CISA's KEV catalog tracks vulnerabilities exploited in publicly known attacks. Our research found that 63% of the KEVs tracked by CISA are found in healthcare networks, and 23% of medical devices (imaging systems, clinical IoT devices, surgical devices) have at least one KEV.
A recent report shows that older medical devices running on unsupported and/or unmanaged operating systems are widespread in hospital networks.
These systems are considered outdated by their respective vendors and are no longer receiving security or feature updates. Below are some data points on legacy systems from our research.
https://claroty.com/resources/reports/state-of-cps-security-report-healthcare-2023
Lab Cyber Defense
