This study identifies cybersecurity vulnerabilities and risks in robotic-assisted surgery (RAS) and proposes a cybersecurity framework and an assessment tool for RAS systems.
Background
RAS systems are increasingly integrated into networks which raise cybersecurity concerns. These systems can enhance surgical outcomes but are potential cyberattack targets, which can affect clinician care, patient safety, and organizational operations.
Method
Surveys and interviews were conducted with stakeholders (clinicians, researchers, cybersecurity professionals, and hospital administrators) to collect perspectives on RAS cybersecurity. Thematic analysis was used to develop an RAS cybersecurity framework. Then, stakeholders contributed to creating an RAS cybersecurity assessment tool using Failure Modes, Effects and Criticality Analysis (FMECA).
Results
Survey responses (n = 84) revealed that 48.8% of respondents were familiar with RAS cybersecurity. Only 24.6% of clinical respondents were aware of their organization’s cybersecurity policy. Interviews (n = 15) identified vulnerabilities such as inadequate training, limited communication between manufacturers and healthcare systems, and gaps in regulations. Failure modes focused on consequences of cyberattacks on RAS systems, with severity assessments related to patient health and technology reliability/integrity completed and outcome actions identified.
Conclusion
Understanding RAS cybersecurity challenges is still in its infancy. Key vulnerabilities include insufficient training, limited data sharing, and external threats. The framework illustrates the interconnectedness of stakeholders, while the FMECA assessment tool addresses current vulnerabilities in RAS systems.
Application
RAS cybersecurity vulnerability and risks should be carefully considered when integrating systems into healthcare organizations, and the RAS cybersecurity assessment tool can be used by stakeholders to systematically identify and analyze potential cybersecurity failure modes.
AhmedK.KhanN.KhanM. S.DasguptaP. (2013). Development and content validation of a surgical safety checklist for operating theatres that use robotic technology. BJU International, 111(7), 1161–1174. https://doi.org/10.1111/bju.12010
AldosariB. (2025). Cybersecurity in healthcare: New threat to patient safety. Cureus, 17(5), Article e83614. https://doi.org/10.7759/cureus.83614
5.
AliG.MijwilM. (2024). Cybersecurity for sustainable smart healthcare: State of the art, taxonomy, mechanisms, and essential roles. Mesopotamian Journal of CyberSecurity, 4(2), 20–62. https://doi.org/10.58496/MJCS/2024/006
6.
AlshamraniA.MyneniS.ChowdharyA.HuangD. (2019). A Survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities. IEEE Communications Surveys & Tutorials, 21(2), 1851–1877. https://doi.org/10.1109/COMST.2019.2891891
BallM.FullerP.ChaJ. S. (2025). Identification of surgical human-robot interactions and measures during robotic-assisted surgery: A scoping review. Applied Ergonomics, 125(1), Article 104478. https://doi.org/10.1016/j.apergo.2025.104478
10.
BaumannA. P.O’NeillC.OwensM. C.WeberS. C.SivanS.D’AmicoR.CarmodyS.BiniS.SawyerA. J.LotzJ. C.GoelV.DmitrievA. E. (2021). FDA public workshop: Orthopaedic sensing, measuring, and advanced reporting technology (SMART) devices. Journal of Orthopaedic Research: Official Publication of the Orthopaedic Research Society, 39(1), 22–29. https://doi.org/10.1002/jor.24833
11.
Ben-AsherN.MeyerJ. (2018). The triad of risk-related behaviors (TriRB): A three-dimensional model of cyber risk taking. Human Factors, 60(8), 1163–1178. https://doi.org/10.1177/0018720818783953
12.
BenMessaoudC.KharraziH.MacDormanK. F. (2011). Facilitators and barriers to adopting robotic-assisted surgery: Contextualizing the unified theory of acceptance and use of technology. PLoS One, 6(1), Article e16395. https://doi.org/10.1371/journal.pone.0016395
13.
BernadotteA. (2023). Cyber security for surgical remote intelligent robotic systems. In 2023 9th international conference on automation (pp. 65–69). Robotics and Applications (ICARA). https://doi.org/10.1109/ICARA56516.2023.10126050
14.
ChiaradonnaS.JevtićP.LanchierN. (2023). Framework for cyber risk loss distribution of hospital infrastructure: Bond percolation on mixed random graphs approach. Risk Analysis: An Official Publication of the Society for Risk Analysis, 43(12), 2450–2485. https://doi.org/10.1111/risa.14127
15.
ChngS.LuH. Y.KumarA.YauD. (2022). Hacker types, motivations and strategies: A comprehensive framework. Computers in Human Behavior Reports, 5(1), Article 100167. https://doi.org/10.1016/j.chbr.2022.100167
16.
Chun TieY.BirksM.FrancisK. (2019). Grounded Theory Research: A design framework for novice researchers. Sage Open Medicine, 7(1), Article 205031211882292. https://doi.org/10.1177/2050312118822927
DeRosierJ.StalhandskeE.BagianJ. P.NudellT. (2002). Using health care Failure Mode and Effect Analysis: The VA National Center for Patient Safety’s prospective risk analysis system. Joint Commission Journal on Quality Improvement, 28(5), 248–267. https://doi.org/10.1016/s1070-3241(02)28025-6
21.
DevenderM. V.McDonaldJ. T. (2023). A quantitative risk assessment framework for the cybersecurity of networked medical devices. International Conference on Cyber Warfare and Security, 18(1), 1. https://doi.org/10.34190/iccws.18.1.986
Fosch-VillarongaE.MahlerT. (2021). Cybersecurity, safety and robots: Strengthening the link between cybersecurity and safety in the context of care robots. Computer Law & Security Report, 41(1), Article 105528. https://doi.org/10.1016/j.clsr.2021.105528
25.
Fosch-VillarongaE.MillardC. (2019). Cloud robotics law and regulation: Challenges in the governance of complex and dynamic cyber–physical ecosystems. Robotics and Autonomous Systems, 119(1), 77–91. https://doi.org/10.1016/j.robot.2019.06.003
26.
FullerP.KennedyS.BallM.DuffieH.GaineyM.LuoQ.JosephA.CarbonellA.ChaJ. S. (2025). Understanding the challenges of robotic-assisted surgery adoption: Perspectives from stakeholders and the general population on human-interaction, built environment, and training. Applied Ergonomics, 122(1), Article 104403. https://doi.org/10.1016/j.apergo.2024.104403
GordonW. J.IkomaN.LyuH.JacksonG. P.LandmanA. (2022). Protecting procedural care—Cybersecurity considerations for robotic surgery. Npj Digital Medicine, 5(1), 148. https://doi.org/10.1038/s41746-022-00693-8
29.
GrandhiS. R.StillJ. D. (2025). Deciphering human error: Improving cybersecurity reporting. Proceedings of the Human Factors and Ergonomics Society - Annual Meeting, 69(1), Article 10711813251358790. https://doi.org/10.1177/10711813251358790
HakimiM.Mustafa QuchiM.Wajid FazilA. (2024). Human factors in cybersecurity: An in depth analysis of user centric studies. Jurnal Ilmiah Multidisiplin Indonesia (JIM-ID), 3(01), 20–33. https://doi.org/10.58471/esaprom.v3i01.3832
HarishV.AckeryA.GrantK.JamiesonT.MehtaS. (2023). Cyberattacks on Canadian health information systems. Canadian Medical Association Journal: Canadian Medical Association Journal, 195(45), E1548–E1554. https://doi.org/10.1503/cmaj.230436
HoldenR. J.CarayonP.GursesA. P.HoonakkerP.HundtA. S.OzokA. A.Rivera-RodriguezA. J. (2013). SEIPS 2.0: A human factors framework for studying and improving the work of healthcare professionals and patients. Ergonomics, 56(11), 1669–1686. https://doi.org/10.1080/00140139.2013.838643
36.
HsiehH.-F.ShannonS. E. (2005). Three approaches to qualitative content analysis. Qualitative Health Research, 15(9), 1277–1288. https://doi.org/10.1177/1049732305276687
37.
HylenderD.LangloisP.PintoA.WidupS. (2024). Verizon 2024 data breach investigations report. Verizon. https://verizon.com/dbir
38.
JalaliM. S.RazakS.GordonW.PerakslisE.MadnickS. (2019). Health care and cybersecurity: Bibliometric analysis of the literature. Journal of Medical Internet Research, 21(2), Article e12644. https://doi.org/10.2196/12644
39.
Jerry-EgembaN. (2024). Safe and sound: Strengthening cybersecurity in healthcare through robust staff educational programs. Healthcare Management Forum, 37(1), 21–25. https://doi.org/10.1177/08404704231194577
40.
JuangK.GreensteinJ. (2018). Integrating visual mnemonics and input feedback with passphrases to improve the usability and security of digital authentication. Human Factors, 60(5), 658–668. https://doi.org/10.1177/0018720818767683
41.
KarwowskiW.SalvendyG.AlbertL.KimW. C.DentonB.DessoukyM.DolguiA.DuffyV.KumaraS.LiJ.MadniA. M.McGinnisL.RouseW.ShammaJ.ShenM.Simchi-LeviD.SwannJ.TiwariM. K. (2025). Grand challenges in industrial and systems engineering. International Journal of Production Research, 63(4), 1538–1583. https://doi.org/10.1080/00207543.2024.2432463
42.
KrippendorffK. (2019). Content analysis: An introduction to its methodology (4th ed.). Sage.
LiY.LiuQ. (2021). A comprehensive review study of cyber-attacks and cyber security; emerging trends and recent developments. Energy Reports, 7(1), 8176–8186. https://doi.org/10.1016/j.egyr.2021.08.126
45.
LiskaA.StoweG. (2016). DNS security: Defending the domain name system. Syngress.
46.
MarcusH. J.RamirezP. T.KhanD. Z.Layard HorsfallH.HanrahanJ. G.WilliamsS. C.BeardD. J.BhatR.CatchpoleK.CookA.HutchisonK.MartinJ.MelvinT.StoyanovD.RoversM.RaisonN.DasguptaP.NoonanD.StockenD.McCullochP. (2024). The IDEAL framework for surgical robotics: Development, comparative evaluation and long-term monitoring. Nature Medicine, 30(1), 1–75. https://doi.org/10.1038/s41591-023-02732-7
47.
MikulakR. J.McDermottR.BeauregardM. (2017). The basics of FMEA. CRC Press.
NaeemM.OzuemW.HowellK.RanfagniS. (2023). A step-by-step process of thematic analysis to develop a conceptual model in qualitative research. International Journal of Qualitative Methods, 22(1), Article 16094069231205789. https://doi.org/10.1177/16094069231205789
50.
NelsonA.RekhiS.SouppayaM.ScarfoneK. (2025). Incident response recommendations and considerations for cybersecurity risk management. NIST special publication 800(NIST SP 800-61r3) (p. 48). https://doi.org/10.6028/NIST.SP.800-61r3
51.
NifakosS.ChandramouliK.NikolaouC. K.PapachristouP.KochS.PanaousisE.BonacinaS. (2021). Influence of human factors on cyber security within healthcare organisations: A systematic review. Sensors, 21(15), 5119. https://doi.org/10.3390/s21155119
52.
NikiO.SairaG.ArvindS.MikeD. (2022). Cyber-attacks are a permanent and substantial threat to health systems: Education must reflect that. DIGITAL HEALTH, 8(1), Article 205520762211046. https://doi.org/10.1177/20552076221104665
53.
O’ConnorS. C.MallardM.DesaiS. S.CoutoF.GottliebM.EwingA.CobbW. S.CarbonellA. M.WarrenJ. A. (2020). Robotic versus laparoscopic approach to Hiatal Hernia Repair: Results after 7 years of robotic experience. The American Surgeon, 86(9), 1083–1087. https://doi.org/10.1177/0003134820943547
SawyerB. D.HancockP. A. (2018). Hacking the human: The prevalence paradox in cybersecurity. Human Factors, 60(5), 597–609. https://doi.org/10.1177/0018720818780472
56.
StrijkerM.Van SantvoortH. C.BesselinkM. G.Van HillegersbergR.Borel RinkesI. H. M.VriensM. R.MolenaarI. Q. (2013). Robot‐assisted pancreatic surgery: A systematic review of the literature. HPB: The Official Journal of the International Hepato Pancreato Biliary Association, 15(1), 1–10. https://doi.org/10.1111/j.1477-2574.2012.00589.x
57.
TamilmaniK.RanaN. P.WambaS. F.DwivediR. (2021). The extended Unified Theory of Acceptance and Use of Technology (UTAUT2): A systematic literature review and theory evaluation. International Journal of Information Management, 57(1), Article 102269. https://doi.org/10.1016/j.ijinfomgt.2020.102269
58.
TanimuJ. A.AbadaW. (2025). Addressing cybersecurity challenges in robotics: A comprehensive overview. Cyber Security and Applications, 3(1), Article 100074. https://doi.org/10.1016/j.csa.2024.100074
59.
VukotichG. (2023). Healthcare and cybersecurity: Taking a zero trust approach. Health Services Insights, 16(1), Article 11786329231187826. https://doi.org/10.1177/11786329231187826
60.
WaddellM. (2024). Human factors in cybersecurity: Designing an effective cybersecurity education program for healthcare staff. Healthcare Management Forum, 37(1), 13–16. https://doi.org/10.1177/08404704231196137
61.
WangH.LauN.GerdesR. M. (2018). Examining cybersecurity of cyberphysical systems for critical infrastructures through work domain analysis. Human Factors, 60(5), 699–718. https://doi.org/10.1177/0018720818769250
62.
WaniT. A.MendozaA.GrayK. (2021). Bring-your-own-device usage trends in Australian Hospitals – A National Survey. In MerolliM.BainC.SchaperL. K. (Eds.), Studies in health technology and informatics. IOS Press. https://doi.org/10.3233/SHTI210002
63.
WeiglM.CatchpoleK.WehlerM.SchneiderA. (2020). Workflow disruptions and provider situation awareness in acute care: An observational study with emergency department physicians and nurses. Applied Ergonomics, 88(1), Article 103155. https://doi.org/10.1016/j.apergo.2020.103155
YeohW.LiuM.ShoreM.JiangF. (2023). Zero trust cybersecurity: Critical success factors and A maturity assessment framework. Computers & Security, 133(1), Article 103412. https://doi.org/10.1016/j.cose.2023.103412
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
