These devices include electronic health records, patient monitoring devices, surgical and lab equipment, and imaging systems.

Of these attacks, 25 per cent had a “significant” impact on patient treatment, and most attacks saw medical devices being down for anywhere between five and 12 hours.

“The findings land against a backdrop of large-scale healthcare cyber incidents that have disrupted care delivery and revenue flows, underscoring how quickly attacks on device-adjacent systems can translate into patient harm,” said Joseph Saunders, CEO of RunSafe Security.

The research found that malware infections impacting devices were the highest threat, closely followed by network intrusions and remote access exploitation.

RunSafe Security noted that the gap between response and readiness is rising when considering AI involvement. The research found that while 57 per cent of healthcare organisations are adopting AI-enabled or assisted medical technology, a significant 80 per cent noted they had moderate to high concerns about these innovations.

“Adoption is outpacing risk mitigation strategies,” the company said.

Healthcare organisations are reportedly taking more consideration when adopting these devices, with Saunders saying that “medical device cyber security is increasing in importance to healthcare buyers as they see it as a patient safety and regulatory imperative”.

This is reflected in the statistics, with the research finding that 56 per cent of devices rejected by organisations in 2026 were due to cyber security concerns, a 10 per cent increase from the previous year.

End-of-support devices were found to compound higher risk exposure across larger systems.