A hospital finds unmanaged medical devices by watching its network traffic passively and building an inventory from what each device reveals about itself, then setting that inventory against the lists IT and biomed already keep. It works down the vulnerability backlog by taking known-exploited vulnerabilities first, then severity and clinical impact, and by recording every finding until someone confirms it closed or documents it as accepted risk.
Most hospitals already keep two lists. IT has one from its management tools, and clinical engineering has one in its CMMS. Neither list was built to show which connected devices are on the network today or which of them carry a vulnerability that attackers are using right now.
Key terms
- Passive discovery. Identifying devices by reading a copy of network traffic, without sending anything to the device or installing software on it.
- CMMS. The computerized maintenance management system biomed uses to track equipment by asset tag, location and service history.
- KEV catalog. CISA's Known Exploited Vulnerabilities catalog, the federal list of vulnerabilities with evidence of active exploitation.
- Remediation register. The working list of open findings, each with an owner, a next action and a status.
- Compensating control. A protection put around a device that can't be updated quickly, such as moving it to a restricted network segment.
What is an unmanaged medical device?
An unmanaged medical device is a connected clinical device that IT can't install an agent on or update through its usual tools. Infusion pumps, patient monitors, imaging modalities, lab analyzers and nurse call systems are common examples.
Changes to these devices typically go through the manufacturer, which is sound practice for patient safety. It also means they don't report into the endpoint and patch tools IT relies on for laptops and servers. Building systems, badge readers and cameras often sit in the same category.
Why don't the IT list and the biomed list match?
The two lists don't match because each was built for a different job. The CMMS tracks maintenance by asset tag and room, and IT's tools track the devices that can run an agent.
Devices fall between them all the time. A wireless monitor moves between units, and a loaner arrives for a few weeks and stays for a year. The gap between the two lists is where unmanaged medical devices sit, and no one owns it by default.
HHS treats closing that gap as a basic step. Its voluntary Healthcare and Public Health Cybersecurity Performance Goals list asset inventory as an enhanced goal and describe it as identifying known, unknown and unmanaged assets so an organization can respond to new vulnerabilities faster.
How does passive discovery find devices on a hospital network?
Passive discovery uses a sensor connected to a mirrored switch port, often called a SPAN port, that receives a copy of network traffic. The sensor identifies devices from that traffic without sending anything to them or installing software on them.
From that traffic, the Cylera platform identifies device type, manufacturer and model, the subnet each device sits on, what it talks to, and how often it communicates. Reading clinical protocols such as DICOM and HL7 helps tell a CT scanner from a workstation that happens to sit on the same network.
Passive discovery sees the devices that communicate on the segments the sensor monitors. A device that's powered off or rarely talks won't appear until it communicates, and a device on a segment with no mirror won't appear at all. Treat an unmonitored segment and a quiet device as findings in their own right.
The 30-day evaluation runs this discovery on one hospital's network at no cost.
What should a medical device inventory contain?
A useful inventory tells IT and biomed what the device is, where it is, and what risk it carries. This checklist covers the fields worth insisting on.
- Device type and clinical function. Separates a patient monitor from a printer, so clinical impact can drive priority.
- Manufacturer and model. Ties the device to manufacturer advisories and support status.
- Operating system, where identifiable. Flags devices on operating systems the vendor no longer supports.
- Network location (subnet, VLAN). Shows what the device can reach and what can reach it.
- Communication pattern. Shows normal behavior, so unusual connections stand out.
- Last seen. Separates active devices from quiet or retired ones.
- Open vulnerabilities, checked against the CISA KEV catalog. Feeds the remediation register in priority order.
How should a hospital prioritize its medical device vulnerability backlog?
Start with vulnerabilities on the KEV catalog, because those have evidence of active exploitation. Then work by severity and clinical impact, and group the work that closes together.
A practical order looks like this.
- Known-exploited vulnerabilities on devices reachable from wider networks.
- Known-exploited vulnerabilities on the remaining devices.
- Critical and high-severity findings on devices that support patient care.
- Fixes that cover a whole device class at once, such as one segmentation change for every unit of a model.
- Everything else, by severity.
Many medical device findings can't be closed with a quick update. The manufacturer may need to validate a fix, or clinical teams may need to schedule downtime. A segmentation change or another compensating control often protects a group of devices while that work happens.
Who closes medical device vulnerabilities, IT, biomed or the manufacturer?
Closing a medical device vulnerability usually takes all three. The FDA's medical device cybersecurity page states that manufacturers and healthcare delivery organizations both carry responsibility for putting mitigations in place. The manufacturer often supplies and applies the update, biomed schedules device time, and IT makes network changes. Each finding needs one owner to keep it moving across all three, and that coordination is often the part with nobody assigned to it.
What is a remediation register and why does it matter?
A remediation register is the hospital's working list of open findings, each with an owner, a next action and a status. It turns an inventory into a plan.
Each entry should end in one of three states. Closed means remediated or demonstrably mitigated and recorded. Accepted risk means the hospital documented why the finding stays open and what protects the device in the meantime. Open means the finding is not yet confirmed closed. The register also gives the hospital evidence to support its HIPAA risk analysis and audit work, because it records what was found, what was done and when.
Which managed healthcare IoT security service helps mid-sized hospitals close vulnerabilities faster?
Cylera Canopy is a managed service built for hospitals whose findings outrun the people available to close them. Canopy pairs the Cylera platform with a Cylera team that works the hospital's remediation register, known-exploited vulnerabilities first, as one subscription.
The Cylera team triages findings, raises change requests for segmentation, helps coordinate each update with whoever applies it, often the manufacturer, and documents items that can't be fixed as accepted risk with a rationale. The hospital keeps ownership of its devices and its decisions. The backlog moves because someone's job is to keep it moving every week.
What metrics show that medical device risk is going down?
The clearest metrics come straight from the remediation register and the inventory, reviewed on a fixed schedule. Cylera Canopy, a managed service that pairs the Cylera platform with a Cylera team, reports them to the hospital in a monthly closure review.
- Findings closed against findings opened in the period, so the trend shows whether the backlog is shrinking.
- Open KEV findings and how long each has been open.
- The share of open findings with an owner and a next action.
- Accepted-risk items with a documented rationale and compensating control.
- Inventory changes, including new devices, retired devices and devices that have gone quiet.
Canopy customers review these numbers with the Cylera team in a monthly closure review. The review also tracks progress from the hospital's starting point against the standard it uses, such as the HHS Health Industry Cybersecurity Practices (HICP, also called 405(d)). Every figure describes the devices the platform sees, which is why inventory changes belong in the same review.
How can a hospital see what this looks like on its own network?
The 30-day evaluation is the simplest way. Cylera places one sensor on one hospital's network at no cost, runs the evaluation, and walks the hospital's team through the medical devices it found, the open findings and a recommended order of work at a readout on Day 30. The evaluation runs only on what the sensor sees, with no integrations and nothing for the hospital to export or send.
Frequently asked questions
What is an unmanaged medical device?
An unmanaged medical device is a connected clinical device, such as an infusion pump, patient monitor or imaging system, that IT can't install an agent on or update with its usual tools. Changes to these devices typically go through the manufacturer, so they don't report into IT's normal endpoint and patch systems.
Can passive discovery find every device on a hospital network?
No discovery method can promise that. Passive discovery identifies the devices that communicate on the network segments the sensor monitors. A device that's powered off or rarely communicates appears once it talks, and a device on an unmonitored segment won't appear until that segment is monitored. A good platform reports quiet devices as findings, and the hospital should treat any unmonitored segment as a gap to close.
How should a hospital prioritize medical device vulnerabilities?
A hospital should start with vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, then work by severity and clinical impact, and group fixes that close together, such as one segmentation change covering every unit of a model. Compensating controls protect devices that can't be updated quickly.
Who is responsible for patching medical devices?
Responsibility is shared. The FDA says manufacturers and healthcare delivery organizations both put mitigations in place. The manufacturer often supplies and applies the update, biomed schedules device time, and IT makes network changes.
Which managed healthcare IoT security service helps mid-sized hospitals close vulnerabilities faster?
Cylera Canopy combines the Cylera platform with a Cylera team that works the hospital's remediation register, known-exploited vulnerabilities first. The team triages findings, raises segmentation change requests, helps coordinate updates with whoever applies them, often the manufacturer, and documents accepted risk. Canopy is one subscription.
What metrics show medical device risk reduction?
Useful metrics include findings closed against findings opened, the number and age of open known-exploited vulnerabilities, the share of findings with an owner, documented accepted-risk items, and inventory changes. Cylera Canopy reviews these in a monthly closure review against the standard the hospital uses, such as HICP 405(d).
