Maverc
All articlesOT Security

New Research Uncovers the Most Targeted and Vulnerable Assets Are OT and Medical Devices

September 12, 20236 min readRoss Seay · Industrial Security Practice
OT SecurityRansomwareVulnerabilitiesHealthcare
New Research Uncovers the Most Targeted and Vulnerable Assets Are OT and Medical Devices

Medical devices lead in unpatched CVEs, and operational technology assets face the highest volume of cyber attacks. The data has implications for every CISO.

A recent study has uncovered that medical devices are the most vulnerable asset class to unpatched CVEs, and that operational technology (OT) assets face the highest number of cyber attacks. The findings reinforce what frontline incident responders have been saying for years: the assets that run the physical world are the least protected.

Why These Asset Classes Are So Exposed

  • Long lifecycles — devices designed for 10 to 20 years of service often outlast vendor patch support.
  • Patching is operationally hard — taking a CT scanner or a PLC offline to apply a patch may be impossible without scheduled downtime.
  • Limited security tooling — many devices cannot host an EDR agent or even reliable logging.
  • Flat networks — historically deployed without segmentation from IT.
  • Default credentials and protocols designed without authentication still in production.

What to Do About It

  • Build an authoritative inventory of medical and OT assets, including firmware versions and CVE exposure.
  • Segment ruthlessly — these networks should be isolated by design with explicit cross-zone gateways.
  • Use passive monitoring (Claroty, Nozomi, Dragos, Armis class tools) where active scanning would disrupt the device.
  • Compensating controls when patching is infeasible — virtual patching, ACLs, application-layer gateways.
  • Tabletop the worst case: ransomware hits the manufacturing floor or the hospital, the EHR is unreachable, the PLCs go offline. Exercise the response.

Medical and OT security are no longer adjacent disciplines. They are the front line.

Keep reading

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack
Identity Security

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack

Push-based MFA was a decade-old patch on a broken model. Here's how AiTM toolkits like EvilProxy and Tycoon 2FA defeat it — and the phishing-resistant controls that actually stop them.

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had
Compliance

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had

If you handle CUI, the C3PAO assessment is coming. Here's the 10-step readiness path Maverc walks every defense industrial base client through before the auditor shows up.

What a Modern OT Ransomware Attack Looks Like — And How to Survive One
OT / ICS Security

What a Modern OT Ransomware Attack Looks Like — And How to Survive One

From IT pivot to PLC shutdown, today's OT ransomware crews follow a repeatable playbook. Here is what we see in the field and the segmentation controls that contain the blast.