The Bedside Is A New Attack Surface: Securing Medical Devices In The Age Of AI

Dan Sorensen is a fractional vCISO & AI governance leader. 22+ year U.S. Air Force and Air National Guard veteran.

​When a ransomware crew hits a hospital, headlines usually focus on stolen records. From what I’ve seen, the scarier story is at the bedside: the infusion pump, the patient monitor, the imaging system and now the AI model reading the scan. Those devices don’t just hold data; they help make clinical decisions. And more of them are connected, software-driven and “smart” than ever before.

I’ve spent a lot of time around incident response, and I’d argue medical device security has become one of the most consequential corners of cybersecurity. Here’s why, and what leaders can do about it.

The Exposure Is Already Here

The numbers are pretty sobering indeed. Just look at this: Claroty’s 2025 report examined more than 2.5 million Internet of Medical Things (IoMT) devices across 351 healthcare organizations. It found that 89% of those organizations had internet-exposed medical devices with vulnerabilities known to be exploited in active ransomware campaigns. Ninety-nine percent had at least some IoMT devices with known exploited vulnerabilities.

This isn’t theoretical. In January 2025, the Cybersecurity and Infrastructure Security Agency (CISA) and the FDA warned that Contec CMS8000 patient monitors contained hidden functionality. The monitors reached out to a hard-coded IP address, allowing remote files to be downloaded and run. Researchers later debated whether it was a deliberate “backdoor” or just an insecure design. Well, for a hospital with that monitor on its network, the distinction is somewhat academic; the risk is the same.

AI Adds A New Attack Surface

Now layer artificial intelligence on top. The FDA’s list of AI-enabled medical devices has grown past a thousand authorized products, most of them in radiology. These tools are very promising, but they bring threats that traditional device security programs weren’t built to catch.