The Long Shadow of Old Tech: Why Aging Medical Devices Put Healthcare at Risk

In hospitals across the country, life-saving medical devices hum along, year after year. Infusion pumps deliver precise doses. Monitors track vital signs. Imaging systems reveal what the human eye can’t see. Many of these machines have been trusted companions for more than a decade—reliable, familiar and, in some cases, irreplaceable. 

But beneath that reliability can lie hidden danger. Some of these devices are running on outdated software. Others have security settings that would never pass muster today. And in an era when almost everything in healthcare is connected to a network, those weaknesses can become open doors for cyberattacks. 

A recent discovery drove this home. In early 2024, researchers found a hidden backdoor in the firmware of a widely used clinical monitor. For more than ten years, it had been quietly trying to connect to a server overseas. The incident prompted a federal cybersecurity advisory and raised an uncomfortable question: How many other devices, still in daily use, carry risks we haven’t found yet? 

When Time Works Against Security 

Medical devices are built to last. It’s not unusual for equipment to remain in service for 10, 15, even 20 years. That’s good for budgets and continuity of care—but not for cybersecurity. 

Technology moves fast. Threats evolve. And what seemed secure in 2011 may be dangerously exposed in 2025. Older devices often: 

• Run on operating systems that no longer receive updates, leaving known vulnerabilities unpatched. 
• Require manual, on-site updates that take devices out of service, creating pressure to delay or skip patches. 
• Lack the ability to log suspicious activity, making it hard to detect breaches. 
• Sit on hospital networks without proper segmentation, increasing the risk that a compromise could spread. 

Sometimes, the original documentation or source code is gone—especially if the manufacturer no longer supports the product. That makes it even harder to understand or fix the problem. 

Rising Stakes, Rising Expectations 

Until recently, there was little regulatory focus on the cybersecurity of devices already in the field. Now, that’s changing. The FDA post-market cybersecurity guidance makes it clear: cybersecurity is a product-lifecycle responsibility. Current rules require manufacturers to plan for ongoing security updates, document vulnerabilities and maintain a detailed Software Bill of Materials (SBOM) for new devices. However, the agency’s attention is increasingly turning to legacy systems. 

This shift means that even devices designed long before modern standards existed can fall under renewed scrutiny, especially if they’re still widely used in critical care. 

Why Medical Device Cybersecurity Is Everybody’s Problem 

Hospitals can strengthen their networks and monitor traffic, but they can’t add security features that were never built into the device. And because many devices are essential to patient care, taking them offline for updates or replacement isn’t always an option. 

That’s why responsibility has to be shared. Healthcare providers and manufacturers must work together to understand the risks, decide on the best mitigation steps, and communicate clearly about what’s being done. 

When that collaboration doesn’t happen, the consequences can be serious: 

• Disrupted care if devices are taken offline by ransomware or malware. 
• Compromised patient data through unauthorized access. 
• Regulatory or legal repercussions for failing to address known risks. 
• Damage to a manufacturer’s reputation if its products are linked to a breach. 

For manufacturers, meeting this shared responsibility means staying aware of where their devices are in use, periodically assessing them against current security standards, and offering practical mitigation strategies when direct updates aren’t possible—all while keeping hospitals informed so they can make safe, informed decisions. 

Facing the Legacy Device Challenge 

At Battelle, we’ve seen the legacy device problem from every angle: engineering, cybersecurity research, regulatory compliance and clinical realities. We know that simply replacing every old device isn’t practical. But ignoring the risks isn’t an option either. 

Our team helps medical device manufacturers: 

• Assess the cybersecurity health of products still in use. 
• Prioritize risks based on where and how devices are deployed. 
• Identify practical mitigation strategies, whether that’s a secure firmware update, network configuration guidance or usage restrictions. 
• Navigate the regulatory landscape, including the revalidation requirements that come with software or firmware changes. 

This isn’t just about preventing the next headline-grabbing breach. It’s about extending the safe, effective life of devices you’ve worked hard to design and build, while protecting patients, preserving trust and meeting the expectations of regulators and the marketplace. 

Old devices can still save lives. But without the right protection, they can also put lives—and your reputation—at risk. Battelle’s experts can help you face that risk head-on, with strategies that are realistic, defensible and tailored to your portfolio.