Illustration: a scan film, in point clouds, of the places a hospital runs on: the hospital from the air, a ward at night, an imaging room with its MRI scanner, the pharmacy’s cold room, a laboratory, the plant room with its standby generator and the Cantic mark. The labels show synthetic readings and addresses.
We break into your hospital before a criminal does.
From your patient portal to records, lab and pharmacy systems. With Fortify, we write the fix within 24 hours.
Real attack Hospital Civil de Guadalajara See the attacks
Healthcare
A criminal needs only one way into a hospital.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what a hospital runs on. So do criminals.
Outside firms
- Your IT provider
- Clinical software suppliers
- Medical equipment suppliers
- Building services contractor
- Refrigeration contractor
Remote access
- VPN
- Remote desktop
- Remote support
- Vendor portals
-
Admissions and office
- Appointments portal
- Patient records
- Backups
-
Wards and theatres
- Patient monitors
- Infusion pumps
- Nurse call
- Ward terminals and network
-
Imaging
- CT and MRI scanners
- Image archive
- Maker’s remote access
-
Laboratory
- Analysers
- Lab system
- Sending results
-
Pharmacy
- Vaccine fridges
- Temperature loggers
- Dispensing cabinets
-
Plant room
- Building management
- Ventilation and cooling
- Medical gas alarms
- Backup power
-
Mexico
-
England, United Kingdom
Wirral University Teaching Hospital
Systems isolated after an attack; staff worked on paper and all outpatient appointments were cancelled.
Sources Healthcare Management ITPro
-
England, United Kingdom
Synnovis, pathology services in south-east London
Ransomware disrupted pathology; two London trusts postponed 1,696 elective procedures and 10,083 acute outpatient appointments.
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for hospitals, clinics and their patients.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules healthcare answers to.
- NIS2 names health a sector of high criticality, from healthcare providers to pharmaceutical and medical device makers (Annexes I and II). 1
- A significant incident needs an early warning within 24 hours and a notification within 72 hours (Article 23). 1
- Spain’s National Security Framework covers the public sector and its contractors’ systems, audited at least every two years. 2
Questions
What buyers ask us
- Have you found a way into healthcare before?
- Yes: in one engagement, Eclipse found a way to read medical records, with diagnoses, prescriptions and tests.
- Does it help with NIS2 and our audits?
- Yes: every step is recorded, from the signed scope to the retest, but it does not certify compliance.
- Our IT is outsourced. Why you?
- Your IT company runs your systems and we attack them: two different jobs.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), . Read on .
- Boletín Oficial del Estado (BOE), Real Decreto 311/2022, de 3 de mayo, por el que se regula el Esquema Nacional de Seguridad, . Read on .