Medical Device Security & IoMT
Assessment Australia
Connected medical devices (IoMT) are a critical blind spot in hospital security. Intrix provides specialised IoMT security assessments to discover, assess, and segment clinical devices, protecting patient safety
Your Greatest Innovation is Now Your Greatest Risk
The explosion of connected medical devices, from infusion pumps and patient monitors to MRI machines, has revolutionised patient care across Australian healthcare environments. But this Internet of Medical Things (IoMT) has also dramatically expanded your digital attack surface, creating medical device security risks that traditional IT security tools are not equipped to address.
These devices are the clinical equivalent of Operational Technology (OT); they directly interact with the physical world and have immediate patient safety implications.
Critical IoMT Security Challenges
Blind Spot Risk
IoMT devices are hard to patch, often insecure by default, and frequently not segmented. This makes them high-risk attack points that require dedicated medical device security controls and continuous monitoring.
Physical Risk
A compromise here doesn’t just breach data; it could lead to disastrous patient outcomes and directly impact patient safety
Specialised Expertise
Traditional IT security providers lack the specialised expertise to manage the unique ecosystem of IoMT devices
Network Exposure
Many devices remain connected to general hospital networks, creating pathways for attackers to pivot from IT systems to clinical devices
Our Solution: Intrix Medical Device & IoMT Security Assessment
Intrix provides a highly specialised service that bridges the critical gap between IT security and clinical technology. We secure your entire clinical ecosystem, not just your IT assets
Device Discovery & Classification
We use specialised tools to discover, classify, and build an inventory of all connected clinical devices on your network. This includes infusion pumps, ventilators, patient monitors, imaging systems, surgical equipment, and laboratory devices
Asset Discovery
Inventory Management
Device Classification
Network Mapping
Vulnerability & Risk Analysis
We conduct the risk assessment of your IoMT ecosystem to identify critical vulnerabilities and their potential impact on patient safety. This includes known CVEs, configuration weaknesses, default credentials, and unpatched systems
CVE Assessment
Safety Impact Analysis
Configuration Review
Risk Prioritisation
Clinical Network Segmentation Strategy
We create a practical segmentation roadmap that isolates critical medical devices from the main IT network. This blocks attacker lateral movement while maintaining smooth clinical workflows, and supports compliance with TGA requirements and the Australian Privacy Act 1988.
Network Architecture
Firewall Rules
VLAN Design
Workflow Preservation
Medical Device Penetration Testing
Specialised, patient-safe penetration testing for medical devices, aligned with TGA cybersecurity guidance, FDA pre-market requirements, and IEC 62304 software standards
Device Pen Testing
IEC 62304
FDA Compliance
Safety-First Testing
Medical Device Security by Category
Infusion & Medication Systems
Security hardening for smart pumps, IV infusion systems, and medication dispensing devices
Patient Monitoring Systems
Security assessments for bedside monitors, telemetry systems, and central monitoring stations
Diagnostic Imaging Equipment
Security assessments for imaging systems and PACS infrastructure
Wearable & Implantable Devices
Security for connected wearables, implants, and remote monitoring devices
Laboratory & Diagnostic
Security for lab analysers, pathology systems, and point-of-care testing devices
Life Support & Surgical
Critical device security for ventilators, anesthesia machines, and surgical robots
Why Healthcare Organisations Choose Intrix for IoMT Security
Clinical Technology Expertise
Our team understands both IT security and clinical technology, enabling us to secure medical devices without disrupting patient care workflows
Patient Safety First
All our assessments and testing are conducted with patient safety as the paramount concern, ensuring clinical operations are never compromised
Proven Track Record
We have delivered medical device security assessments across Australian hospitals, aged care facilities, and diagnostic centres, producing actionable roadmaps that balance security uplift with zero disruption to clinical operations.
Regulatory Knowledge
Deep understanding of TGA, FDA, IEC 62304, and other medical device cybersecurity standards, alongside Australian obligations under the Privacy Act 1988 and My Health Records Act 2012.
Medical Device Security FAQ
Why are medical devices vulnerable to cyber attacks?
Medical devices often run on legacy operating systems, use default credentials, cannot be easily patched due to regulatory constraints, and are connected to hospital networks without proper segmentation. Many were designed before cybersecurity was a priority. In Australia, the Therapeutic Goods Administration (TGA) regulates medical device software safety, and organisations handling patient data must also comply with the Privacy Act 1988 and the My Health Records Act 2012.
Can you patch medical devices like regular IT systems?
Patching medical devices is more complex than patching standard IT systems because software changes may require regulatory review under Australia’s Therapeutic Goods Administration (TGA), which governs device safety under the Therapeutic Goods (Medical Devices) Regulations 2002. Where patching is not immediately possible, compensating controls such as network segmentation, virtual patching, and continuous monitoring are used to reduce risk without disrupting device operation.
What is the Internet of Medical Things (IoMT)?
The Internet of Medical Things (IoMT) is the network of internet-connected medical devices, software applications, and healthcare systems that collect, transmit, and share patient data. It includes devices such as infusion pumps, cardiac monitors, wearable sensors, and remote patient monitoring equipment. While IoMT improves patient care and operational efficiency, it also significantly expands the attack surface of healthcare environments, as many devices run legacy software and are deployed on networks without adequate segmentation. In Australia, IoMT devices that collect or transmit patient data are subject to the Privacy Act 1988, and device software may require TGA regulatory review before security changes can be implemented.
How does medical device penetration testing work?
Medical device penetration testing is a simulated cyberattack conducted by security specialists to identify vulnerabilities in a device’s hardware, firmware, software, and communication interfaces before they can be exploited. Testing typically covers network security, authentication controls, data encryption, and firmware analysis, and is conducted in alignment with regulatory guidance from the TGA in Australia and the FDA in the United States. Unlike standard IT penetration testing, medical device testing must be carefully scoped to avoid disrupting clinical operations or compromising patient safety during the assessment.
What Australian regulations apply to medical device cybersecurity?
Medical device cybersecurity in Australia is governed by the Therapeutic Goods Administration (TGA) under the Therapeutic Goods (Medical Devices) Regulations 2002. Devices that collect or transmit patient data must also comply with the Privacy Act 1988 and, where applicable, the My Health Records Act 2012. Healthcare organisations operating critical infrastructure may have additional obligations under the Security of Critical Infrastructure Act 2018. Intrix assessments are aligned with all applicable Australian regulatory requirements.
Can you assess medical devices while they are in clinical use?
Yes. All Intrix medical device assessments are conducted using passive, non-intrusive methods that observe device behaviour without sending commands or probes that could interfere with clinical operation. Active testing such as penetration testing is scoped and timed to maintenance windows and requires sign-off from clinical and biomedical engineering teams before commencement. Patient safety is the primary constraint on all assessment activity.
Don't Let Patient Safety Be Your Blind Spot
Contact Intrix to secure your IoMT ecosystem and protect both patient data and patient safety with specialised medical device security