Only 6% of internet-connected medical devices currently use post-quantum cryptography in their SSH implementations, a stark contrast to the 50% adoption rate seen in standard IT devices, according to new research from Forescout. Analyzing over 2.5 million devices across 50 healthcare organizations, Forescout identified more than 5,500 internet-exposed medical information systems, with only 31% supporting the standardized post-quantum TLS 1.3 protocol.
“Patient data stays sensitive for a lifetime, and a medical device can stay in service for many years,” said Carlos Moreira, Founder, Chairman and CEO of SEALSQ, emphasizing the need for chip-level security solutions as SEALSQ and IC’Alps outline their approach to address this critical vulnerability.
IoMT Security Readiness Gap & Forescout Findings
IC’Alps, a subsidiary of SEALSQ, is addressing a critical vulnerability in connected healthcare systems by integrating post-quantum cryptography directly into application-specific integrated circuits, or ASICs. This disparity highlights the urgent need for proactive security measures in medical devices, given their extended operational lifecycles and the potential for long-term data compromise.
This vulnerability extends to key clinical systems. TLS 1.3 adoption stands at 33% for electronic medical record systems, 36% for picture archiving systems and a significantly lower 13% for laboratory management systems. The implications are substantial, as patient data, unlike financial information, cannot be reset if compromised, and remains valuable indefinitely.
Forescout emphasizes that cryptography safeguards not only data but also critical device functions, including commands, telemetry, medication orders and firmware signatures. The long service life of medical devices presents a unique challenge, as cryptographic agility is limited by vendor release cycles, recertification requirements and potential hardware replacements. “That is why post-quantum security has to be designed in at the chip stage, not added once a device is on the market,” said Carlos Moreira, Founder, Chairman and CEO of SEALSQ.
Together, SEALSQ and IC’Alps give manufacturers a practical way to close it in the devices they design. IC’Alps’ expertise in designing ASICs for active implantable medical devices is central to this strategy, allowing for the simultaneous optimization of patient safety, reliable operation and extended battery life.
The company offers two pathways for manufacturers: standard post-quantum chips integrated into existing products, or fully custom ASICs with post-quantum security embedded from the outset, SEALSQ says. Both approaches implement the NIST-standardized ML-KEM (FIPS 203) and ML-DSA (FIPS 204) algorithms. IC’Alps’ ISO 13485 certification ensures adherence to the stringent quality framework demanded by medical device manufacturers.
“We bring that track record in ultra-low-power design and power management to QASIC, integrating SEALSQ’s post-quantum security alongside sensing and processing while addressing the stringent energy constraints of implants, within the ISO 13485 quality framework our medical customers rely on.” The QASIC platform, targeted for release in 2026, is designed to address the power and size limitations inherent in implantable and wearable devices. By incorporating security considerations at the semiconductor design stage, IC’Alps aims to minimize the overhead associated with post-quantum cryptography.
SEALSQ’s commitment extends beyond chip-level security, encompassing a Public Key Infrastructure solution, INeS PKI, that enables the issuance of quantum-safe digital certificates for all connected elements within a healthcare network, from devices to workstations and cloud infrastructure, according to the company. These certificates secure data connections, software updates, and ultimately, patient data and lives. While these technologies are intended for new products, Forescout notes that existing devices will still require supplementary measures such as network segmentation, TLS 1.3 enforcement and PQC gateways to mitigate immediate risks.
Patient data stays sensitive for a lifetime, and a medical device can stay in service for many years.
Carlos Moreira, Founder, Chairman and CEO of SEALSQ
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
