Infusion pumps, patient monitors, imaging systems, and dental and surgical equipment increasingly connect to clinical networks. Each connection can create a path to patient data or to the care itself. Medical device penetration testing shows whether those devices, and the networks around them, can be reached and misused by an attacker. Because patient safety is involved, the testing has to be done carefully.
Why connected devices need their own testing
Many devices run older operating systems, use default or shared credentials, or can't be patched on a normal IT schedule. They often sit on the same network as workstations and the EHR. An attacker who compromises one ordinary laptop may be able to reach a device that was never designed to resist an attack. Standard vulnerability scans often miss these paths, and aggressive scans can even disrupt fragile devices.
What FDA guidance means for providers
FDA premarket cybersecurity guidance and Section 524B of the Federal Food, Drug, and Cosmetic Act place security obligations on device manufacturers, including threat modeling, a software bill of materials, and a plan for addressing vulnerabilities after the device is sold. These requirements apply to manufacturers, not clinics. Healthcare providers are still responsible under the HIPAA Security Rule for protecting patient data on the networks where these devices run. Manufacturer documentation, such as the MDS2 form and the software bill of materials, is a useful input for scoping provider-side testing.
Testing without endangering care
Provider-side testing focuses on the environment around the device: network segmentation, exposed services, remote vendor access, credentials, and the paths between the device and patient data. Devices in active clinical use are generally not attacked directly. Where hands-on device testing is needed, it is done on a spare or offline unit, or during an agreed maintenance window, with biomedical engineering and the clinical team informed and the manufacturer involved where appropriate.
What a useful assessment covers
A strong assessment inventories connected devices, maps which networks and systems each one can reach, tests segmentation between clinical devices and general IT, reviews vendor remote-access pathways, and checks for default credentials and unencrypted data flows. Findings are rated by patient-safety and patient-data impact, not only by technical severity.
Turning findings into safer operations
Many device risks can be reduced without touching the device: isolating devices on dedicated network segments, restricting and monitoring vendor remote access, removing unnecessary connectivity, and asking manufacturers for patches or compensating controls. Retesting confirms that each change actually closed the path.