Healthcare Cybersecurity Solutions & Training

On 18 March 2021, an employee of Ireland's national health service, the HSE, opened an infected Excel spreadsheet that had arrived by phishing email two days before. The same user had received emails with the same subject line several times in the months leading up to it. Within two weeks, antivirus software on the workstation detected tools commonly used by ransomware groups, but the intrusion was not stopped.

The attacker stayed inside the network for about eight weeks. On 14 May 2021, Conti ransomware was detonated across the HSE. Clinicians lost access to patient records, clinical systems, and laboratory systems, and many went back to pen and paper. The HSE's director general estimated recovery costs would exceed US$600 million. An independent review by PwC, published in December 2021, found several missed opportunities to stop the attack before the ransomware ran.

A spreadsheet in a work inbox does not announce itself as a decision. It looks like a task, and in a hospital environment tasks arrive faster than anyone can weigh them. The person who opened it was doing what the setting trains everyone to do: deal with what is in front of you and move on.

Familiarity worked against them. A message that resembles ones you have already seen reads as routine rather than as a warning, so each earlier attempt made the next one easier to accept, not harder. And once the file was open, the moment passed in silence. Nobody flagged it, nobody asked about it, and the organization's first sign of trouble came from software rather than from the person best placed to raise a hand.

Repeated targeting of one person is itself a risk signal. Odin brings together signals from the security tools you connect, including email security, so a clinician who keeps receiving the same lure moves up the risk view and can be prioritized for targeted training.

A suspicious attachment is only useful to the security team if someone reports it. Whitebait simulations, including lures rebuilt from real emails in Dolus AI Studio, teach staff to report instead of open, and reporting rate is tracked next to click rate. With the Teams App, reporting takes one tap.

Training has to fit around patient care. Codex delivers short modules in English and Arabic, and Zero-Touch Training assigns them only when a person's behavior calls for it. For UAE providers who need data to stay in their own environment, Fraus can run on-premise.