Forescout's October 2026 Healthcare Report Finds 6% of Medical IoT Devices on Post-Quantum-Capable SSH and 31% of Exposed Hospital Systems on TLS 1.3

What a hospital-network survey of 2.5 million devices found, October 2026

Quentir Medicine Monitor

Evidence-based insights for quantum medicine.

A CT scan taken in a hospital this week will still describe the same patient in 2040. The encryption that carries that image from the scanner to the archive, and from the archive to an outside radiologist, was mostly designed for a world without large quantum computers.

The security firm Forescout has now put numbers on that gap. Its research report PQC in Healthcare: From Data Risk to Migration Readiness, released in early October 2026, looks at how far hospital networks have moved toward post-quantum cryptography, the new public-key algorithms meant to resist a future quantum computer. The answer is uneven. In the enterprise networks Forescout tracks, half of ordinary IT devices run OpenSSH versions that support the new algorithms. Among the devices of the Internet of Medical Things, such as infusion pumps, patient monitors and imaging equipment, the share is 6%.

The report also searched the open internet for hospital systems that anyone can reach. It found more than 5,500 of them, mostly electronic medical record platforms and image archives, and only 31% of those systems support TLS 1.3, the only version of the web's standard encryption protocol that can carry the standardized post-quantum key exchange.

For a hospital board or a chief medical information officer, the figures separate the devices a hospital can upgrade on its own from the devices whose encryption changes only when a manufacturer ships new firmware. They come from one vendor's customer data and from public internet scans, so they describe the networks Forescout can see, not a random sample of all hospitals.

The dataset comes from Forescout's own device cloud: more than 2.5 million connected devices across more than 50 healthcare delivery organizations, an average of around 50,000 devices per organization. About two-thirds are IT assets, such as workstations and servers. The rest are network equipment, building and facility systems, and medical devices, which make up about 5% of the total.