NHS Case Study

Why is Cyber Security in the NHS a Patient Safety Issue, not just an IT Issue?

• outages delay diagnosis and treatment

• health records, test results and NHS numbers are valuable to criminals and impossible to ‘reissue’

• affects tens of thousands of organisations and well over a million devices

• a hospital can’t close for a week to rebuild its IT - has to continue on paper

What are the the Top 10 Cyber Risks?

• Lack of staff awareness and training

• Insufficient cyber skills and resources

• Cyber not a board-level priority

• Weak access management and controls

• Poor password and credential management

• Historic weakness of the information governance regime

• Unpatched and legacy systems and assets

• Vulnerable internet-facing systems

• No monitoring of encrypted traffic

• No local internet monitoring

What are the Key Components of the Regional Lead Model?

1. understand

2. prioritise

3. deliver

build security in from the start

monitoring added afterwards limits the damage but doesn't stop the incident

What is Understand in the Regional Lead Model?

• what are the key risks and concerns?

• what is the architecture, especially external connectivity?

• how strong is the governance - SIRO, cyber lead, risk escalation?

What is Prioritise in the Regional Lead Model?

• which services directly mitigate the high risks?

• how quickly can they be deployed?

• what risk remains?

What is Deliver in the Regional Lead Model?

• build a roadmap with delivery providers

• identify conflicts and issues early

• keep the national team informed

What are the Challenges of Cyber Security in the NHS?

• who is accountable?

• leadership, funding and legacy

• the emergence of AI - threat, tool and target

Who is Accountable for Cyber Security in the NHS?

• each trust is a separate legal entity that owns its own risk, but threats cross organisational boundaries

• central teams see the risk but have limited power to enforce

• responsibility for suppliers is split between trusts, ICBs, the centre and regulators

• every reorganisation disrupts expertise, relationships and incident playbooks

Why is AI a Threat for Cyber Security in the NHS?

• NCSC: AI will almost certainly make attacks more frequent and effective to 2027

• shrinks the time between a flaw being disclosed and exploited

• better phishing; lower barrier for less skilled criminals

Why is AI a Target for Cyber Security in the NHS?

• AI tools connected to clinical systems and data create new attack surface

• developers prioritise speed over security in the race to ship

• data poisoning and model misuse are new risks for clinical safety

Why is AI a Tool for Cyber Security in the NHS?

• AI-driven detection and triage can help stretched SOC teams

• a 'digital divide' risk: organisations that can't keep pace become more vulnerable