Quantum-resistant cryptography presents security leaders with various challenges, but CISOs in industries dependent on IoT and operational technology (OT) devices may face a particularly difficult journey to quantum readiness, especially if sensitive information that must remain confidential for years passes through those devices.A recent report from cybersecurity firm Forescout highlights these challenges in the healthcare industry, where medical histories, diagnostic images, and laboratory results, which retain their sensitivity long after they are created, routinely get transferred between various operational systems.Attackers who collect encrypted traffic carrying this information today can store it for decryption when sufficiently powerful quantum computers become available, an approach security experts call “harvest now, decrypt later” (HNDL).“PQC [post-quantum cryptography] migration in healthcare is not just about data confidentiality, but also patient safety,” the Forescout researchers say in their report, which examined over 2.5 million devices across more than 50 organizations. “Cryptography protects commands sent to medical devices, telemetry received from those devices for diagnostic purposes, medication orders, and other sensitive interactions. Quantum threats include unauthorized remote access by exploiting public keys for authentication, tampering with device-to-device communication by decrypting traffic, and sophisticated malware exploiting firmware integrity signatures.”While upgrading to PQC is relatively straightforward for live servers, where a standardized PQC algorithm can be implemented as a library package upgrade and configuration change, embedded devices such as those used in healthcare need full firmware updates from their manufacturers. Moreover, those upgrades must maintain backwards compatibility with other systems that might not be upgraded at the same time, and in the case of certified devices, they might require re-certification.This issue goes beyond healthcare to include industrial installations or anywhere OT or IoT devices handle sensitive or business-critical data.Last month, the G7 Cybersecurity Working Group urged governments and organizations to begin migrating to PQC as soon as possible, calling for action across all sectors. The group warned that the transition will be lengthy and that organizations should prepare before quantum computers capable of breaking current cryptography become available.Daniel dos Santos, VP of research at Forescout, tells CSO that while government bodies have issued orders and advisories with different expectations for PQC readiness, they all tend to converge on a 2030 timeline, which is when experts expect quantum computers might be capable of breaking existing encryption algorithms.For industries such as healthcare, however, the HNDL threat collapses that quantum-readiness timeline completely.Patient data travels beyond the medical deviceProtecting patient information requires securing the entire communication chain, from the equipment that generates the data to the IT systems that store it and the applications that make it available to doctors and patients. That includes, for example, a CT scanner that sends images to a picture archiving and communication system (PACS), images that can later be transferred between hospitals, cloud services, and external radiology providers, requiring quantum-resistant protection on each transfer to maintain long-term confidentiality.Laboratory results and prescription records follow similar routes. Electronic prescribing services exchange medication information between providers and pharmacies, including records of controlled substances and treatment for chronic diseases. Attackers can potentially intercept and siphon that data at different points in the chain: at the device level, from an internal network, through a compromised edge router or firewall, or even at the telecom operator’s level.The platforms that store and exchange patient records are often accessible directly from the internet as well. In a Shodan search, Forescout identified more than 5,500 internet-exposed instances of medical information systems, with electronic medical record platforms accounting for 46% of those instances and PACS accounting for 40%.Only 36% of PACS, 33% of electronic medical record systems, and 13% of laboratory information management systems had support for TLS 1.3, the only version of the protocol that supports ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), a quantum-resistant key encapsulation standard published by NIST. However, the presence of TLS 1.3 does not demonstrate that a connection uses quantum-resistant cryptography, because the connecting client might negotiate a different algorithm.Furthermore, in a previous study published in June, Forescout found that only 11.8% of SSH servers on the internet are PQC-capable, a number that falls to 3% when looking only at Dropbear, an SSH server commonly used on embedded devices. Inside enterprise networks, 50% of IT devices use OpenSSH versions that support PQC, but only 28% of IoT, 16% of OT, and 6% of IoMT devices use the same versions.“Specialized devices are unlikely to be fully migrated this decade if we keep going at the current pace, delaying broader PQC migration efforts and quantum readiness,” the researchers concluded. “Unfortunately, medical devices are among those with the lowest adoption rates and the hardest challenges for adopting PQC.”Challenges extend beyond healthcareChanging cryptography on equipment used for patient care or industrial operations is completely dependent on the device vendor. Dos Santos says modifying the device filesystem independently, even when it can be done, jeopardizes certification, maintenance, and support, and any communication protocol changes need to preserve connections to other equipment. The same problem exists for devices in chemical plants, electricity networks, water treatment facilities, and factory floors.Some medical and industrial equipment already runs on Linux, which could in theory make adopting PQC easier, dos Santos says. However, he has seen little discussion of PQC adoption or roadmaps among OT vendors.The Cybersecurity and Infrastructure Security Agency (CISA) described in its October 2024 OT guidance how changes to equipment controlling heavy machinery or combustible materials can require extensive safety testing. For medical devices, the regulatory implications depend on the changes made to the device. The US Food and Drug Administration’s February 2026 cybersecurity guidance says changes to authentication or encryption algorithms may require a new premarket submission.Concerns about legacy equipment and PQC extend across sectors. In a Certes survey of 200 IT and security professionals engaged with quantum-related risks at large US and UK organizations published in May, 78% of respondents rated the potential quantum threat to legacy environments as very high. For edge and IoT equipment, including industrial and medical devices, ATMs, and vehicles, 43% rated the threat as very high and another 31% as significant.Some devices will need alternative solutionsHealthcare information, financial records, and trade secrets, such as code and industrial designs, can remain sensitive years after transmission. But not all data exchanged between devices has the same confidentiality requirements or operational relevance over time.“What’s missing from the policy conversation is a differentiated threat and risk assessment framework — one that accounts for data lifetime and sensitivity decay rate, device class, computational constraints, and realistic adversary capability timelines,” Sharon Hagi, CSO at IoT cybersecurity firm Finite State, told CSO in June after France’s national cybersecurity agency, ANSSI, outlined plans to introduce PQC requirements for product qualification starting in 2027.“The quantum threat is not uniformly distributed across the cryptographic stack,” Hagi said. “Shor’s algorithm breaks RSA and ECC. It does not break AES-256 or SHA-3 in any operationally practical sense — Grover’s provides at most a quadratic speedup, and the effective security margins of properly sized symmetric primitives still holds for most uses. Architectures that rely on symmetric encryption with out-of-band or pre-provisioned key distribution remain meaningful options for resource-constrained embedded devices where NIST PQC algorithms (e.g. ML-KEM, ML-DSA) impose non-trivial compute, bandwidth, and memory costs.”This means vendors will have to weigh carefully on which devices it’s even viable due to hardware limitations to deploy new PQC algorithms. In some cases, end-users might have to come up with alternatives, such as isolating those devices and routing traffic to and from them through other gateway devices that can apply PQC.This is the approach that users should start taking before vendors decide to release firmware upgrades, dos Santos says. For example, internet-facing websites and portals should already be configured to use TLS 1.3 as all modern browsers support it. For remote management and file transfers over the internet, deploy gateways that support protocols with quantum-resistant cryptography.A hospital could use a gateway to protect an image transfer to an external radiology provider. The hospital would still need to assess the connection from the scanner or image archive to that gateway and maybe isolate them on their own network segment with no direct internet access.“But at least for the external part, you’re reducing risk, right?” dos Santos says.But PQC support at one endpoint is effective only if the other endpoint can also negotiate the same algorithm, and manufacturers are reporting difficulty meeting interoperability goals. Thales’s September Manufacturing Data Threat Report, based on 417 respondents in 20 countries, revealed that 30% were behind on their post-quantum interoperability objectives.“For the end users, the main thing to be doing right now is the inventory of devices and data together,” dos Santos said. “Devices, data, and communication.”The resulting map should identify which transfers already have compatible protection, which depend on an upgrade, and where a gateway could protect an external connection.For healthcare, Forescout recommends prioritizing patient portals, external APIs, partner exchanges, and other internet-facing connections, then updating cryptographic libraries and firmware where feasible. For equipment that cannot be upgraded, its healthcare report recommends assessing gateways and isolation measures, obtaining vendor roadmaps, and planning replacement when manufacturers have no viable migration path.Dos Santos says vendors supplying equipment with multiyear service should have a roadmap for PQC communications even when their current firmware does not support it. Operators need to know when that support will arrive, which connections it will protect, and whether it requires new hardware. For equipment expected to remain in service for years, those answers need to inform purchasing and support agreements, alongside a replacement plan if a vendor cannot deliver an upgrade.The G7 call to action urges organizations to integrate quantum-safe replacements into normal equipment renewal schedules and the US Office of Management and Budget’s June guidance directs federal agencies to incorporate PQC upgrades into hardware refreshes and prioritize replacing or decommissioning equipment that cannot support PQC or hybrid cryptography.