State of CPS Security: Healthcare Exposures 2025

Cybersecurity leaders inside hospitals and healthcare delivery organizations must acknowledge the risks posed by an ever-increasing number of so-called Internet of Medical Things devices coming online. As imaging systems, patient devices, health information systems, and more share data and are used in day-to-day diagnoses and treatment, the risk of a compromise threatens the availability and quality of patient care.

In this report, Team82 quantifies the riskiest and most exposed healthcare devices, by taking into consideration not only the criticality of vulnerabilities in connected devices, but also whether devices contain known exploited vulnerabilities and are securely connected to the internet. We hope our analysis provides a road map for mitigating and remediating the most at-risk medical systems.