Studies such as those from Researchgate suggests that hospitals across Asia face a growing cryptographic challenge as connected medical devices remain in service far longer than the encryption protecting them.
In a study of more than 2.5 million devices across over 50 healthcare delivery organisations, Forescout’s Vedere Labs found that only 6% of Internet of Medical Things (IoMT) devices running Secure Shell (SSH) use implementations capable of supporting post-quantum cryptography (PQC).
Operational technology devices fared only slightly better at 16%, while conventional IT devices reached 50%. The gap reflects replacement cycles rather than security effort.
The exposure is not confined to internal networks. Forescout identified more than 5,500 internet-facing healthcare systems, most of which were medical record platforms and imaging archives. Only 31% supported TLS 1.3, the protocol version on which standardised post-quantum key exchange depends.
The concern is the “harvest now, decrypt later” model, in which attackers capture encrypted traffic today and decrypt it once quantum computing matures. Unlike a compromised password, a patient’s diagnostic images or medication history cannot be reissued, making healthcare data particularly sensitive over long periods.
The replacement standards already exist. In August 2024, the US National Institute of Standards and Technology finalised its first three PQC standards: FIPS 203 for key establishment, FIPS 204 for digital signatures and FIPS 205 as a backup signature standard. NIST recommends that organisations begin migrating systems to quantum-resistant cryptography.
The issue is particularly acute among hospitals in Asia where public and private healthcare providers are expanding telemedicine, digital health records and connected diagnostics. Ageing imaging equipment, regional supply chains and long procurement cycles can leave medical-device fleets in service for a decade or more, often without a field-upgradable cryptographic capability.
Forescout recommends that healthcare organisations begin with accurate asset inventory and classification, prioritise internet-facing systems, enable TLS 1.3 where possible, and plan segmentation, restricted access and closer monitoring for devices that cannot be upgraded.
Regulatory pressure is also increasing. The European Union’s Cyber Resilience Act treats security as an obligation lasting across a product’s expected lifetime; its vulnerability-reporting obligations began on 11 September 2026, with full application from 11 December 2027.
For connected-device buyers, the practical priority is crypto-agility: ensuring that key exchange mechanisms, certificates and cryptographic algorithms can be updated in the field. Hospitals may be the earliest test case, but the same principle applies to smart meters, industrial controllers and other long-lived IoT fleets across Asia.
