ABSTRACT
Medical device cybersecurity has no shortage of frameworks, standards, or regulatory guidance. What it lacks is something far simpler: working accountability for what happens to a vulnerable device after it is deployed in a clinical environment. This paper is written from four years of direct experience as an Infrastructure Lead in hospital systems. The core observation is straightforward-when a medical device cannot be patched, a patching exception gets filed and the device stays on the network. No segmentation. No compensating controls. No follow-up. The exception becomes permanent by default. When hospitals contact manufacturers about known vulnerabilities, the most common response is no response at all. These are not edge cases. They are the norm. This paper argues that the failure of medical device cybersecurity is fundamentally a governance failure-manufacturers, hospitals, and regulators each bear partial responsibility and none owns the problem fully. It proposes three concrete reforms: mandatory patch SLAs tied to market authorization, published end-of-security-support dates at time of sale, and connected device inventory as a condition of CMS reimbursement. Each reform assigns accountability to a specific party with a specific consequence for failure. That is what the current system lacks.
Allani, Satish Kumar, Medical Device Defence – Closing the Vulnerability Gap in Hospital Environments (April 3, 2026).
Leave a Reply