Reclaiming the Defender’s Advantage: Strengthening Healthcare Cybersecurity with a Threat-Informed Defense
Healthcare cyberattacks continue to grow in frequency and sophistication. As the industry’s digital footprint expands, so does the attack surface, putting sensitive patient data and essential services at risk. This blog will outline strategies to reclaim the “Defender’s Advantage,” including practical approaches to reduce the risk of cyberattacks and processes that support a threat-informed defense.
Understanding the Defender’s Advantage
Traditionally, defenders in cybersecurity are thought to be at a disadvantage—needing to be right all the time, while attackers only need one opportunity. But this perspective overlooks the critical edge organizations have over attackers: defenders know their environments better than anyone else. They’ve built the systems, manage the identities, and understand the workflows. The Defender’s Advantage involves leveraging this knowledge to anticipate threats, act quickly, and restore systems efficiently.
Think of Kevin McCallister in Home Alone. He wasn’t stronger than the intruders, but he knew his environment and used that to outsmart them. Similarly, healthcare IT teams can outmaneuver attackers, reassert control, and maintain the advantage if they understand how to use their environmental awareness as a strategic advantage.
From Compliance-Informed to Threat-Informed Defense
Many healthcare organizations approach security from a compliance-first standpoint, ensuring alignment with frameworks such as HIPAA and HITRUST. While necessary, this approach can fall short when real-world threats don’t fit neatly into a compliance checkbox. A threat-informed defense goes further, utilizing real intelligence about active attackers and their methods to inform defense and response strategies.
This shift requires integrating intelligence into every layer of the cybersecurity function, from detection and response to control validation and incident management.
The Six Critical Functions of Cyber Defense
Operationalizing a threat-informed defense involves six core functions, each interdependent and reinforcing the others:
1. Intelligence – The Guiding Light
Effective defense starts with understanding the threat landscape. The intelligence life cycle should go beyond simply reacting to alerts from monitoring sources and instead begin with deliberate planning and direction. Within this process, hospitals must also consider operational technology (OT)—such as HVAC systems, physical access controls, and medical devices—that interface with information technology (IT), an aspect often overlooked in traditional intelligence gathering.
The process begins with collecting and curating threat intelligence data, which feeds into an analysis phase where context is added and meaning is derived. This analysis informs intelligence production, resulting in outputs such as leadership briefings, updates to detection telemetry, employee awareness communications, or peer collaboration to validate observations.
An important outcome of this process is a cyber threat profile created by understanding the threat landscape in relation to the organization’s specific operations, structure, and vulnerabilities. The potential impact of attacks, such as reverting to paper processes, inability to pay staff, or evacuating patients, further refines this profile. A continuous feedback loop assesses effectiveness and identifies areas for improvement, reinforcing an intelligence-driven approach to decision-making.
2. Detect – Alert Monitoring and Investigation
The next step is to leverage threat intelligence for detection. With the right telemetry in place, hospitals can detect anomalies early to maintain a secure operation. However, detection must be tuned to actual threats, not just noise. Threat-informed telemetry ensures that alerts generated are actionable and relevant.
3. Respond – Incident Response and Recovery
Once analysis is complete and threat intelligence is activated, the focus shifts to system restoration—determining the appropriate response to compromises and identifying the immediate actions required for containment.
Restoration must be careful and informed by an understanding of the infection’s scope to avoid reinfection. Bringing services back online safely without risking reinfection requires a clear understanding of threat actor behavior timelines, detection telemetry, and the integrity of backups. Restoration decisions also depend on identifying the infection boundary and may involve temporary paper-based processes, followed by the reentry of data into compromised systems, such as electronic health records (EHRs). This process is followed by eradication, ensuring the threat is entirely removed to prevent re-exploitation.
4. Validate – Testing Controls and Processes
Hospitals must routinely test security controls—and not just technical controls but also processes and people. Tabletop exercises, real-time simulations, and validation of incident response and playbooks help ensure readiness when incidents occur.
5. Hunt – Proactive Threat Identification
Threat hunting uses intelligence to hypothesize how attackers might behave and searches for signs of compromise. Hunting is often similar to red teaming; it’s a way of modeling attacker behavior against the hospital’s specific environment, helping uncover blind spots and strengthen defenses.
6. Mission Control – Maintaining Governance
The final category is mission control. Maintaining governance in the cyber defense process involves ensuring that staff are empowered, authorized, and equipped to act effectively and efficiently. It prioritizes clear communication between IT, clinical services, and third-party partners, encouraging coordination across the entire ecosystem.
The Role of AI in Healthcare Cyber Defense
AI’s role in healthcare cybersecurity is twofold:
- As a Target – Hospitals must defend AI systems, including the data they rely on, the models themselves, the infrastructure they run on, and the applications they power.
- As a Tool – AI can serve as a powerful assistive capability for defenders, helping to regain the advantage by managing the volume of information produced in modern healthcare environments. AI assists by analyzing vast volumes of telemetry, summarizing threat intelligence, and even simulating attack paths. This enables faster and more effective detection and response by distilling complex data into actionable insights. AI can also enhance control validation and threat hunting.
While AI itself is a critical asset to protect, it also acts as a defensive tool. It accelerates the security workflow, reducing manual effort, eliminating noise, and adding structure and context—making AI a powerful ally in reclaiming the Defender’s Advantage.
Building a Resilient Cybersecurity Framework
Cyberattacks on hospitals are not just an IT issue—they pose a direct threat to patient safety. A resilient healthcare cybersecurity strategy demands a holistic approach that secures both digital and physical infrastructure. This includes:
- Reassessing the attack surface, including overlooked OT systems.
- Making intelligence actionable, not just consumable.
- Training staff and testing systems so that the first response isn’t a fire drill.
- Leveraging AI and cloud-based tools to help scale and automate.
The ultimate goal isn’t just to prevent breaches, but to build a resilient cybersecurity framework—one that reclaims the Defender’s Advantage and ensures continuity of care, even in the face of evolving threats.
Interested in learning more? Check out a recording of our in-depth webinar on this topic presented by Bill Reid of Google’s Office of the CISO for Healthcare and Life Sciences and Mike Donahue, CloudWave’s Chief Operating Officer.