Quantum-Resistant Security Puts Medical and Industrial Devices to the Test
Post-quantum migration is becoming an equipment problem as much as a cryptography problem. Servers can often adopt new algorithms through software updates, but medical and industrial devices may need manufacturer-led firmware changes, compatibility testing and, in some cases, recertification. For organizations moving sensitive data through these systems, the time to map the routes and plan protections is already here.
The pressure comes partly from “harvest now, decrypt later” attacks: an adversary collects encrypted traffic today and holds it in the hope that future quantum computers can decrypt it. That matters when information stays sensitive for years, as patient histories, diagnostic images, laboratory results, financial records and trade secrets can. A Forescout report examined more than 2.5 million devices across over 50 organizations and highlights how healthcare’s connected systems complicate protection.
Medical data moves through a chain of systems
A patient image doesn’t stay on the scanner that creates it. A CT scanner may send images to a picture archiving and communication system (PACS), from which they can be shared with another hospital, a cloud service or an external radiology provider. Each transfer is a potential exposure point, so protecting the archive alone doesn’t secure the full path.
Laboratory results and prescriptions follow similar routes. Electronic prescribing services exchange medication information between providers and pharmacies, including records related to controlled substances and chronic disease treatment. Traffic could be intercepted at a medical device, inside a network, through a compromised edge router or firewall, or at a telecom operator.
Some patient record platforms are exposed directly to the internet. Forescout’s Shodan search found more than 5,500 exposed medical information systems: electronic medical record platforms accounted for 46% of the instances, while PACS accounted for 40%.
Protocol support offers one indicator of readiness, but it can be misleading. TLS 1.3 is the only version that supports ML-KEM, the quantum-resistant key encapsulation mechanism published by NIST. Forescout found TLS 1.3 support on 36% of PACS, 33% of electronic medical record systems and 13% of laboratory information management systems. That support doesn’t prove a connection uses quantum-resistant cryptography: the client and server still need to negotiate a compatible algorithm.
The same gap appears in remote access and device software. In a June study, Forescout found that 11.8% of internet-facing SSH servers could support post-quantum cryptography (PQC). The figure was 3% for Dropbear, an SSH server often used on embedded devices. Within enterprise networks, half of IT devices ran OpenSSH versions with PQC support, compared with 28% of IoT devices, 16% of OT devices and 6% of internet-connected medical devices.
Firmware and safety shape the timetable
On a live server, adding a standardized PQC algorithm may be a matter of upgrading a library and adjusting configuration. Embedded equipment presents a different challenge: manufacturers generally control firmware updates, and operators who modify a device’s filesystem themselves can put certification, maintenance and support at risk. An update also has to preserve communication with systems that may not receive the same change at the same time.
Those constraints matter in hospitals and across operational technology (OT). Medical devices and industrial equipment control or monitor real-world processes, so changes to communication protocols need to account for safe operation. CISA’s October 2024 OT guidance describes how changes to equipment involved in heavy machinery or combustible materials can call for extensive safety testing. The same vendor dependency affects chemical plants, electricity networks, water treatment facilities and factory floors.
For medical equipment, the impact of a change depends on what is modified. The US Food and Drug Administration’s February 2026 cybersecurity guidance says changes to authentication or encryption algorithms may require a new premarket submission.
Some medical and industrial devices run Linux, which could make updates easier in principle. Yet Daniel dos Santos, Forescout’s vice president of research, told CSO that he has seen little discussion of PQC adoption plans among OT vendors. Forescout’s researchers warn that, at the current pace, specialized equipment is unlikely to be fully migrated this decade. They describe medical devices as among the slowest to adopt PQC and hardest to update.
The broader readiness timeline doesn’t remove the urgency. Last month, the G7 Cybersecurity Working Group urged organizations and governments across sectors to start migration, warning that the transition will take time. Dos Santos says government guidance tends to converge on 2030, when experts expect quantum computers might be able to break existing encryption. But data that must remain confidential for years creates a nearer-term planning concern: intercepted information can be stored now.
A May survey by Certes of 200 IT and security professionals at large US and UK organizations found that 78% rated the potential quantum threat to legacy environments as very high. For edge and IoT equipment—including industrial and medical devices, ATMs and vehicles—43% gave the threat that rating, while another 31% called it significant.
Match protection to data and device limits
Not every device transfer carries information with the same sensitivity or useful lifetime. Sharon Hagi, chief security officer at IoT cybersecurity firm Finite State, argues that risk assessments should account for how long data remains sensitive, the device type, its computing limits and realistic timelines for adversaries. She made the comments in June after France’s national cybersecurity agency, ANSSI, outlined plans for PQC requirements in product qualification beginning in 2027.
Hagi also points to differences among cryptographic tools. Shor’s algorithm threatens RSA and elliptic-curve cryptography (ECC), while Grover’s algorithm offers at most a quadratic speedup against symmetric cryptography. In her assessment, properly sized AES-256 and SHA-3 remain practical options for many uses. Systems that rely on symmetric encryption and keys distributed out of band or provisioned in advance could suit constrained devices where NIST algorithms such as ML-KEM and ML-DSA carry meaningful computing, bandwidth and memory costs.
That leaves manufacturers and operators with device-by-device decisions. Some equipment may be able to run PQC after a firmware update; other devices may lack the hardware capacity or support needed. One possible approach is to isolate equipment and route its traffic through a gateway that can apply quantum-resistant protection. The gateway can help secure a connection beyond it, while the internal link from the device to the gateway still needs its own assessment.
Dos Santos recommends that operators begin with inventory: identify devices, the data they handle and the communication paths between them. That map can show which transfers already have compatible protection, which depend on upgrades, and where gateways or network isolation could reduce exposure.
Start with connections and vendor commitments
Organizations can prioritize internet-facing services while working through slower equipment updates. Dos Santos recommends configuring public websites and portals for TLS 1.3, which modern browsers support, and using gateways with quantum-resistant protocols for remote management and internet file transfers. In healthcare, a gateway might protect an image transfer to an outside radiology provider. The hospital would still need to examine the scanner-to-archive and archive-to-gateway links, and may choose to isolate those systems from direct internet access.
Support at one end of a connection is not enough; both endpoints need to negotiate the same algorithm. Interoperability is already a reported obstacle. In Thales’s September Manufacturing Data Threat Report, based on 417 respondents in 20 countries, 30% said they were behind on post-quantum interoperability objectives.
For equipment that cannot yet be upgraded, operators need to ask vendors for specific plans: when PQC support will arrive, which connections it will cover, and whether it requires new hardware. Those answers can shape purchasing and support agreements for equipment expected to remain in service for years. If a manufacturer has no viable migration path, organizations may need to plan for replacement.
Forescout’s healthcare recommendations put patient portals, external APIs, partner exchanges and other internet-facing links near the front of the queue. The company also advises updating cryptographic libraries and firmware where possible, assessing gateways and isolation for devices that cannot be upgraded, and seeking vendor roadmaps. The G7 recommends fitting quantum-safe replacements into ordinary equipment renewal schedules. US Office of Management and Budget June guidance likewise directs federal agencies to include PQC upgrades in hardware refreshes and prioritize replacing or decommissioning equipment that cannot support PQC or hybrid cryptography.
The practical starting point is a map of devices, data and communications, paired with credible vendor timelines. That gives security teams a way to protect the connections they can change now and plan for equipment that will take longer to move.
