IoMT (the Internet of Medical Things) is the network of connected medical devices in a healthcare environment, including infusion pumps, patient monitors, imaging systems, and lab analyzers, most of which cannot host a security agent.
What IoMT means
The Internet of Medical Things is the healthcare branch of the broader Internet of Things. Where the consumer IoT describes connected thermostats and doorbells, IoMT describes the connected devices that deliver and support care: infusion and insulin pumps, patient monitors, ventilators, imaging systems such as CT and MRI and their controllers, laboratory analyzers, and a long tail of specialized equipment. Modern hospitals run thousands, and large systems tens of thousands, of these devices, all speaking to each other and to central systems over the network.
This connectivity is genuinely transformative for care. It enables continuous monitoring, faster diagnosis, data that flows automatically into the electronic health record, and increasingly AI-assisted clinical workflows. The same connectivity, though, turns every one of those devices into a networked computer, and that is where the security problem begins.
Why IoMT is so hard to secure
IoMT devices carry a structural weakness that makes them the single hardest part of a hospital to defend. Most of them cannot run security software. They use closed or embedded operating systems that do not permit third-party software, their regulatory certification often forbids modifying them, and a large share remain in clinical service long past the point where the manufacturer still issues patches. Research across large device populations has found an average of several known vulnerabilities per device, with many end-of-life and unpatchable.
The result is that the majority of a hospital's real attack surface sits on devices that a conventional endpoint tool cannot see at all, because there is nowhere to install an agent. Claroty's 2025 research found that 99% of healthcare organizations have connected devices affected by known exploited vulnerabilities, and that a meaningful share of those are both internet-exposed and tied to insecure connections. In other words, the exposure is close to universal.
Why attackers target IoMT
Attackers understand this gap precisely, and they exploit it deliberately. An unmonitored medical device is an ideal place to gain an initial foothold and to hide, because the defenders cannot see it and often cannot patch it. From there, an intruder can move laterally toward the systems that hold value, using the device as a quiet base of operations. In a ransomware attack, the device fleet is both an entry point and a pressure point, because disrupting connected clinical equipment maximizes the downtime leverage the attacker holds over the hospital.
This is why securing IoMT is not a niche concern but a central one for healthcare cybersecurity. A defense that covers the servers and laptops but leaves the device fleet invisible is protecting a minority of the building while the attacker walks in through the majority.
How IoMT is protected
Because the devices themselves cannot be secured individually, protection has to happen around them, on the network. In practice that means a specific set of capabilities: automatic discovery and classification to find every device, including the unmanaged ones; behavioral baselining to learn what normal looks like for each device, which is effective because medical-device behavior is highly predictable; detection of deviations that signal compromise; and, crucially, containment that can quarantine a misbehaving device at the network layer without powering it down or interrupting care. That last point is essential in healthcare, where shutting down a device attached to a patient would turn a security action into a safety event.
This is the domain of agentless protection, and of what the market often calls IoMT security or medical device security. It is also increasingly a regulatory expectation rather than a nice-to-have, as data-governance and cybersecurity frameworks in the US, UK, and Gulf put growing weight on the resilience of connected clinical systems. For a hospital, treating IoMT as a first-class part of the attack surface, rather than an afterthought, is one of the clearest markers of a mature security program.
Approval is not the same as safe operation
A point that security and clinical-engineering teams increasingly make is that regulatory approval of a device is only the starting line, not a guarantee of safety on the network. A device can be fully certified for its clinical function and still carry an unpatchable software flaw, sit on a flat network with broad access, and communicate in ways that create risk. The real question a hospital has to answer is not whether a connected device is approved, but whether it can be operated safely within the hospital's technical and network environment without introducing risk to care or to other systems.
That reframing changes how IoMT security is approached. It becomes an ongoing operational discipline rather than a procurement checkbox: maintaining a live inventory of every connected device, understanding which ones are actually exposed and reachable, and protecting the many that cannot be fixed. It also clarifies where responsibility sits. A manufacturer certifies the device for its purpose, but the hospital owns the environment it runs in, and securing that environment, especially for devices that will remain in service for a decade or more past their last patch, is squarely the hospital's job. Recognizing this is often the step that moves an organization from treating device security as someone else's problem to building it into the core of its defense.
See also
Sources
- Claroty: State of CPS Security 2025 — Healthcare Exposures
- HHS HC3: medical device security risks in healthcare
- NIST SP 1800-24: Securing PACS in healthcare
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.