Abstract

The Internet of Medical Things (IoMT) has transformed healthcare through real-time patient monitoring, intelligent diagnosis, and seamless exchange of medical data. However, the increasing interconnectivity of IoMT devices has significantly expanded the cybersecurity attack surface, exposing healthcare systems to threats that may compromise patient safety, Data Confidentiality, and service availability. Existing cybersecurity risk assessment methods often face challenges in adequately capturing the ambiguity, incompleteness, and subjectivity inherent in expert-based evaluations of IoMT security risks. To address these limitations, this paper proposes a symmetric hybrid neutrosophic fuzzy-based cybersecurity risk assessment methodology for IoMT environments. The proposed framework integrates Neutrosophic Fuzzy Sets (NFSs), the Analytic Hierarchy Process (AHP), and the Simple Average Method (SAM) to model truth, indeterminacy, and falsity in expert judgments while aggregating multiple expert opinions to produce a comprehensive cybersecurity risk assessment. The framework evaluates cybersecurity risks across seven security dimensions and twenty-eight evaluation sub-factors to identify and prioritize critical IoMT vulnerabilities and risk vectors. The experimental results indicate that Data Protection Assessment is the highest-ranked cybersecurity dimension. At the final evaluation stage, the proposed approach combines normalized criterion weights with expert risk evaluations to produce a cybersecurity risk score of 0.8504, indicating high cybersecurity risk that requires priority mitigation in IoMT situations. The proposed framework is validated by comparing it to traditional multi-criteria decision-making methods and using sensitivity analysis to assess the rankings’ robustness and stability under different decision scenarios and expert preference variations. Results show that the proposed method delivers consistent, accurate, and robust risk prioritization under uncertainty, supporting IoMT cybersecurity decision-making. Healthcare organizations can use the framework to identify cybersecurity threats, prioritize mitigation techniques, and strengthen IoMT systems.

IPC Classification

Keywords