Most hospital security programs are built to stop a data breach. But the attack chains ON2IT models in live “Hack the Hospital” demonstrations never touch a medical record — they hit the HVAC system keeping an OR sterile, the water loop feeding dialysis, the building controls separating clinical zones. These systems are connected, unmonitored, and invisible to almost every tool your security team runs. Zero Trust that stops at the data layer isn’t protecting your hospital. It’s protecting half of it.
The Problem
Hospital OT Is Connected, Unmonitored, and Unsafe
Hospitals have 15 to 20 networked devices per bed. Larger facilities may have 85,000 non-IT medical devices. Most traditional cybersecurity systems cannot even see OT, IoT, and IoMT devices — let alone protect them. Water, HVAC, and sterilization systems sit on the same networks as radiology workstations.
The Response
Zero Trust Adapted for Physical Environments
Standard IT Zero Trust cannot be copied directly into CPS environments without risking operational disruption. Safety, latency, and uptime constraints require a specifically adapted approach — but the principles are the same. Start with visibility, segmentation, and controlled remote access.
In Brief
The scale of the problem
European health sector reported 309 cybersecurity incidents in 2023, with hospitals as the primary target (ENISA). Most attacks are not sophisticated — they exploit unsecured interfaces, flat network designs, and unmonitored vendor access. The damage is no longer limited to patient data. It now reaches operating rooms, dialysis units, and sterile zones.
The hidden attack surface
OT systems — HVAC, water management, sterilization, building management — are critical to patient safety but are built for availability, not security. OT evolves every 10–15 years; IT every 6 months. Most OT systems have no logging, no authentication, no detection. In many hospitals, these systems share network infrastructure with clinical IT and medical devices.
Why standard IT ZT doesn’t transfer
Applying IT-centric Zero Trust to hospital CPS environments risks physical harm. Active vulnerability scanning crashes fragile PLCs. Auto-isolation of a “risky” controller in an ICU can cause patient harm. Cloud-dependent identity checks introduce latency that real-time clinical systems cannot tolerate. Gartner (January 2026) is explicit: adapt the principles, don’t copy the tools.
What adapted ZT delivers
Passive asset discovery that doesn’t disrupt. Protocol-aware segmentation that understands Modbus and BACnet commands, not just TCP ports. Just-in-time credentials for vendor access. East-west monitoring inside the OT network. Success is measured by time-to-recovery and blast radius containment — not patch saturation or MFA universality.
What we found in real hospital assessments: “No logging on OT controllers. Shared passwords across vendor accounts. Windows 7-based HMIs still in production. Water and HVAC systems on the same VLAN as radiology workstations. If you’re thinking ‘that can’t be true’ — you’re already behind.”
I. Why Hospitals Are the Perfect Target
Ask a hospital security team what their biggest risk is and most will say the same thing: a leaked patient record. It isn’t. Hospitals are digitally fragmented, chronically under-resourced on security, and architecturally unprepared for the threat they actually face — which makes them highly attractive to attackers, and particularly vulnerable to the specific technique that defines modern OT attacks: living off the land.
Volt Typhoon, a Chinese state actor, remained undetected for more than 300 days inside the US electric grid in 2023. FrostyGoop malware targeted heating controllers via Modbus in 2024 — disrupting 600 apartment buildings in Ukraine during sub-zero temperatures after ten months of silent reconnaissance. These are not IT attacks. They are infrastructure attacks executed through the same industrial protocols that run hospital buildings.
What makes hospitals specifically vulnerable is not their importance — it is their architecture. Complex ecosystems of legacy OT and modern IT. Systems from multiple vendors, patched irregularly if at all. Remote access by third parties, often with default credentials or shared accounts. Minimal segmentation between clinical systems and building management. Most hospitals were built for care, not cyber defence.
Signal
“309 cybersecurity incidents in the European health sector in 2023 alone. Hospitals are the biggest target according to ENISA — and most attacks exploit basic architectural failures, not sophisticated zero-day exploits.”
II. The Cascade Effect — When Physical Systems Fail
In ON2IT’s live Hack the Hospital demonstrations — using real-world-inspired attack chains — two things become immediately clear. First, the entry points are embarrassingly accessible. Second, the physical consequences are immediate and serious.
Demo 1 · HVAC Attack
Entry via outdated vendor VPN → BACnet command injection
An attacker exploits an unpatched vendor VPN gateway to reach the Building Management System. BACnet commands — unencrypted by design — are used to override operating room climate controls and close air dampers. Room temperature rises. Surgeries are postponed. Sterile zones are compromised. Medical equipment is damaged.
Demo 2 · Water System Attack
Entry via lateral movement → direct command injection
From a foothold anywhere in the flat network, an attacker pivots to a publicly exposed HMI with default credentials. Water pressure and chlorination levels are altered. Dialysis processes — which require precisely controlled water quality — are disrupted. Patient safety is directly at risk.
Both attack chains demonstrate the same structural vulnerability: when systems are connected but unprotected and unsegmented, going from access to impact takes minutes. No sophisticated tooling is required. The protocols — BACnet, Modbus — were designed for industrial reliability, not security. They have no native authentication. They accept commands from any device that can reach them.
The cascade effect compounds the damage. A malfunctioning HVAC delays surgeries. A tampered water loop contaminates dialysis treatments. A disabled sterilization cycle shuts down entire wards. Alarms don’t sound — because they are not designed to detect these specific threats. The hospital appears to be operating normally until it isn’t.
Key finding from ON2IT assessments
“In some hospitals, water and HVAC systems were on the same VLAN as radiology workstations. Once an attacker enters a poorly segmented system, they can pivot from a building management system to a nurse station in minutes.”
III. Five Failures We Find in Every Hospital Assessment
ON2IT’s hospital security assessments consistently surface the same vulnerabilities. They are not exotic. They are the predictable outcome of decades of designing hospital infrastructure for availability without designing it for security.
- No logging on OT controllers. Building management systems, HVAC controllers, and water management systems generate no security logs. An attacker can be inside these systems for months without producing a single alert. There is no evidence trail. There is no detection surface.
- Shared passwords across vendor accounts. Third-party vendors — equipment manufacturers, maintenance contractors, system integrators — access hospital OT with shared credentials, often unchanged from the factory default. When those credentials are compromised, every vendor account for that system is compromised simultaneously.
- Legacy Windows HMIs in production. Windows 7 and Windows XP-based Human-Machine Interfaces running industrial control systems — unpatched, unsupported, and impossible to patch without voiding OEM warranties or causing production downtime. These systems cannot be updated. They must be bounded.
- No detection of lateral movement. Hospital networks are typically flat — no east-west monitoring between segments, no visibility into controller-to-controller traffic. An attacker who gains a foothold anywhere in the network can move freely. There is no internal boundary to cross and no alarm to trigger.
- OT and clinical IT on the same network segment. The most dangerous finding: building systems (HVAC, water, power) sharing network infrastructure with clinical workstations and medical devices. A breach in building management becomes a pathway to patient data. A breach in clinical IT becomes a pathway to physical systems.
Signal
“Although targeted OT attacks on hospitals are still rare, it is a matter of time before healthcare OT comes into the sights of cyber adversaries. The question is whether hospitals act before that moment arrives.”
IV. Why Standard IT Zero Trust Doesn’t Transfer — and What Does
Most hospitals trying to adopt Zero Trust reach for the toolkit their IT team already owns: vulnerability scanners, universal MFA, cloud identity, automated isolation. In hospital OT, that toolkit is dangerous. Gartner’s January 2026 research note on Zero Trust for Cyber-Physical Systems makes the risk explicit: applying IT-centric Zero Trust tools and tactics directly to CPS environments without adaptation can jeopardise physical safety and operational continuity. The principles are sound. The implementation approach must be different.
What Works in Hospital OT
- Passive discovery — map assets and topology without sending active probes that crash fragile real-time controllers
- Zone and conduit segmentation — isolate safety systems from control systems, and both from enterprise IT, using architecture, not just policy
- Protocol-aware enforcement — firewalls that understand Modbus and BACnet, blocking “write” commands for read-only users rather than just allowing or denying TCP port 502
- JIT credentials for vendor access — rotating, temporary credentials for maintenance windows; never static shared passwords
- Alert-first adaptive access — trigger alerts and step up monitoring for anomalous commands; never auto-isolate a controller without human confirmation
- East-west traffic monitoring — visibility into controller-to-controller lateral movement, not just north-south traffic from enterprise IT to OT
What Doesn’t Work — and Why
- Active vulnerability scanning — crashes fragile PLCs and real-time systems; a high scan frequency is a negative safety indicator, not a positive one
- MFA for all OT devices — legacy protocols (Modbus, BACnet) have no native identity concept; wrapping them in ZT authentication tunnels introduces latency that real-time safety systems cannot tolerate
- Cloud-dependent identity for local operations — if internet connectivity is lost, local safety systems must still function; cloud-only IdP creates a dangerous single point of failure
- IT SOAR playbooks that auto-isolate — in a hospital, isolating a controller could cause physical harm; automated isolation decisions require human confirmation and clinical context
- Relying on air-gap mythology — CPS environments are increasingly connected and remotely accessed; the air gap is illusory and often absent entirely in modern hospital infrastructure
Gartner, CPS Security Research · G00845476, January 2026, p.2
Gartner’s 2026 CPS security research is clear that in operational environments, success is not measured by the percentage of systems patched or scanned — it is measured by how quickly critical processes can be restored and how effectively actual exposures are mitigated without halting production. That framing shift is the starting point for any hospital Zero Trust program.
V. The Five Zero Trust Principles — Adapted for Hospital Environments
Gartner’s five Zero Trust principles provide the right structural framework. Applied to hospital CPS, each requires specific adaptation that respects the physical realities of clinical operations.
Zero Trust is a paradigm — start with high-value assets, build outward
Don’t try to apply Zero Trust everywhere simultaneously. Identify the highest-risk, highest-value systems — specific safety systems, ventilation controllers, water management — and build outward from there. A brownfield-first strategy using gateways and overlay solutions is realistic. A rip-and-replace strategy for expensive medical equipment is not. A cross-functional team — IT bringing ZT architecture, clinical engineers bringing process safety context — is non-negotiable.
Assume hostile actors — OT environments are increasingly targeted
Living off the land techniques and dormancy are the norm in CPS attacks. Volt Typhoon sat undetected for 300 days. FrostyGoop spent 10 months in reconnaissance before striking. Deploy purpose-built CPS protection platforms for passive asset discovery and east-west traffic monitoring. Conduct exercises that assume attackers already have valid credentials — and ask “what stops them from disabling the sterilization cycle?” This leads to better secondary controls and physical safety interlocks.
Establish identity — in hospital OT, identity is complex
“Engineer 3” in a 24/7 shift operation could be three different people. A polymorphic robotic CPS changes what it does continuously. Equipment identity may change during OEM maintenance without IT being notified. Use gateway proxies and behaviour-based device fingerprinting (“this IP always communicates via Modbus TCP to these three registers”) to establish identity where native authentication is absent. Issue JIT credentials for maintenance windows; rotate them on completion.
Limited access — least privilege through zones and conduits
Architect for zones and conduits that separate safety instrumented systems from control systems, and control systems from enterprise IT — unless a specific, monitored need exists. For critical segments like nuclear or power generation (and some hospital systems), physically enforce one-way traffic with unidirectional gateways. The engineering department workstation should not have direct IP connectivity to a sensor on the clinical floor. Logical separation enforced only by ACLs is weak; routing that exists is routing that can be exploited.
Risk-based adaptive access — alert first, never auto-isolate
In hospital CPS, automatically blocking a command because of a risk score change is dangerous. A safety command that is stopped at the wrong moment causes exactly the harm you are trying to prevent. Adaptive access in clinical OT means stepping up monitoring and triggering high-priority alerts for security analysts to engage with production engineers — while allowing the process to continue. Define context-aware maintenance windows: write access to a controller only when a permit-to-work ticket is open in the system, or when a physical maintenance key is active.
Gartner, CPS Security Research · G00845476, January 2026, p.3
Gartner’s 2026 research on CPS security notes that Zero Trust is no more a magic wand in OT environments than any security paradigm before it — and the implementation path is harder than in IT. Organisations that succeed will be those that respect the physical constraints of clinical environments rather than force-fitting IT assumptions onto them. The principles travel; the tools must be chosen carefully.
VI. Measuring Success — Hospital OT Metrics Are Different
The metrics used to measure Zero Trust progress in IT environments are the wrong metrics for hospital OT. Some of them are actively dangerous. Gartner identifies a specific set of “anti-metrics” — common IT ZT measurements that indicate misunderstanding when applied to CPS.
Measure These
- Time-to-recovery (TTR): How fast can a critical clinical process be restored using manual overrides or offline backups during a drill?
- Drill frequency: How often are “assume breach” exercises conducted with both IT security teams and clinical engineers — testing physical safety interlocks, not just perimeter defences?
- Zone integrity: What percentage of east-west OT traffic (controller-to-controller) is monitored for lateral movement?
- Maintenance window compliance: What percentage of “write” commands to controllers correlate with an active permit-to-work or physical maintenance key?
Do Not Measure These
- Patching saturation: Many legacy OT controllers cannot be patched without voiding warranties or causing downtime. High patch rates indicate risky behaviour in CPS.
- Active scan coverage: Active scanning crashes fragile PLCs. A high number here is a safety failure, not a security success.
- MFA universality: Legacy CPS cannot support MFA. A high target here indicates a fundamental misunderstanding of the hardware environment.
- % of devices compliant: Compliance frameworks built for IT endpoints do not map to industrial controllers. Forcing this metric creates paper compliance, not actual security improvement.
Gartner, CPS Security Research · G00845476, January 2026, p.2
Gartner’s 2026 guidance on CPS security is direct: organisations should plan for breaches to occur, not just try to prevent them. That means investing in offline backups, maintaining manual override capabilities, and conducting regular recovery drills. In hospital OT, resilience and recovery speed are the primary measures of security maturity — not prevention metrics borrowed from IT frameworks.
The Numbers That Make the Case
ENISA · 2023
ON2IT · Hack the Hospital
ON2IT · Hack the Hospital
US CISA · 2023
ON2IT · Gartner Analysis
Protocol specifications
Four Concrete First Steps for Hospital Security Leaders
Zero Trust for hospital OT does not start with a full transformation program. It starts with visibility and bounded segmentation — proving the approach works in a contained environment before expanding. The hospital that starts small and executes well is further ahead than the one that plans comprehensively and implements nothing.
Make the invisible visible — passive OT asset discovery
Deploy a purpose-built CPS protection platform that passively discovers and maps every OT, IoT, and IoMT device without sending active probes. This single step typically reveals assets the IT team didn’t know existed. You cannot protect what you cannot see. Before segmentation, before policy, before anything — build the inventory.
Separate the critical from the connected
Identify your highest-risk, highest-impact OT systems — HVAC, water, sterilization, oxygen supply — and segment them from the rest of the network using zones and conduits. These systems should not share network infrastructure with clinical IT or radiology workstations. Start with architectural separation; enforce it with protocol-aware controls rather than generic firewall rules.
Eliminate standing vendor access
Replace static shared vendor credentials with just-in-time access: credentials issued for a specific maintenance window, scoped to the specific systems the vendor needs to reach, revoked automatically on completion. Every third-party vendor who has standing access to hospital OT systems is a persistent, unmonitored risk. JIT access eliminates that class of exposure entirely.
Run an “assume breach” drill with clinical engineers in the room
The most valuable exercise a hospital security team can conduct is not a penetration test — it is a tabletop exercise that asks: “An attacker has credentials and is inside our OT network right now. What stops them from affecting patient care?” The answer to that question reveals the secondary controls you need: physical safety interlocks, manual override capabilities, response procedures. Clinical engineers must be in the room. This is not an IT exercise.
Hack the Hospital
Want to see this attack chain, not just read about it?
Hack the Hospital is ON2IT’s live demonstration of exactly the attack chains described above, run against a realistic hospital environment. HVAC, water systems, building controls: your team sees the cascade effect for themselves, not just our word for it.
See the Hack the Hospital demoSources
- ON2IT. “Hack the Hospital.” Presented by Luca Cipriano, ONE Conference, 2025.
- Gartner. “Adapting Zero Trust Principles to CPS Security.” Katell Thielemann, G00845476, January 2026.
- ENISA. “Health Threat Landscape.” European Union Agency for Cybersecurity, 2023.
- CISA. Advisory on Volt Typhoon activity in US critical infrastructure, 2023.