The 5 Riskiest Medical Devices in 2026, According to New Research

Forescout just published its 2026 Riskiest Devices report, and for anyone working in medical device security, the IoMT section is worth reading carefully.

The report maps risk across IT, IoT, OT, and IoMT environments. This year, 11 device types appeared on the riskiest list for the first time. In the IoMT category, the top five riskiest device types for 2026 are:

1. Medication dispensing systems
2. Medical image printers
3. DICOM gateways
4. MRI scanners
5. Healthcare workstations

This is the equipment in virtually every hospital and clinical environment. Most of it shares the same core problem: it connects to hospital networks, it runs software that doesn't get updated regularly, and it wasn't designed with modern threat models in mind.

What "riskiest" actually means

Forescout describes its approach as a multifactor risk scoring methodology that considers a device's configuration, function, and behavior. In practice, a device ranks high when it carries known vulnerabilities, is hard to patch, and would have serious downstream consequences if compromised.

For medication dispensing systems, that consequence is direct patient harm. For DICOM gateways, it's exposure of imaging data and potential manipulation of diagnostic workflows. For MRI scanners, it's both.

This matters for two reasons. First, many manufacturers of these devices are still building FDA cybersecurity documentation to the premarket submission standard, which is about proving the device is secure before it ships. That's necessary. It's also not the whole picture.

Second, FDA's premarket cybersecurity guidance (February 2026) expects lifecycle risk management, going beyond point-in-time submission readiness. For cyber devices, Section 524B(b)(1) of the FD&C Act makes the postmarket vulnerability monitoring plan a statutory requirement. Our book chapter on building a vulnerability monitoring program covers how to stand one up. The Forescout data is exactly the kind of threat intelligence those plans need to account for.

The Stryker attack made the same point

Earlier this month, Stryker confirmed a cyberattack on its Microsoft environment that wiped employee laptops and phones, and said it believed the attack was contained. Public reporting attributed the attack to an Iran-linked group that used the remote-wipe function built into Microsoft Intune, the company's endpoint management platform, against enrolled devices. On March 18, 2026, CISA issued an alert on hardening endpoint management platforms. The attack vector was infrastructure, not the devices themselves.

The Forescout data and the Stryker attack are pointing at the same gap: device manufacturers are getting better at submission-level cybersecurity documentation. What's lagging is operational resilience, the security posture of the systems, networks, and infrastructure around the devices.

FDA's 524B requirements cover the product. The environment the product operates in is a separate question, and that's where real-world attacks are landing.

What manufacturers should be asking

If you make any of the device types in Forescout's top five, or if your products connect to hospital networks that include them, a few questions worth asking:

• Does your threat model include the network environment your device operates in, beyond the device itself?
• Do you have a postmarket vulnerability monitoring process that accounts for third-party components alongside your own code?
• Is your SBOM complete enough to know which of the vulnerabilities Forescout cites apply to your bill of materials?
• Does your cybersecurity documentation address destructive attack scenarios alongside ransomware?

FDA's February 2026 guidance recommends a Cybersecurity Risk Management Report and security architecture views, and its cybersecurity risk assessment is built on exploitability. The Forescout data is exactly the kind of threat intelligence that assessment should draw on.

The practical step

If your cybersecurity program was built around the superseded 2023 version of FDA's guidance, it's worth an honest gap assessment against the February 2026 final. The Quality Management System Regulation took effect on February 2, 2026 and the guidance is written to it. The lifecycle monitoring expectation is explicit. And for cyber devices, the SBOM has been a statutory obligation under Section 524B(b)(3) since 2023.

CyberMed offers a free Cybersecurity Readiness Assessment that walks through your current posture against the current FDA expectations. Fourteen questions, about three minutes.

The Forescout research focuses attention on where the real risk is, which is exactly what good cybersecurity programs are designed to do.

Need help with threat modeling or FDA cybersecurity documentation? Email us at info@cybermed.ai.

Sources

• Forescout Research, Vedere Labs. The Riskiest Devices of 2026. March 2026. https://www.forescout.com/research-labs/the-riskiest-devices-of-2026/
• CISA. Alert on hardening endpoint management platforms, March 18, 2026. https://www.cisa.gov/news-events/cybersecurity-advisories
• FDA. Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. Final guidance, February 3, 2026. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions
• 21 U.S.C. 360n-2, Ensuring cybersecurity of devices (Section 524B of the FD&C Act). Office of the Law Revision Counsel. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360n-2&num=0&edition=prelim