Most medical devices unready for post-quantum cryptography

Forescout found only 6% of medical devices can support post-quantum SSH, while more than 5,500 healthcare systems are exposed online.

Forescout’s Post-Quantum Cryptography in Healthcare report analyzed more than 2.5 million devices across more than 50 healthcare delivery organizations. Only 6% of IoMT or connected medical devices and 16% of medical OT devices used SSH software that can support post-quantum cryptography, compared with about 50% of traditional IT devices; sources differ slightly on whether the IT share is “about 50%” or 50%, and on calling the 6% group IoMT versus connected medical devices. Researchers identified more than 5,500 internet-exposed medical information systems. Help Net Security said 46% were electronic medical record platforms and 40% were PACS, while TLS 1.3 support of 31% was described by Infosecurity Magazine as applying to those exposed systems and by Help Net Security as an average among exposed system types. Infosecurity Magazine reported a warning that long-lived medical records face harvest-now, decrypt-later collection ahead of expected quantum attacks within about five years. Help Net Security also reported 461 public ransomware claims and 300 hacktivist claims against healthcare providers from January to August 2026.