Report Examines Cybersecurity Risks and Regulatory Requirements for AI Medical Devices
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
An IntuitionLabs report reviews cybersecurity risks and regulatory requirements for AI-enabled medical devices, highlighting adversarial inputs, training-data poisoning, and the need for lifecycle security controls.
Key points
- The report cites Cynerio’s 2022 survey of 300 hospitals, which found critical vulnerabilities in 53% of connected medical devices; the finding is not specific to AI-enabled devices.
- AI-specific risks include manipulated diagnostic inputs, poisoned training data, model tampering, and inference attacks that could expose sensitive patient information.
- The report distinguishes research demonstrations of AI-targeted attacks from deployed-device incidents, noting no publicly documented patient attack involving the described adversarial diagnostic manipulations.
- Its regulatory review highlights Section 524B requirements for software bills of materials, secure development, vulnerability management, and security updates, alongside EU medical-device security obligations.
- Recommended engineering controls include signed firmware and model updates, secure boot, network segmentation, privileged-access protection, and validation of training data and model inputs.
- Postmarket recommendations include coordinated vulnerability disclosure, continuous monitoring, regression testing of patches, and collaboration with hospitals to preserve patient care during incidents.
Article Details
- Publisher
- IntuitionLabs
- Scope
- AI-enabled medical device cybersecurity, including threats, documented incidents, U.S. and EU regulatory requirements, international standards, and lifecycle security controls.
- Sample Size
- No original study sample disclosed; the report synthesizes third-party research and regulatory sources.
- Key Statistics
- The report cites Cynerio's 2022 survey across 300 hospitals as finding critical vulnerabilities in 53% of connected medical devices and vulnerabilities potentially jeopardizing patient safety in 73% of IV pumps.
- A cited 2024 TechTarget analysis reported 993 vulnerabilities in 966 medical devices and a 59% increase in published medical device vulnerabilities.
- The report states that the 2017 Abbott cardiac-device cybersecurity recall affected 465,000 devices.
- The report states that more than 1,000 AI-enabled medical devices had been authorized for marketing in the U.S. as of 2025.
- Recommendations
- Integrate cybersecurity risk management and threat modeling into the device lifecycle, explicitly covering AI models, training data, interfaces, and update mechanisms.
- Maintain a versioned SBOM linked to vulnerability monitoring, establish coordinated vulnerability disclosure, and deliver authenticated, regression-tested security patches.
- Segment medical device networks, disable unnecessary services, eliminate default credentials, and require strong authentication for privileged access.
- Protect patient data with encryption at rest and in transit, and maintain tamper-resistant audit logs and security alerts.
- Validate training data and model provenance, verify model integrity, test adversarial resilience, and monitor adaptive models for suspicious performance or data-distribution changes.
MITRE ATT&CK
People
Abtahi, F.Cited author of a 2026 paper examining data-poisoning vulnerabilities across healthcare AI architectures.Adrien LaurentAuthor of the report and CEO at IntuitionLabs.Biasin, E.Cited author of research on AI medical device cybersecurity risks, legislation, and challenges.Finlayson, S.G.Cited researcher whose 2019 work demonstrated adversarial manipulation of medical images to induce incorrect machine-learning diagnoses.
Malware
Ryukhost platforms. Ransomware has been devastating in healthcare (e.g. WannaCry 2017 impacting NHS, or Ryuk attacks on US hospitals) by locking systems including medical devices until a ransom is paid. Even ifWannaCrydevice software or Windows/Linux host platforms. Ransomware has been devastating in healthcare (e.g. WannaCry 2017 impacting NHS, or Ryuk attacks on US hospitals) by locking systems including medical devices until
Vendors
Abbott([2] www.techtarget.com). Armis Security reports show examples like the 2017 FDA recall of 465,000 Abbott pacemakers after a vulnerability that could allow remote battery depletion ([14] www.armis.com), andJohnson & Johnsondisable an insulin pump by exploiting its wireless protocol ([15] www.armis.com). Subsequently, Johnson & Johnson disclosed (2015) that unauthorized actors could infiltrate its insulin pumps. In 2019, the FDAMedtronic(2015) that unauthorized actors could infiltrate its insulin pumps. In 2019, the FDA recalled certain Medtronic MiniMed insulin pumps because attackers could remotely alter insulin dosage settings ([27]
Products
Countries
United Kingdom- **Hospital Networks and Ransomware**: Attacks against hospital IT systems (e.g. WannaCry in UK, or Hollywood Presbyterian Hospital ransomware in 2016) have effectively taken connected medical devices offline.United States- [2.1.2 Other U.S. Considerations](#212-other-us-considerations)
Industries
HealthcareThe rapid convergence of artificial intelligence (AI) and medical devices has transformed healthcare but also introduced unprecedented cybersecurity challenges.medical devices- [1. The Cybersecurity Threat Landscape for Medical Devices](#1-the-cybersecurity-threat-landscape-for-medical-devices)