Full Report
New research from Forescout Research – Vedere Labs has found significant post-quantum cryptography (PQC) readiness gaps across healthcare... The post Forescout finds healthcare lagging in post-quantum cryptography readiness as IoMT and OT devices fall behind IT appeared first on Industrial Cyber.
Analysis Summary
# Industry News: Healthcare Sector Faces Critical Gap in Post-Quantum Cryptography Readiness
## Summary
A new report from Forescout Research – Vedere Labs reveals a significant disparity in Post-Quantum Cryptography (PQC) readiness between traditional IT and specialized medical environments. While 50% of IT devices are PQC-capable, only 6% of Internet of Medical Things (IoMT) and 16% of Operational Technology (OT) devices support the necessary cryptographic standards, leaving sensitive patient data vulnerable to future decryption.
## Key Details
- **Date:** October 07, 2026
- **Companies Involved:** Forescout (Vedere Labs)
- **Category:** Industry Report / Market Analysis
## The Story
Forescout’s research, titled "Post-Quantum Cryptography (PQC) in Healthcare: From Data Risk to Migration Readiness," analyzed over 2.5 million devices across 50 healthcare delivery organizations (HDOs). The study highlights a dangerous "readiness gap": healthcare systems rely heavily on long-lifecycle OT and IoMT devices—such as infusion pumps and imaging systems—that lack modern cryptographic paths.
The report warns of "Harvest Now, Decrypt Later" (HNDL) attacks, where adversaries steal encrypted data today to decrypt it once quantum computing matures. Currently, only 31% of internet-exposed healthcare systems support TLS 1.3, the only version capable of supporting standardized PQC. Furthermore, the study tracked 300 hacktivist attacks in early 2026, showcasing that healthcare remains a primary target for disruption and data theft.
## Business Impact
### For the Companies Involved
- **Forescout:** Positions itself as a thought leader in the specialized niche of OT/IoMT security, likely driving demand for its visibility and segmentation products.
### For Competitors
- **Cybersecurity Vendors:** Competitors in the NAC (Network Access Control) and OT security space will face pressure to integrate PQC assessment tools into their platforms to match Forescout’s research-driven value proposition.
### For Customers
- **Healthcare Delivery Organizations (HDOs):** Must brace for high capital expenditures. Replacing non-upgradeable, long-lived medical devices is costly, and the alternative—implementing complex network segmentation—requires significant labor and expertise.
### For the Market
- **Medical Device Manufacturers:** Will face increased regulatory and buyer pressure to adopt "Secure-by-Design" principles, specifically PQC-ready hardware, to avoid losing market share to future-proof competitors.
## Technical Implications
The primary technical bottleneck is the lack of support for **TLS 1.3** and modern **SSH implementations** in legacy medical hardware. Because these devices often have limited processing power and fixed firmware, they cannot simply be "patched" to support computationally intensive quantum-resistant algorithms. This necessitates a shift toward **compensating controls** like granular network micro-segmentation and enhanced traffic monitoring.
## Strategic Analysis
- **Market Positioning:** Forescout is pivoting from simple device visibility to a strategic partner for "Quantum Readiness."
- **Competitive Advantage:** By focusing on the *types* of data (EMR, lab results) rather than just the devices, Forescout aligns its technical findings with healthcare business risks.
- **Challenges:** The "Quantum Threat" is still perceived by some stakeholders as a distant problem, making it difficult for CISOs to secure immediate budget for PQC migration.
## Industry Reactions
- **Analyst Opinion:** The consensus suggests that healthcare's reliance on legacy systems makes it the "weakest link" in critical infrastructure regarding quantum transitions.
- **Market Response:** Increased focus on government and regulatory bodies (like NIST) to accelerate PQC standards specifically for medical grade devices.
## Future Outlook
- **Predictions:** Expect a surge in "Quantum-Safe" marketing from medical device OEMs.
- **What to Watch For:** Regulatory mandates requiring PQC readiness for any new medical device seeking FDA or international equivalent certification.
## For Security Professionals
Practitioners should prioritize **inventorying data sensitivity** alongside device type. Since PQC migration for IoMT will take years, the immediate focus should be on **identity-based segmentation** and moving exposed systems behind **TLS 1.3-capable gateways** to mitigate the "Harvest Now, Decrypt Later" risk.