Forescout finds healthcare lagging in post-quantum cryptography readiness as IoMT and OT devices fall behind IT

New research from Forescout Research – Vedere Labs has found significant post-quantum cryptography (PQC) readiness gaps across healthcare environments, with Internet of Medical Things (IoMT) and operational technology (OT) devices lagging behind traditional IT systems. The research analyzed more than 2.5 million devices across more than 50 healthcare delivery organizations and found that only 6% of IoMT devices and 16% of OT devices use SSH implementations capable of supporting PQC, compared with 50% of IT devices.

The research also identified more than 5,500 internet-exposed healthcare systems, including electronic medical records and picture archiving and communications systems containing sensitive data, while only 31% of exposed healthcare systems support TLS 1.3, the only TLS version capable of supporting standardized PQC. Forescout said electronic medical records, medical imaging, laboratory results, medication and prescription data, and financial and payment information are the five healthcare data types currently most at risk.

The researchers point out that when discussing PQC migration in healthcare, it is not enough to discuss the types of devices that have to migrate their cryptographic implementations. HDOs must explicitly consider the heterogeneity of data types that these devices generate, transmit, store, and process.