Have you noticed that, over the last decade, hospitals have stopped being organizations with buildings full of rooms, wards, and operating theaters, and have become complex ecosystems of data and interconnected systems? Therefore, today a cyberattack does not just block servers: it shuts down operating rooms, delays critical diagnoses, and, ultimately, jeopardizes the safety of those receiving care.
As a company that has helped various healthcare organizations, we have seen firsthand that in this sector, a system compromised by an attack can have consequences as real as medical malpractice.
And why does the healthcare sector have a target on its back?
The answer is simple: medical information does not expire. Medical records are a goldmine on the black market:
- The value of data: while a credit card can be canceled in minutes, your medical history, your profile, and your illnesses are permanent. For this reason, a complete medical record can be worth up to ten times more on the dark web than financial data.
- The trail of incidents: we have seen how massive breaches in the past have exposed the privacy of millions of people. These incidents were not software errors: they were strategic failures that proved the healthcare sector was operating with 21st-century tools but protecting them with a last-century mindset.
What makes the healthcare environment unique?
Unlike a bank or an online store, healthcare presents challenges found nowhere else. As a consulting team, these are the three pillars we always emphasize:
- The Paradox of Absolute Availability
In banking, if there is a risk, you can take the system offline for an hour to patch it. In a hospital, “zero downtime” is not a goal—it is a requirement. No matter how many crisis continuity plans are in place, it is not easy to reboot a server if the monitoring of an ICU or the flow of an infusion pump depends on it, for example. This critical dependency is why ransomware, for instance, is uniquely devastating here, as attackers know the hospital has lives at stake. - The IoMT (Internet of Medical Things) Ecosystem
A modern hospital has thousands of connected devices: pacemakers, insulin pumps, MRI machines. Many of these devices run on obsolete (legacy) operating systems that cannot be easily updated. Therefore, every single device is a potential backdoor and a risk to be considered. - The Human Factor Under Pressure
Healthcare staff are trained to save lives, not to detect phishing. In a high-stress environment, usability usually triumphs over security. If a complex password delays an emergency treatment, staff will find a way to bypass it. Cybersecurity here must be invisible and enabling, not an obstacle.
…And then came AI!
The integration of AI into healthcare is a quantum leap, but from a security perspective, it expands the attack surface in unprecedented ways and introduces new risks. So, how can we manage them comprehensively? At ThinkUPC, we aim to address this perspective through three scenarios:
"Against AI"
"With AI"
"For AI"
- “Against AI”. The new value of AI for attacking —and against which we must defend—. AI has become a multiplier for criminals. It allows the automation of tasks that previously required weeks of work and deep expertise. How?:
• By automating reconnaissance, massively scanning public profiles, or identifying employee behavior patterns.
• By creating “high-definition” social engineering, using phishing that includes audio and video deepfakes, or generating perfectly written, personalized, and persuasive emails in any language.
• By developing new malware or rewriting existing code so it goes undetected.
• Additionally, AI accelerates the exploitation of flaws by analyzing security patches to generate new exploits in a matter of hours. - “With AI”. The new value of AI for defending —which must be leveraged—. AI enables a shift from a reactive approach (waiting for the attack) to a proactive one (anticipating it). Examples of capabilities:
• Reconnaissance and visibility over our own infrastructure, thinking like an attacker.
• Alert management within a SOC (Security Operations Center), reducing response times and automating initial analysis. This allows humans to focus exclusively on real, complex threats.
• Autonomous penetration testing on exposed services with continuous validation, adapting in real time to changes made to the infrastructure.
• Phishing training and simulations, including analyzing the profiles of employees who fall for scams to generate tailored educational content. - “For AI”. AI as a new asset to protect —which we must safeguard— on three levels:
• Ensuring privacy and regulatory compliance by identifying risks, drafting relevant policies, and conducting continuous reviews.
• Monitoring events for potential alerts and incidents (SOC).
• Comprehensively managing vulnerabilities to proactively determine the actual risk of a potential incident on an AI system, using scans or pen tests that follow the new OWASP methodology for AI (https://genai.owasp.org) to simulate real-world attacks.
