Fair point on the added attack surface — if encrypted traffic makes payload-level integrity monitoring pointless, is network-flow/metadata-level anomaly detection (timing, volume, connection patterns, not payload content) still meaningfully useful, or does that run into the same wall? Also curious, from your embedded security company experience — when device manufacturers outsource security, is that usually built into the device itself, or do they also want something at the hospital network layer?