# How do we monitor medical or lab devices that cannot run security software?

From the network, the same way as industrial equipment. Analysers, imaging devices, infusion pumps and lab instruments often run old operating systems that the manufacturer certifies and forbids you to change, so an endpoint agent is not an option. Put them on their own network segment that reaches only the systems they report to, such as the lab information system or the image archive, block internet access they do not need, and route each manufacturer's remote service access through your own gateway. A sensor on a SPAN or TAP port of that segment then sees their connections without touching them. NetSenX lists the devices on the network map and flags beaconing, scanning, lateral movement and unusual outbound volume on every plan. It does not decode medical protocols such as HL7 or DICOM, and it never decrypts traffic. Ask your data protection officer how the monitoring fits your records of processing before you switch it on.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/how-to-monitor-medical-devices-that-cannot-run-security-software

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Can NetSenX monitor OT and industrial networks?](https://netsenx.com/en/faq/can-netsenx-monitor-ot-and-industrial-networks)
- [Can you monitor an OT network without affecting PLCs?](https://netsenx.com/en/faq/can-you-monitor-an-ot-network-without-affecting-plcs)
- [Which industrial protocols does NetSenX read?](https://netsenx.com/en/faq/which-industrial-protocols-does-netsenx-read)
- [Do I need a hardware appliance on every site?](https://netsenx.com/en/faq/do-i-need-a-hardware-appliance-on-every-site)
- [Does NIS2 cover OT networks?](https://netsenx.com/en/faq/does-nis2-cover-ot-networks)