Connected Medical Devices: 2025 Cybersecurity Budget Shift

For most of the past decade, connected medical devices were priced and planned around features: what the device measures, what the companion software shows, how the data reaches a clinician. That era is ending. Between late 2022 and early 2026, U.S. regulators rebuilt the rules around a question that used to sit at the bottom of every project plan: can this device be defended, patched, and documented for its entire life on the market? The answer now determines whether a product reaches the market at all, and it is reshaping the IoT Security in Healthcare Market  which NMSC values at USD 6.02 billion in 2023, growing to a projected USD 26.76 billion by 2030 at a 23.7% CAGR.

Development budgets are being redrawn to match, and cybersecurity, cloud, and connectivity vendors are moving quickly to serve that shift sometimes profitably, and in at least one case this year, at real reputational cost.

NMSC Market Size & Growth Comparison

What Changed, and When

The turning point was legislative, not technical. In December 2022, Congress amended the Federal Food, Drug, and Cosmetic Act with section 524B, which took effect in March 2023. The section created a formal category of “cyber devices”: products that contain software and can connect to the internet. For these devices, manufacturers must submit a plan for monitoring and addressing vulnerabilities, commit to shipping patches on a regular cadence plus out-of-cycle fixes for serious flaws, and provide a software bill of materials (SBOM) covering commercial, open-source, and off-the-shelf components.

Enforcement followed quickly. Since October 2023, the FDA has been able to refuse to accept submissions that arrive without the required cybersecurity documentation. In June 2025, the agency finalized an updated premarket cybersecurity guidance interpreting those 524B obligations but the document did not stay still for long. On February 2, 2026, the FDA's new Quality Management System Regulation (QMSR) took effect, incorporating ISO 13485:2016 by reference and replacing the older Quality System Regulation. The very next day, the FDA reissued its cybersecurity guidance to align with QMSR, and paired it with a new Compliance Program Manual (#7382.850) giving investigators a structured framework for cybersecurity inspections. The substantive requirements did not change; where they now sit inside a manufacturer's quality system did  cybersecurity is no longer a bolt-on document, it is a line item inside design controls, supplier controls, and post-market surveillance.

FDA Medical Device Cybersecurity Regulatory Timeline

The FDA's cybersecurity requirements for connected devices have not loosened since this post was first written  they have been formally folded into the broader quality-system overhaul that took effect in February 2026.

• Section 524B (2023) created the “cyber device” category and gave FDA refuse-to-accept authority

• The June 2025 premarket cybersecurity guidance was superseded, not merely supplemented, by a February 2026 reissue

• Cybersecurity is now explicitly tied to ISO 13485:2016 quality-system obligations, not a standalone document

Security Moved to the Front of the Budget

The financial consequence of all this is a reallocation, not just an increase. Under the old model, security spending clustered at the end of a program: penetration testing before submission, documentation written retroactively, patches funded from a maintenance budget. Under 524B, the most expensive security decisions are architectural, and architecture happens in the first months of a program. Signed and verifiable update paths, partitioned firmware that can be patched without full recertification, and component-level traceability for the SBOM all have to be designed in, because none of them can be bolted on at a reviewable cost later.

For manufacturers, the budgeting implication is concrete. Programs that once split spending 80/20 between features and compliance are moving toward models where a third or more of premarket engineering time goes to security architecture, documentation, and update infrastructure. The money is not disappearing from features  it is being pulled forward from post-market maintenance budgets that used to absorb these costs quietly and inefficiently.

The Vendor Chain Is Consolidating

A second-order effect is showing up in procurement. The SBOM requirement spans every component in a device, regardless of who wrote it. When a manufacturer assembles a product from a firmware shop, a mobile vendor, a cloud contractor, and a compliance consultant separately, the SBOM becomes a reconciliation exercise across four documentation cultures  and gaps tend to surface during submission review, at the worst possible moment. The predictable response is a shorter vendor chain: manufacturers are consolidating development scope with partners who can produce submission-grade documentation across hardware, firmware, and cloud layers. Firms such as Yalantis, which combines in-house hardware and embedded-software teams for medical-device engineering, illustrate the single-vendor accountability manufacturers are buying toward.

None of this guarantees a better device by itself. What consolidation changes is the failure mode: documentation gaps become visible inside one organization during development, instead of between organizations during review.

Legacy Devices Are the Unresolved Line Item

The FDA's cybersecurity framework leaves one major question open: it does not fully explain how legacy devices, built on hardware and software that can no longer be patched, are supposed to meet 524B expectations. For manufacturers with a large installed base, that silence is itself a planning problem. Every legacy product line now needs a decision  retrofit connectivity and update mechanisms where hardware allows it, wall the device off from networks and accept the commercial consequences, or redesign.

Redesign is the expensive option on paper and, increasingly, the cheaper one in practice: a clean redesign can be built inside modern quality frameworks  IEC 62304 and ISO 13485  from day one, avoiding the retroactive documentation work that makes retrofits unpredictable to estimate. RunSafe Security's 2026 Medical Device Cybersecurity Index (551 healthcare professionals across the US, UK, and Germany) found real progress on SBOM adoption and runtime protection  but also that attacks on medical devices grew more frequent in 2026, and many organizations still run unpatchable end-of-support devices.

How Costly Has Noncompliance Become?

Cybersecurity gaps are no longer just a support-ticket problem  they are a documented source of federal liability. In July 2025, DOJ announced a $9.8 million False Claims Act settlement with Illumina over allegations that its genomic sequencing systems, sold to federal agencies, contained cybersecurity vulnerabilities misrepresented as compliant with NIST and ISO standards. DOJ was explicit that the claims were false “regardless of whether any actual cybersecurity breaches occurred”  the first FCA settlement of its kind against a life-sciences device maker, and a template DOJ has kept applying.

That posture has only hardened. DOJ recovered a record $6.8 billion in FCA settlements and judgments in fiscal year 2025  more than double fiscal year 2024  with health care accounting for 84% of that total. In January 2026, DOJ stood up a new Division for National Fraud Enforcement; officials have said cyber-fraud cases are “not about data breaches” but misrepresentation  a manufacturer need not be hacked to be liable, only to have certified controls it did not actually have.

Cybersecurity noncompliance has moved from a theoretical risk to a documented, fast-growing category of federal financial liability, concentrated overwhelmingly in health care.

• Illumina's $9.8M settlement (2025) established that a breach is not required for cybersecurity misrepresentation to trigger FCA liability

• Total DOJ False Claims Act recoveries more than doubled year-over-year, from $3.1B in FY2024 to $6.8B in FY2025

• Health care alone accounted for 84% of FY2025 recoveries

• A dedicated DOJ fraud-enforcement division, stood up in January 2026, signals this is a durable enforcement priority, not a one-time case

How Are Cybersecurity Vendors Responding to the IoT Security in Healthcare Market's Growth?

Palo Alto Networks made the largest move, closing its $25 billion acquisition of identity-security firm CyberArk (internally rebranded Idira) in the first half of 2026  aimed at the identity layer underpinning Zero Trust segmentation for connected devices. Fortinet acquired AI-security platform Virtue AI in August 2026; its 2026 OT Cybersecurity Report found intrusions on OT/IoT-adjacent networks  the same networks hospitals run infusion pumps and imaging systems on  remain frequent despite improving governance. Cisco acquired identity-security specialists Astrix Security (May 2026) and WideField Security (June 2026), extending its Splunk “Agentic SOC” to secure non-human identities and credentials  directly relevant where connected devices, not just people, now hold access credentials.

Microsoft made Agent 365 generally available in May 2026, expanding capabilities for governing AI agents and endpoint activity. For healthcare organizations, these controls are relevant to managing increasingly connected and autonomous systems, although Agent 365 should not be characterized as a healthcare-specific network-layer security solution.

Check Point Software acquired AI-model-security firm Deepchecks (May 2026) and expanded its Illumio partnership (June 2026), building on earlier exposure-management acquisitions adding IoT/OT visibility. Deutsche Telekom partnered with Palo Alto Networks in June 2026 on Sovereign Cortex with T Security, an AI-driven platform for Europe's regulated industries  healthcare named explicitly  with data-sovereignty controls Deutsche Telekom independently governs.

IBM announced a quantum-safe cybersecurity center with the Singapore Institute of Technology, opening by end-2026 and framed around encryption risk in healthcare and other sensitive-data sectors. Oracle expanded its Life Sciences AI Data Platform internationally through mid-2026  even as Oracle Health continued notifying hospitals through 2026 about a breach of legacy Cerner systems first detected in February 2025, a reminder that even major platform vendors carry inherited security debt. Intel is preparing a Health & Life Sciences AI Suite for later-2026 release, though without a comparably dated security-specific healthcare initiative this period. For Agile Cyber Security Solution LLC, no comparably material recent disclosure could be identified; its public footprint is limited next to the larger vendors here.

Together, these moves cluster around two priorities: securing non-human identities (the credentials devices, agents, and services now hold) and proving data sovereignty and quantum-readiness to regulated buyers  exactly what the Palo Alto/Deutsche Telekom partnership offers.

The cybersecurity vendors serving this market are converging on identity security and non-human credential management as the next competitive battleground, with data sovereignty as a second, Europe-driven front.

• Palo Alto Networks, Cisco, and Check Point all made identity- or credential-security acquisitions in 2026

• Microsoft's Agent 365 and Fortinet's OT research both target the same device- and agent-level visibility gap hospitals face

• Deutsche Telekom and Palo Alto Networks' Sovereign Cortex partnership directly names healthcare as a target regulated industry

• Oracle's ongoing Cerner-breach notifications underscore that even major platform vendors are not immune to the legacy-system risk this article describes

A Test for Next Year's Planning

Market forecasts for the IoT Security in Healthcare Market will keep disagreeing on size and growth rate. The regulatory direction, by contrast, is settled and one-way. Before signing off on next year's device roadmap, run a simple test: ask every vendor and internal team on the program to produce a current software bill of materials for their own deliverables, this week. The teams that respond in days are ready for the market as it now works. The ones that respond with questions are telling you where next year's budget overrun will come from.

Teams building out that roadmap can go deeper into segment-level forecasts and regional breakdowns Download Free Sample

Conclusion

Connected medical devices are no longer judged on features alone; they are judged on whether their manufacturer can prove, in documentation, that the device can be defended for its entire time on the market. That shift is what is driving budgets, consolidating vendor relationships, and now generating real federal liability for the companies that get it wrong. NMSC projects continued growth in both markets through 2030, with the IoT Security in Healthcare Market expanding at a 23.7% CAGR and the Patient Monitoring Market growing at an 8.7% CAGR.