
• High breach costs:
  • IBM puts the average cost of a healthcare data breach at $9.77 million in 2024, $7.42 million in 2025, and $6.64 million in 2026.
  • Many hospitals run on thin operating margins, so a single breach can be catastrophic.
• Ransomware surge: Ransomware has become endemic.
  • Sophos' State of Ransomware in Healthcare 2025 found only 36% of victims paid the ransom, down from 61% in 2022, and exploited vulnerabilities were the top technical root cause (33% of incidents).
  • Ransom incidents not only steal data but can shut down patient care.
• Long recovery time:
  • Beyond the raw data cost, downtime and recovery are brutal.
  • IBM's 2025 report found healthcare breaches took 279 days on average to identify and contain, the longest of any industry and well above the 241-day global average.
  • This delay compounds patient risk.
• Regulatory penalties: Fines and lawsuits are rising.
  • OCR continues to levy HIPAA penalties, for example a $4.75M settlement with Montefiore Medical Center in February 2024.
  • HHS has proposed a HIPAA Security Rule update (January 2025) that would require MFA and encryption for ePHI. It was not yet final at the time of writing, but hospitals lacking IoMT security already face legal and financial risk on top of cyber risk.

In short, the data is clear, healthcare organizations face frequent attacks and record breach volumes, and exposed or unpatched IoMT devices add to that risk. Both patient safety and financial viability depend on fixing these holes.

Why IoMT Devices Are So Vulnerable

The root causes are often mundane, not exotic hacks:

• Default credentials and misconfiguration: Many devices ship with hard coded or simple passwords. Industry surveys find one of the single most common IoMT flaws is insecure or default passwords. In practice, it’s often trivial for attackers to log in.
• Outdated software: As noted, more than 40% of end-of-life devices get little or no security patching. Even when patches exist, hospitals are slow to update due to device uptime needs or lack of maintenance. Unpatched firmware and legacy protocols, unencrypted DICOM, legacy SSL, etc. remain the biggest risks in several studies.
• Lack of segmentation and visibility: Many hospitals treat IoMT as an afterthought. Devices are often on flat networks with general IT traffic, so a breach of one device can easily spread. Without proper network segmentation or monitoring, attackers can move laterally from an IV pump to a hospital database.
• Supply chain issues: Many medical devices are impacted by third party or supply chain vulnerabilities, such as the network stack flaws found in infusion pumps. IoMT systems incorporate components and software from many vendors and open source libraries, and vulnerabilities in any part can undermine the whole device.
• Clinical constraints: Unlike consumer tech, you cannot simply password protect a ventilator in an ICU. Clinicians need quick access to care equipment. This human factor means security is sometimes consciously reduced to ensure reliability, creating unique vulnerabilities.

Despite headlines about high profile zero days, everyday hygiene issues dominate. Patching alone isn't enough: even patched devices can be compromised if they still use default creds or insecure ports. In practice, IoMT defenders must treat almost every device as inherently at risk and assume exploitable gaps exist unless proven otherwise.

Real World Cases

• Harvard Pilgrim ransomware attack 2023: Attackers had access to the health plan's network from March 28 to April 17, 2023, and more than 2.8 million people were ultimately notified that their data was affected.
• Insulin pump hacks: The FDA has issued multiple recalls and advisories e.g. for insecure Bluetooth comms in pumps and glucometers. In one case, researchers remotely controlled an insulin pump’s dosing.
• Pacemaker vulnerabilities: Researchers repeatedly find issues in implantable cardiac devices. In 2017 the FDA announced a firmware update for about 465,000 Abbott (St. Jude) pacemakers to address radio frequency vulnerabilities, and in 2019 CISA and the FDA warned that Medtronic's Conexus telemetry protocol lacked encryption and authentication.
• Ransomware exposure in imaging: Claroty and Forescout both rank imaging systems among the riskiest IoMT categories, citing KEVs tied to ransomware campaigns, legacy operating systems, and network exposure.

These examples show that devices described as isolated or special purpose often still have network interfaces or wireless links.

How to Secure IoMT: Strategies & Best Practices

1. Inventory and SBOMs

First, know what you have. Many providers lack a complete inventory of connected devices. Create a master list including vendor and model for all monitors, pumps, scanners, etc.

SBOM: For each device, obtain a Software Bill of Materials. Section 524B of the FD&C Act requires SBOMs in premarket submissions for cyber devices, and the FDA's final premarket cybersecurity guidance (reissued February 3, 2026, to align with the Quality Management System Regulation) explains what to submit. SBOMs are equally useful post market. An SBOM lists all third party components (OS, libraries, drivers) so you can track known vulnerabilities.

2. Risk Assessment & Compliance

Categorize devices by risk (life critical vs non critical). Use standards like IEC 81001-5-1 for health software security. Ensure compliance with healthcare regulations (HIPAA, FDA, etc.).

For example, prepare for the proposed HIPAA Security Rule update, which would make MFA mandatory and tighten audit requirements. Refer to a HIPAA penetration testing checklist to align your security tests with HIPAA requirements and ensure you can handle audits and OCR inquiries.

3. Network Segmentation & Monitoring

UK healthcare providers should segregate medical devices onto their own VLANs or networks. Use firewalls to isolate sensitive zones. Use passive network monitoring, such as traffic capture with Wireshark or tcpdump or a healthcare-aware monitoring platform, on IoMT subnets to detect anomalies. Reserve active scanning (for example, Nmap) for agreed test windows and devices that are not connected to patients.

This can catch unexpected device behavior for instance, a pacemaker beaconing out. With IoMT, consider specialized monitoring platforms like those from Claroty or Cynerio that understand healthcare protocols.

4. Patching and Maintenance

Patch all devices promptly, following vendor guidelines. For legacy or unsupported devices, use compensating controls: isolate them, use network filters, or install host based firewalls if possible. Disable unused services e.g. unused USB ports or remote access features. Implement a strict change management process to track any software updates on devices.

5. Penetration Testing and Red Teaming

Regular security testing is essential. A targeted IoMT penetration test goes beyond vulnerability scanning by simulating real attacks on medical devices and networks. Most IoMT devices are paired with a clinician or patient mobile app, so What Is Mobile Application Penetration Testing covers the companion-app and API side of the same attack surface. This can uncover chain exploits e.g. combine a default password pump with a hospital Wi Fi flaw to reach an EHR database.

Quick Comparison: Vulnerability Assessment vs Penetration Testing

For IoMT specifically, you might choose a combination: automated IoT scans for known CVEs, plus periodic manual pentests.

Hospitals should never run active tests against devices connected to patients. Our healthcare penetration testing guide explains how to test device networks, gateways and spare units safely, and where manufacturer testing takes over.

Black Box vs White Box IoMT Testing: In black box tests, testers attempt to break in with no internal info mimicking an outside hacker. In white box tests, they get full system details, code access, network maps to dig deeper.

A hospital might start with a black box IoMT pen test to see what an outsider could do, then use white box tests to harden critical devices. See the comparison table below for key differences.

These specialized IoMT tests should be conducted by experts familiar with medical protocols and equipment. DeepStrike offers red team assessments and Penetration Testing as a Service (PTaaS), including continuous testing of newly deployed features and APIs.

6. Incident Response and Resilience

Have an IoMT specific response plan. If a pump or monitor is compromised, how do you isolate it and continue patient care safely? Regular drills and backups both cyber and physical are key. Insurance now often requires documented pentesting and response plans for cyber coverage, so maintain evidence of your testing and remediation steps see penetration testing for cyber insurance eligibility.

Penetration Testing & ROI

While security improvements cost money, the return on investment ROI is clear in IoMT contexts. For example, preventing one ransomware shutdown which could cost hospitals tens of millions in direct and indirect losses easily justifies routine pentesting.

A conservative breakdown: a thorough IoMT penetration test, especially if done as PTaaS or by a continuous platform, costs a fraction of a breach, while the average healthcare breach cost $6.64M in IBM's 2026 report. IBM also found that organizations using security AI and automation extensively saved $1.93M per breach on average.

When budgeting, also consider compliance and competitive pressure. U.S. hospitals that stay compliant with FDA/HIPAA and demonstrate mature IoMT security can negotiate better cyber insurance rates and avoid fines. Think of penetration testing not just as an expense, but as part of a risk management investment that preserves patient trust and financial stability.

Common Mistakes & Myths

• Myth: Medical devices can’t be hacked. Reality: They absolutely can. Countless incidents have shown even air gapped devices are vulnerable once connected via USB updates, maintenance ports, or network.
• Mistake: Relying on vendor security alone. Manufacturers often provide updates, but hospitals frequently skip them or lack visibility. It’s on healthcare IT to verify each device’s patch status and secure the surrounding network.
• Mistake: Assuming no device can take security tooling. Some newer devices support lightweight agents where the manufacturer approves them; where they don’t, segment and monitor aggressively.
• Mistake: Ignoring passive monitoring. Passive traffic capture (for example, tcpdump or Wireshark) and anomaly detection may seem basic, but they work well for IoMT because they watch the network without probing the devices. Without them, you’ll miss lateral moves or unusual traffic.

Quick Tip: Make sure to change all default passwords on devices out of the box. In assessments, insecure passwords are often the top IoMT finding.

IoMT devices bring amazing benefits to patient care, but the security data is sobering: vulnerabilities are ubiquitous and escalating in 2026. Every hospital network risks data theft, patient harm, and costly downtime if these gaps aren't closed.

The good news is that many countermeasures exist today: from proper network design and patch management to targeted penetration testing services specifically for medical environments.

Ready to Strengthen Your Defenses? The threats of 2026 demand more than just awareness; they require readiness. If you're looking to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike is here to help.

Our team of practitioners provides clear, actionable guidance to protect your business. Explore our penetration testing services to see how we can uncover vulnerabilities before attackers do. Drop us a line, we’re always ready to dive in.

About the Author:Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

FAQ

• What is IoMT?
  • IoMT (Internet of Medical Things) is the network of connected medical devices and health IT systems, from wearable monitors and smart insulin pumps to hospital imaging machines and EHR workstations.
  • These devices collect, share, and sometimes act on patient data. The connectivity improves care but introduces cybersecurity risks.

• Why are IoMT devices so vulnerable?
  • Many IoMT devices were built for functionality, not security. They often run outdated software, use default credentials, and lack encryption.
  • Clinical usability constraints e.g. bypassing logins on a ventilator also reduce security measures. As a result, nearly every hospital IoMT network has exploitable flaws.

• What do IoMT penetration tests involve?
  • IoMT pentesting involves simulated attacks on medical devices and networks to uncover vulnerabilities. It can be black box (no prior knowledge) or white box (full information).
  • Specialists will try to exploit devices e.g. remote pump takeover and pivot to broader systems.
  • This is different from a simple scan; it shows the actual impact and helps comply with standards like OWASP’s medical device guidelines.

• How often should hospitals test IoMT security?
  • Best practice is at least annually or whenever major changes occur (new devices, network architecture, etc.). Critical devices may warrant more frequent checks.
  • Many organizations are moving to continuous penetration testing platform PTaaS to get ongoing coverage rather than one off tests.

• What regulatory requirements apply?
  • Several key ones: FDA’s Section 524B now requires premarket cybersecurity plans and SBOMs.
  • HHS has proposed a HIPAA Security Rule update that would mandate MFA and encryption for ePHI; it was not final at the time of writing.
  • ISO/IEC 81001 5 1 and NIST 800 171/CSF provide control frameworks.
  • Internationally, EU medical device regulations also emphasize cybersecurity.
  • Compliance often means detailed documentation of device security testing for example, see our HIPAA penetration testing checklist for HIPAA focused requirements.

• What is a Software Bill of Materials SBOM for medical devices?
  • An SBOM is a list of all software components OS, libraries, open source code in a device. It helps identify vulnerabilities when new bugs are found.
  • Since March 2023, U.S. law (section 524B of the FD&C Act) requires SBOMs in premarket submissions for cyber devices, and they are a best practice for post market risk management.

• How much does IoMT penetration testing cost?
  • Costs vary by scope. A focused test on a handful of devices costs far less than an enterprise level engagement covering thousands of devices or a full red team.
  • Many firms offer subscription PTaaS models. Given high breach costs ($6.64M on average in healthcare, per IBM 2026), even a modest testing budget can be highly cost effective.

• How does IoMT security help with insurance?
  • Cyber insurers increasingly require proof of robust security. Having regular penetration tests documented and compliance with standards can lower premiums or even be a condition for coverage.
  • Our blog on penetration testing for cyber insurance eligibility explains how proactive testing influences insurance.