Forescout Study: Only 6% of Medical Devices Are Quantum-Safe
A recent Forescout study reveals that just 6% of connected medical devices in healthcare organizations can withstand future quantum-computer attacks, compared to 50% of traditional IT systems, with 31% of over 5,500 internet-facing healthcare systems supporting encryption that can accommodate post-quantum cryptography. The immediate threat is “harvest now, decrypt later,” where attackers collect sensitive data today to decrypt once quantum computers break current encryption, prompting White House directives for federal systems to adopt post-quantum cryptography by 2030–2031, though the GAO notes the transition is lagging. Examining over 2.5 million devices across 50+ healthcare organizations (including hard-to-update infusion pumps and patient monitors), the study also found ransomware claims against healthcare providers surged 47% year-over-year through August 2026, with over 60% targeting U.S. organizations, while Microsoft’s post-quantum TLS pilot and migration complexities (e.g., larger certificate chains) highlight ongoing challenges.
The Quantum Deadline Is a Warning Shot, Not a Plan
Read that Forescout study again, but this time look at what it isn’t saying. Only 6% of connected medical devices are ready for the quantum era, while 50% of traditional IT systems are. That gap isn't an accident of technology — it's an architecture of neglect. Infusion pumps, patient monitors, the machines physically attached to human bodies: these are the most intimate data-collection points in existence, and they are being left deliberately vulnerable. Meanwhile, the White House hands out deadlines for 2030 and 2031 as if announcing a train schedule. The GAO says the federal transition is already lagging. Do you understand what that means? The people responsible for protecting the system are the same people who are telling us, in writing, that they won't make it. They aren't scrambling. They're staging.
The Harvest Has Already Begun
"Harvest now, decrypt later" is not a hypothetical threat — it's a business model. Attackers have been collecting encrypted medical records, signatures, and biometric data for years because they know what's coming. And here's the part that should keep you up at night: the same institutions that control the quantum research, the same intelligence agencies that poured decades into quantum computing, are the ones who set the migration timeline. They know exactly how long it takes to rip out and replace encryption across hundreds of millions of devices. So why would they allow a 94% exposure rate in the most sensitive sector on Earth? Why would they push pilots with untrusted certificate roots and call that progress? You have to ask yourself whether the "lag" is incompetence — or whether the lag is the plan. Every encrypted medical record sitting in a database today is a treasure chest with a lock that someone intends to open tomorrow.
Follow the Bodies, Then Follow the Money
Now watch the ransomware numbers: 461 attacks in eight months, a 47% increase, 60% against U.S. organizations. The same healthcare systems that can't update a pump are being squeezed by criminals, while the same government agencies that are supposed to protect them are tied up in certificate-chain compatibility meetings. This isn't chaos. It's a coordinated theater of helplessness. They want you to believe the threat is external — hackers, quantum computers, rogue states — so you won't look at the internal architecture that profits from your vulnerability. Who benefits when medical data becomes permanently unreadable or permanently readable only by the right keyholders? Who benefits when the definition of "trust" is moved from public infrastructure into closed test environments? Look up the members of the post-quantum working groups. Look at the foundation charters behind the standards bodies. Look at who holds the root keys. The answer is already on page 47 of the document they told you not to read.