24/7 managed SOC at a private healthcare group

The IT team was six people covering seven clinics: systems, networks, support for the HIS — the hospital information system every clinical activity depends on — and not a single person dedicated to security. Protection amounted to a traditional antivirus, and visibility ended when the working day did: from eight in the evening and all weekend, nobody was looking at anything. The wake-up call came on a Monday, when a technician stumbled on traces of an intrusion attempt that had been running since Friday night. Nothing happened that time. It was luck, and everyone knew it.

Two sector-specific complications sat on top of that. First, a large share of the estate was diagnostic equipment running old versions of Windows the manufacturer forbids patching or touching. Second, the data at stake was clinical records — special-category data under the GDPR — and NIS2 classed the group as an essential entity in the health sector, obliged to demonstrate detection and response capability, not merely to claim it.

1. EDR rollout and a real inventory — agents deployed across ~1,100 endpoints and servers in all seven clinics, in waves so as not to interfere with clinical activity. The inventory delivered the first surprise: 14% of connected assets IT had never catalogued, from consulting-room machines to a forgotten test server with access to the HIS.
2. Medical legacy is not touched: it is isolated and watched — no agents were installed on the unpatchable diagnostic equipment. Instead, network microsegmentation so those devices talk only to what they strictly need, plus reinforced traffic monitoring from the outside. Any anomalous connection from a CT scanner or an ultrasound machine raises a priority alert.
3. Use cases prioritised with the business, not from a catalogue — playbooks built around the three scenarios that would hurt most: ransomware, anomalous access to clinical records, and data exfiltration. Each with predefined containment actions and thresholds agreed with management.
4. Escalation defined with IT and the on-call medical directorate — who decides to isolate an HIS server at three in the morning cannot be improvised. We defined an escalation chain with IT on-call rotas and a reachable medical directorate contact, with clear criteria for when the SOC acts alone and when it wakes somebody up.
5. 24/7 operation and continuous improvement — round-the-clock monitoring from our SOC, with a monthly review of metrics (detections, false positives, response times) and ongoing tuning of rules and playbooks. The service in month twelve bears little resemblance to month one: it detects more and interrupts less.
6. Monthly exposed-credential monitoring and threat intelligence — every month we sweep open sources, criminal marketplaces, leak channels and third-party breach dumps for corporate credentials belonging to the group. In the first year alone, 47 exposed credentials surfaced in third-party service breaches — every one was rotated before anyone could use it, and three belonged to accounts with HIS access. Each finding feeds a monthly intelligence report for management: new exposures, active campaigns against the healthcare sector, techniques observed in the group's own incidents, and prioritised recommendations. Management stopped learning about threats from the press: they see them coming in their own report.

The first year's three incidents — two ransomware attempts caught at an early stage and a compromised account being used in the small hours — were contained with no impact on clinical activity: not one clinic lost a single hour of operation. And when NIS2 became applicable, the group did not have to improvise a story: it had metrics, playbooks and handled incidents with which to demonstrate genuine detection and response capability.

The monthly exposed-credential monitoring added a layer the EDR cannot see: the 47 credentials rotated in time were bought-and-paid-for entry points that never got to open a door. And the monthly intelligence report turned security into a board-level conversation built on the group's own data and its sector's threat picture — not a technical annex nobody read.