Forescout: medical devices lag far behind IT in readiness for post-quantum cryptography
Forescout's analysis of more than 2.5 million devices in over 50 healthcare networks found that only 6% of connected medical devices and 16% of operational technology devices run SSH software that supports post-quantum cryptography, against 50% of IT devices. It also found more than 5,500 internet-exposed healthcare systems, mostly medical record and imaging platforms, of which only 31% support TLS 1.3.
Forescout's report "PQC in Healthcare: From Data Risk to Migration Readiness" argues that hospitals are especially exposed to harvest-now, decrypt-later attacks, in which adversaries collect encrypted data today to decrypt once quantum computers can break current public-key cryptography. Unlike card numbers, medical histories, diagnostic images, lab results and prescriptions stay sensitive for a lifetime and can't be reset.
Using a dataset of more than 2.5 million devices across over 50 healthcare networks, Forescout found that 50% of IT devices run OpenSSH versions that support post-quantum cryptography, compared with 28% of IoT, 16% of OT and only 6% of medical (IoMT) devices. These figures show the software can support quantum-resistant protection, not that it is in use. Infusion pumps, patient monitors and building controls stay in service for years, and updating their cryptography can depend on vendor releases, recertification or hardware replacement.
Forescout also identified more than 5,500 healthcare information systems exposed to the internet, led by electronic medical record platforms and picture archiving and communication systems (PACS); on average only 31% supported TLS 1.3, the only TLS version that can support standardized post-quantum cryptography. The report places this against an active threat picture: Forescout tracked 461 public ransomware claims against healthcare providers between January and August 2026, 47% more than a year earlier, and 300 hacktivist attack claims. It recommends a phased plan over 6, 12 and 24+ months to map where sensitive data flows, prioritize exposed assets and isolate or replace equipment that can't be upgraded.