An AI-based SOC-as-a-Service, built for the clinical environment

Comprehensive risk assessment, proactive defence against emerging threats, and effective prioritisation and risk treatment, with customised long-term protection.

Ad-hoc behavioural models trained per system deliver an estimated probability that a device is behaving incorrectly, which may be an early warning of an attack. Because the models learn normal operation rather than parse protocols, they are unaffected by the diversity of medical device architectures and data formats.

Machine learning builds a baseline of normal behaviour for users such as doctors, nurses and administrative staff, and for entities such as infusion pumps, EHR systems and IoT devices, then flags deviations such as unusual logins or unauthorised access to patient records. This matters in healthcare, where insider risk, compromised accounts and lateral movement bypass perimeter defences.

Rather than relying solely on automated alerts, analysts use intelligence-driven hypotheses to actively search for anomalies and stealthy mechanisms, informed by attacker tactics, techniques and procedures, indicators of compromise and emerging vulnerabilities.

The core component for active protection: a central provisioning layer that coordinates security operations and service delivery, evolving the SOCaaS into a unified cyber operations and service provisioning fabric able to analyse many different environments.

Standardised playbooks for the healthcare sector covering proactive actions triggered by predictive maintenance or attack prediction, and reactive actions to detected incidents, so that business processes are not disrupted.

Standardised reporting processes and templates that let healthcare providers notify incidents, vulnerabilities and breaches in a timely and secure manner, supporting cross-border cooperation and trust between hospitals, national authorities and EU institutions.

Aggregating and analysing intelligence from consortium members and trusted sources such as ENISA, national CSIRTs and healthcare CERTs, so hospitals move from reactive to proactive defence.

Intelligence-driven hypotheses and shared playbooks let security teams detect what automated defences miss, and transfer lessons learned from one institution across the EU healthcare ecosystem, reducing dwell time at scale.

Realistic scenarios such as ransomware outbreaks or attacks on connected medical equipment help IT teams and clinical staff identify, respond and recover faster. Incident response and business continuity playbooks can also be rehearsed in these environments.

From general cyber hygiene for healthcare professionals to advanced courses for security experts, plus material and guidelines on EU policies and regulations. Four full-day training sessions run at the pilot sites for pilot personnel.

Matching the real problems faced by healthcare providers and SMEs with the right expertise, plus advisory services connecting authorities and policy makers with providers, researchers and industry. A dedicated helpdesk operates at HOPE premises.

Activities that engage stakeholders across government, policy, academia, industry and civil society, promoting understanding of healthcare cybersecurity and generating demand for the technologies developed.