Healthcare Cybersecurity

DetectRx is the drug diversion counterpart to Haystack iS, the iatricSystems patient privacy product already indexed here, and is recorded separately under the same product scoping rule. Released in May 2022 by iatricSystems of Ponce Inlet, Florida, a healthcare technology company with more than three decades of integration work behind it, it evaluates dosing activity in near real time using what the company describes plainly as machine learning combined with expert written rules. The signal set is the most clinically interesting in this lane. Alongside the usual medication and reconciliation patterns and off shift or off location behaviour, DetectRx analyses patient pain scores. That is a genuinely different idea from anything else graded here. Every other product in this category reasons about the diverter; pain scores reason about the patient left behind, on the logic that a withheld dose shows up as pain that never resolves. Nobody else in this lane names it. The product draws from three system classes, the electronic health record, automated dispensing cabinets and timekeeping, and presents events risk ranked in a management dashboard. The second distinctive component is AVA, the Advanced Virtual Assistant shared with the privacy product. AVA triggers alerts, requests information and tracks responses against predefined parameters, and the company states the product responds automatically according to customised settings. In the sibling privacy record, AVA is documented as initiating a questionnaire directly with the user whose access was flagged, before a human has reviewed the case. Whether DetectRx does the same to a clinician suspected of drug theft is not stated in any published material located here, and it is the single most consequential open question about this product. The two situations are not equivalent. Being asked to explain a record you opened is an inconvenience; being contacted by an automated system about suspected controlled substance theft, before any person has looked at the case, is something else. The deployment evidence is named and checkable. Renown Health in northern Nevada implemented DetectRx in 2024, with its director of accreditation and regulation and its vice president of quality and patient safety both quoted, and reports moving from five risk factors monitored through manual monthly reports to twenty four monitored through the product. Peterson Health is named through its director of pharmacy. Worth reading carefully: twenty four risk factors is a measure of how much is now watched, not of how much was caught, and no detection rate, accuracy figure or case outcome has been published.

Imprivata Drug Diversion Intelligence, sold as DDI and previously carrying the Imprivata FairWarning name, is the diversion monitoring counterpart to the Patient Privacy Intelligence product already indexed here. It is recorded separately under the same product scoping rule that governs that entry: Imprivata's wider business is healthcare identity and access management, which would not qualify on AI centrality, and this record covers the diversion product specifically. Both products descend from the FairWarning and Maize Analytics acquisitions and now sit inside the Imprivata Digital Identity Framework under access compliance. The product monitors the controlled substance lifecycle from prescription through dispensing, preparation, administration, waste and removal, using machine learning to establish baseline behaviour for medication access and flag deviation from it, including peer comparison and out of hours activity. It ships more than 250 report types for compliance and audit, an investigation platform, and an optional monitoring services team. It has been sold in the United States for years and became available in Canada in March 2023. One named technical capability is unlike anything else in this lane. OneRx is described as AI assisted technology that standardises medication names across disparate source systems. Inconsistent drug naming between the electronic health record, the dispensing cabinet and the pharmacy system is a mundane and genuinely destructive problem for this category, because a reconciliation engine cannot match what it cannot recognise, and this is the only vendor here that names the problem and ships something specific at it rather than treating clean input as a given. The security and privacy position is the strongest in this lane. Imprivata holds ISO 27001 and ISO 27701 certifications issued by A LIGN, maintains a public trust and security page, and states a SOC 2 attestation alongside HIPAA governance. ISO 27701 is the privacy information management standard and is rare across this entire index, which matters for a product whose subject is the behaviour of named staff. Two things a buyer should confirm rather than assume: the certification announcement cites the 2013 revision of ISO 27001, which has since been superseded, so the transition to the current revision should be verified, and the published scope is described at company level without enumerating which products fall inside it. The weakness is evidence. No outcome study, accuracy figure or named customer result was located. The only checkable third party measure found is a KLAS assessment reported in 2022 that scored Imprivata 70.1 in drug diversion monitoring, the lowest of the four vendors covered in that report and flagged there as resting on limited data. That figure is four years old and should not be treated as current, but nothing published since replaces it.

ANiGENT sells one thing, drug diversion detection, through one platform called MAAP Analytics, short for Medication Administration and Analysis Program. It was established in 2019 in St. Louis to commercialise software that had already run for years inside a hospital, and launched publicly in March 2020 as a venture between DYNALABS, an analytical laboratory testing business, and Mayo Clinic. Omnicell acquired the company in October 2025. The brand, the site and the product name all remain in use, with ANiGENT's own material describing it as now part of Omnicell, so it is indexed here under its own name with the parent recorded, and the separate Omnicell record covers the dispensing estate. The platform is built from modules: AUDITOR for reconciliation, Waste Reconciliation and Assay, Peer to Peer Behavioral Analysis, and INSIGHTS, with dashboards delivered through Microsoft Power BI. The company describes the method as a blend of applied human logic and advanced machine learning drawing on five data sources, which is a more honest formulation than most in this lane, since it concedes that rules do part of the work. Its stated technical differentiator is breadth of process modelling: where competitors track a one to one relationship between dispense and administration, MAAP claims to chart more than 300,000 combinations of how a medication can be handled in a hospital, which is what allows it to separate a practice error from a theft. The DYNALABS parentage produces a capability nothing else in this category has. Waste Reconciliation and Assay pairs software surveillance with actual laboratory testing of returned waste, so a hospital can establish whether the substance in the container was the drug it was recorded as. Every other vendor here reasons from transaction records alone about a physical event they cannot observe. Two claims need to be read carefully and both are the company's own. The first is that MAAP Analytics 3.0 enables near 100 percent accuracy in identifying the true cause of a variance, described as the first product in the market to do so, with no definition of accuracy, no population and no method given. The second is more consequential: the Peer to Peer module is said to predict, within minutes, which specific users will divert medications at particular locations and times. That is a claim to identify named employees before they have done anything, and nothing published describes what a customer is expected to do with such a prediction, what threshold produces it, or what protects the person it names. The evidence base is a five year benchmark study at Mayo Clinic Arizona, reporting practice inefficiencies reduced to under one percent and more than $3 million recouped over five years, with more than 80 facilities on the platform as of 2022. That study is the flagship validation and Mayo Clinic co founded the company, so it is a related party evaluation and should be weighed as one. It also measures revenue recapture and practice efficiency rather than diversion detection accuracy, which is a different question from the one the product is sold on.

Sentri7 Drug Diversion is the diversion detection module of Wolters Kluwer Health's Sentri7 clinical surveillance platform. Wolters Kluwer is a global information and software business reporting revenues of 5.9 billion euros for 2024 across healthcare, tax, accounting, legal and corporate compliance, far too broad to grade on these axes, so this record covers the product and notes the parent. The index already applies the same treatment to UpToDate. The technology is the former Flowlytics platform, built by Invistics of Atlanta and acquired by Wolters Kluwer Health in June 2023 into its Clinical Surveillance, Compliance and Data Solutions unit. The Invistics brand was retired on absorption and is not separately indexed. Sibling modules on the same platform cover pharmacy surveillance and infection control, which took Best in KLAS rankings announced in February 2026, and those awards belong to the siblings rather than to the diversion module graded here. What distinguishes this record is that the central claim has been tested and published. A study in the American Journal of Health-System Pharmacy, funded by the National Institutes of Health, evaluated the software across ten acute care inpatient hospitals in four health systems, covering more than 20,000 clinicians and over 25 million medication movement transactions. It reported detection of all 22 known diversion incidents, accuracy of 96.3 percent, specificity of 95.9 percent and sensitivity of 96.6 percent, and detection of known cases a mean of 160 days and a median of 74 days earlier than the incumbent methods. Two qualifications belong with those figures. The study evaluates the vendor's own product, so a reader should check the authorship and funding declarations rather than take independence for granted. And it was conducted on the software as Invistics ran it, before the acquisition and before whatever has changed since. The product reconciles transactions across more than seven named data sources, including the electronic health record, automated dispensing cabinets, CII Safe, the narcotics vault, reverse distributors, retail pharmacy systems, wholesaler systems and the employee time clock, and weighs more than 60 determinants of risk. It covers non controlled medications as well as controlled ones, which most of this category does not, and spans pharmacy, nursing, anaesthesia and the supply chain either side of the hospital. The shape of this record is unusual and worth stating plainly. On what the model does and how well it works, this is the most transparent vendor in the lane by a wide margin. On how the product is secured, hosted, governed and what recourse exists when it is wrong, it is among the least. Those are the two halves of the same buyer's question and only one of them has been answered.

Forescout Medical Device Security is indexed as a product rather than as a company, following the ruling applied to Vscan Air and Optum Integrity One. Forescout is a general enterprise security business serving government, financial services and industrial operators alongside healthcare, and it would fail the horizontal filter as a whole. The healthcare product has its own lineage and is assessed on its own terms. That lineage matters. The product was CyberMDX, a healthcare specific medical device security company acquired by Forescout in 2022, and its material still identifies itself as formerly the CyberMDX Healthcare Security Suite. So this is a dedicated healthcare product absorbed into a horizontal platform rather than a vertical bolted onto one, which is the distinction the horizontal filter is meant to catch. The function is asset intelligence and risk on the clinical network. Agentless discovery finds every connected medical device, including devices behind firewalls and serial gateways that ordinary scanning misses, classifies them automatically into a taxonomy, and assesses each one on known exposures, attack potential and operational criticality. Detection is described in the company's own words as artificial intelligence and rule based, which is an unusually honest construction. Enforcement follows visibility, with per device access policy, smart isolation restricting a device to authorised nodes, and segmentation policies designed from observed communication patterns. Two capabilities distinguish this from general network security and both are healthcare specific. FDA device class and recall status are tracked alongside cyber risk, so a biomedical engineering team sees regulatory and security exposure together. And manufacturer disclosure statement integration brings the standardised medical device security form into the platform, which is the document a hospital technology management team actually works from. A third capability sits outside security entirely. Utilisation dashboards let hospitals monitor device performance, identify anomalies and move equipment between departments, which is a biomedical operations tool built on the same telemetry. Evidence includes Vedere Labs research analysing more than two million devices across 45 healthcare delivery organisations and publishing 162 vulnerabilities in connected medical devices, participation in the KLAS Healthcare IoT Security 2026 report with customers interviewed, and inclusion in the 2025 Gartner market guide for medical device risk management platforms. One thing a reader should weigh, and it is the sharpest finding on this record. The product's naming and its artificial intelligence claim are both unstable. The same marketing sentence appears on Forescout pages describing the platform as combining discovery techniques with AI powered intelligence in one version and with cloud powered intelligence in another, and the product is variously presented as Medical Device Security, part of Forescout Continuum, part of the Forescout 4D Platform and as the Forescout Vistaro platform. A buyer should establish which product they are being sold and what the intelligence in it actually is.

Cynerio secures the connected devices inside hospitals, and it was built for healthcare from the outset rather than adapted to it. Founded in 2017 and based in New York, with Samsung NEXT among its investors, it was acquired by the asset management company Axonius in July 2025 for a reported figure above 100 million dollars and now operates inside that platform. Anyone searching for Cynerio is looking at an Axonius business. The platform has three parts. Network detection and response for healthcare uses deep packet inspection and behavioural anomaly detection to identify threats on clinical networks in real time. Medical device security discovers connected devices automatically, assesses their risk and offers mitigation through micro segmentation and patching. Complete asset visibility maintains a single inventory across information technology, operational technology and connected medical devices with compliance reporting. Two things distinguish it from its peers. In 2021 it released an attack detection and response module that goes beyond inventory to containment, letting a hospital quarantine a device showing malicious behaviour immediately while deferring full remediation until the device is not in use, so that a patient connected to it is not affected. And its patient data security module is data centric rather than device centric: it identifies where electronic protected health information is exposed across clinical systems, maps data flows between devices and external parties, and monitors access patterns. The company co produced research with the Ponemon Institute, surveying leaders at 517 United States health systems, which found that 71 percent rated connected device risk as high or very high while only 21 percent described their protections as mature, and reported that organisations suffering cyberattacks saw increases in bed days, mortality, affected procedures, transfers and complications. That work is now cited in the professional literature on medical device security. It integrates with Microsoft Sentinel, belongs to the Microsoft Intelligent Security Association, and sells through managed security providers as well as directly.

Patient privacy monitoring formed by merging two of the category's established products: FairWarning and Maize Analytics, now sold as Imprivata Patient Privacy Intelligence. Indexed under the product-scoping rule, as with ModMed and Indica Labs. Imprivata's wider business is healthcare identity and access management, which would not qualify on AI centrality; this record covers the privacy monitoring product specifically, where the AI is identifiable and gradeable. Corporate lineage: Maize Analytics was acquired by SecureLink in May 2021, SecureLink by Imprivata, and the two privacy products were then combined. The technical idea inherited from Maize is genuinely distinctive and inverts how this problem is normally approached. Conventional privacy auditing hunts for high-risk behaviour in the access log. Maize's Explanation-Based Auditing System instead tries first to explain each access, matching it against a legitimate clinical or operational reason such as an appointment, an encounter, a diagnosis code or a departmental relationship, then flags only the residue it cannot account for. Filtering out what is explainable leaves a far smaller pool for human review than trying to spot suspicious patterns directly. The approach originated in academic research at the University of Michigan by Daniel Fabbri and Kristen LeFevre, was published and peer reviewed with the original paper reporting explanations for over 94 percent of accesses in a real University of Michigan Health System log, and is patented as US 8745085B2. The company reported automatically auditing up to 99 percent of EMR accesses in production. Architecture scales to between 100,000 and one million accesses per minute using a parallelised database, with multiple instances able to share the workload, and deployment runs in a virtual machine inside the customer environment so data does not leave. Maize was ranked Best in KLAS for patient privacy monitoring in 2021. Imprivata states PPI supports both proactive auditing to surface risk before harm and reactive auditing to investigate incidents and complaints, with three years of archived audit trail storage.

On-device runtime protection embedded inside the medical device itself, which is a fourth distinct approach in this category. Network monitoring vendors watch devices from outside, and manufacturer tooling analyses software before shipment; Sternum hardens the device from within so it defends itself while running, including when disconnected from any network. Founded 2018 in Tel Aviv by a team drawn substantially from IDF Unit 8200. The core technology, patented EIV or Embedded Integrity Verification, uses binary instrumentation to place security checkpoints inside the device's compiled code, verifying the integrity of the execution flow, meaning the order in which code runs, and of dynamic memory. The underlying insight is elegant and worth understanding: whatever the vulnerability and whatever the malware, an attacker must ultimately divert the device's intended execution flow to run malicious code, so preventing that diversion blocks the attack without needing to know which specific flaw was exploited. That is why the company can claim protection against unknown and zero-day vulnerabilities and against software supply chain threats in third-party libraries, which matter enormously here because medical device firmware leans heavily on components the manufacturer did not write. Overhead is reported at 1 to 3 percent latency and roughly 10 percent code footprint. Operating at bytecode level makes it broadly compatible across RTOS and embedded Linux environments including Zephyr, FreeRTOS, VxWorks, Micrium and OpenWrt, and it works on legacy devices. Sternum became the Zephyr Project's first embedded runtime security partner under the Linux Foundation. A second capability layer provides fleet observability with AI-driven anomaly detection, log management, remote debugging and root cause analysis, feeding into SOC, SIEM or SOAR tooling. The company positions this explicitly against the patching problem the FBI has highlighted for unpatched medical devices, since runtime prevention reduces dependence on field patching that is slow, costly and sometimes impossible on deployed clinical equipment.

Product security platform for connected device manufacturers, spanning medical devices and automotive. The defining capability is binary-first analysis, and it addresses a problem MedCrypt's approach does not. Most SBOM tooling starts from an SBOM the manufacturer supplies or a supplier provides, which assumes that document is accurate and complete. Finite State derives the inventory from the shipped artifact itself: it automatically unpacks over 130 binary formats across 30-plus architectures, with support cited elsewhere for 50-plus binary instruction set architectures, revealing file systems, libraries and components even inside encrypted or proprietary firmware without requiring source code access. That matters because device manufacturers frequently cannot obtain source for third-party and off-the-shelf components, which is precisely where unknown risk accumulates. Binary software composition analysis extracts function names, control flow graphs and symbols directly from compiled binaries, and binary static application security testing analyses decompiled code for unsafe function calls that could enable denial of service, privilege escalation or full system takeover. The second differentiator is reachability analysis: the platform evaluates call graphs and entry points to determine whether a vulnerable code path can actually be executed at runtime, reported to reduce false positives by up to 80 percent and cut noise by up to 90 percent. The regulatory payoff is concrete rather than theoretical, because unreachable vulnerabilities can be documented as defensible not-affected justifications in audit-ready VEX documents rather than remediated unnecessarily. Generates, imports and enriches SBOMs in SPDX, CycloneDX and VEX formats, ingesting from a reported 120-plus external sources, and maps findings automatically to FDA Section 524B and IEC 62304, extending to the EU Cyber Resilience Act. Offers Health-ISAC members free SBOM generation and firmware risk assessment for three products. Indexed alongside MedCrypt, its closest comparator in the device manufacturer sub-lane.

Patient privacy monitoring from iatricSystems, a healthcare IT company with more than 35 years of integration experience and a reported track record across 1,300 or more hospitals. Haystack iS, formerly Security Audit Manager, consolidates PHI access activity from the EHR, HR systems and hundreds of third-party applications into a single platform so privacy teams monitor, investigate and document in one place rather than running separate audit reports per system. Version 2 launched March 2026, rebuilt rather than incrementally updated, adding customisable dashboards, deeper drill-down into events and investigations, and the ability for privacy teams to adjust event weights themselves so risk scoring aligns with their own policies and risk tolerance rather than a vendor-fixed model. Two named AI components, and the distinction matters. Solomon is the detection engine, evaluating multiple signals rather than a single data point and learning what normal looks like within each organisation including differences by role, department, shift and workflow. AVA, an Advanced Virtual Assistant, automates the follow-up: when potentially inappropriate access is detected it initiates a questionnaire directly with the user, collects the response and returns the context to the privacy team, so auditors spend time on decisions rather than manual outreach. That auto-outreach capability is unique among indexed privacy vendors and deserves scrutiny as well as credit, since the system contacts a suspected employee before a human has reviewed the case. Integration breadth is the standout: named EHR support spans Epic, Cerner, MEDITECH, Allscripts, athenahealth and Quadramed among more than 180 vendors, plus document management systems including Hyland and Perceptive, clinical systems across PACS, pharmacy, lab and radiology, and HR platforms including Workday, PeopleSoft, ADP, Kronos and Active Directory, with an open standard audit file import specification that works with virtually any system generating an audit file. Named customers include Renown Health and WVU Medicine, which runs 23 hospitals and has partnered with the company for over 14 years.

Cyber exposure management platform covering the full cyber-physical systems landscape, with medical device security as one of five products within Armis Centrix alongside Asset Management, OT/IoT Security, ViPR Pro for vulnerability prioritisation and remediation, and Early Warning. The platform correlates device context, behavioural anomalies, vulnerability intelligence, business impact and exposure pathways into a unified risk model, prioritising remediation by real-world operational risk rather than treating findings in isolation. Named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms for the second consecutive year, one of 13 vendors evaluated, and recognised in the companion Critical Capabilities report, with 119 Gartner Peer Insights reviews in that category rating 4.7 out of 5 as of March 2026. Offers on-premise, cloud and hybrid deployment. Two things a reader must weigh, both stated plainly by the company. First, this is a horizontal platform, not a healthcare specialist: it serves manufacturing, energy, critical infrastructure and government alongside healthcare, and medical device security is one product line rather than the business. It is indexed on the same basis as Claroty, whose Medigate-derived healthcare capability sits inside a broader industrial security platform. Buyers should compare it against healthcare-only vendors such as Cylera and Asimily on depth of clinical device intelligence rather than on platform breadth, and independent Gartner Peer Insights commentary notes that while asset visibility is strong, some users find OT and CPS protocol depth less than top tier. Second, independence is ending: Armis has announced a planned acquisition by ServiceNow expected to complete in the second half of 2026. The company states it will continue operating with the same mission and innovation strategy under ServiceNow investment. That should be treated as a forward-looking statement rather than a settled outcome, and buyers signing multi-year agreements should establish what contractual continuity exists. The pattern is worth watching: an independent exposure management platform absorbed by an enterprise workflow vendor raises the same question as diagnostics manufacturers acquiring open algorithm platforms.

Medication intelligence platform whose ControlCheck product, formerly Bluesight for Controlled Substances, is the market share leader in drug diversion detection. Founded 2011 as Kit Check, rebranded to Bluesight in December 2022, based in Alexandria, Virginia, led by co founder and chief executive Kevin MacDonald and backed by Thoma Bravo. The diversion product connects data from automated dispensing cabinets, electronic medical records and other systems to deliver a 100 percent audit of dispense, administration, waste and return records for controlled substances, flagging discrepancies for review so pharmacy staff investigate real issues rather than manually reconciling records. The stated technical approach is notably specific: unsupervised machine learning with continuous learning, identifying anomalous patterns in clinician behaviour. The company's own explanation of why is the clearest articulation of the AI necessity argument in this category, and it is candid about what it replaces: simple statistics such as standard deviations and averages have proven inadequate against diverters who have become adept at covering their tracks, because diversion patterns are often visible only when many variables are compared simultaneously and evaluated against other patterns. Reported Best in KLAS three years running, with more than 100 million medication transactions tracked and over 1,000 US and Canadian hospitals using Bluesight solutions. Deployment is deliberately low friction: the platform runs on a HIPAA-compliant cloud, leverages existing reports and multiple data delivery options rather than requiring complex integrations, and one health system implemented across 10 hospitals in a reported 33 days with minimal IT involvement. Updated 29 August 2026. The company has grown substantially by acquisition and has folded each acquired brand into its own product line rather than operating it as a standing brand: Medacist in 2023, Sectyr in 2024, and Protenus in January 2025. The patient privacy monitoring product now sold as PrivacyPro is the former Protenus platform, and Bluesight's own announcements refer to it as previously Protenus. In the 2025 Best in KLAS report ControlCheck scored 86.1 in the drug diversion monitoring category and the patient privacy product scored 94.3, among the highest scores recorded in that ranking. The suite now runs to six products: ControlCheck, PrivacyPro, KitCheck for radio frequency identification kit and tray inventory, CostCheck for drug spend, 340BCheck for covered entity compliance which was rebuilt on Sectyr technology and relaunched in April 2026 with a 100 percent transaction audit, and ShortageCheck for shortage forecasting. Prism Assistant, the first product on a new artificial intelligence platform, arrived in 2026 and carries no located governance or model disclosure. Indexed in cybersecurity for the diversion and privacy products specifically, applying the product-scoping rule: the inventory, spend and 340B products are pharmacy operations tools rather than security. Medication safety and prescribing is carried as a secondary category because ControlCheck is a direct comparator to the diversion analytics sold inside the BD Pyxis and Omnicell dispensing estates, and a buyer comparing those three should find all of them.

Healthcare IoT security platform, MedCommand, built exclusively for hospitals rather than adapted from a general IoT product, covering connected medical devices, operational technology and traditional IoT. The technical differentiator is genuinely novel and resolves the central constraint of this category. Medical devices are fragile and cannot be actively scanned while in clinical use, because a vulnerability scan can take a device out of service mid-treatment, which is why every competitor relies on passive network monitoring. Passive observation, however, cannot rigorously test for vulnerabilities, only infer them from observed traffic. Cylera's patented Digital Twin approach resolves that tension: it uses network traffic emulation to construct a virtual replica of each medical device, learning its behaviour agentlessly, and then probes the twin rather than the live device, enabling out-of-band vulnerability detection without ever touching equipment attached to a patient. Machine learning continuously updates the device and vulnerability knowledge base from multiple sources. The platform also automatically identifies zero-day devices and zero-day protocols, meaning previously unknown equipment appearing on the network is flagged proactively rather than sitting unclassified. Capabilities span asset discovery and real-time inventory across managed and unmanaged devices, vulnerability and risk assessment, segmentation, threat detection, and notably device utilisation and fleet optimisation analytics, which serve biomedical engineering and finance rather than security alone. Targets providers with 150 or more beds and multi-facility networks, unified through a central management console. Integrates with Cisco ISE and TrustSec for segmentation enforcement, with the integration maintained in the standard platform at no additional cost or consulting hours. A UK deployment at Dartford and Gravesham NHS Trust pairs Cylera with The AbedGraham Group's clinical risk analysis platform to quantify device risk in terms of patient safety and clinical service impact rather than technical severity alone.

Acquisition update, 29 August 2026. Protenus was acquired by Bluesight on 9 January 2025 and no longer trades under its own name. Bluesight's own announcements describe its patient privacy monitoring solution as previously Protenus, and the product is now sold as PrivacyPro within the Bluesight suite. Under the index rule on acquired vendors this record is retained with the acquisition documented, so that a buyer searching for Protenus finds out what happened to it, and the live vendor record is Bluesight. The grades below describe the platform as researched under the Protenus name and were last assessed on 26 July 2026. The description that follows is retained from that assessment. Healthcare compliance analytics addressing the insider threat rather than the external one, which makes it structurally different from every device security vendor in this category. Two products share one platform and one underlying insight. Patient Privacy Monitoring detects inappropriate access to electronic medical records, and Drug Diversion Surveillance detects theft of controlled substances by staff. The company's founding observation is the reason AI is necessary here rather than decorative: health systems were reviewing only a tiny fraction of patient access logs and similarly tiny samples of controlled substance transactions, because manual audit cannot scale to the volume, which left the overwhelming majority of accesses unexamined. Protenus monitors 100 percent of system accesses and audits 100 percent of medication use transactions. The technical approach is behavioural profiling on both sides of an access event: the platform ingests EHR, HR and automated dispensing cabinet data, builds profiles of patients using demographics, appointment information and procedure and diagnosis histories, and separately builds profiles of the users accessing those records and controlled substances, then reasons about whether a given access was appropriate. The company describes the same platform being trained with different intelligence for the two use cases, since privacy violations and diversion are both workflow anomaly problems. Founded 2014 in Baltimore by CEO Nick Culbertson. Awarded Best in KLAS in 2023 for both patient privacy monitoring and drug diversion surveillance, and named a Gartner Cool Vendor in Healthcare Artificial Intelligence. Holds patents on the diversion technology including US Patent 11,621,065, Methods and Systems for Analyzing Accessing of Drug Dispensing Systems. Reported customer outcomes include 70 percent time savings in case review and an 86 percent decrease in case resolution time. Runs on US-based AWS infrastructure.

Cybersecurity for medical device manufacturers rather than for hospitals, which makes this the only vendor in the index addressing the upstream half of the connected device problem. Where Claroty, Asimily and Ordr help health systems secure devices already deployed on their networks, MedCrypt helps the companies building those devices meet regulatory security obligations before and after market. The regulatory context is what makes this a real category rather than a niche: FDA cybersecurity expectations moved from guidance to enforceable statutory mandate under Section 524B of the Food, Drug and Cosmetics Act via the PATCH Act, with requirements fully effective from October 2023 and a Refuse to Accept policy meaning inadequate cybersecurity documentation can block a submission outright. Manufacturers must submit a Software Bill of Materials, identify known vulnerabilities including those in CISA's Known Exploited Vulnerabilities Catalog, provide safety and security risk assessments per vulnerability, and maintain postmarket monitoring for the life of the device. The flagship product Helm manages SBOM generation, validation and vulnerability tracking across a device portfolio, and its central function is determining which vulnerabilities are actually relevant to a given device rather than listing every CVE matching a component. It draws exploitability intelligence from EPSS, CISA KEV, ExploitDB, Metasploit, NVD and CWE Top 25, applies AI to detect which technology stacks a vulnerability affects in order to suppress false positives, generates short-term mitigations and upgrade paths, and produces FDA-ready SBOM, VEX and VDR reports. Auto-rescoring tracks changes in exploitability and fixability over time. The wider portfolio covers cryptography and device monitoring supporting FDA Secure Product Development Framework implementation. The company publishes substantial regulatory analysis, including work on 2026 FDA premarket deficiency trends, and states it collaborates with regulatory bodies on standards.

Connected device security platform whose distinguishing claim is closing the gap between identifying risk and acting on it, which is the specific failure mode in this category: segmentation projects rarely fail because they lack value, they stall because teams do not trust their asset data enough to enforce policy. Ordr addresses that by generating segmentation policies from observed device behaviour rather than manual templates, simulating enforcement impact before deployment so the blast radius is visible, and validating policies against real traffic patterns. Discovery is passive and agentless, using behavioural fingerprinting the company states is trained on more than 100 million real-world devices and on proprietary device languages from thousands of manufacturers, producing inventory with device make, model, firmware, operating system, clinical function, owner, location and software versions. Risk is prioritised by operational and patient impact rather than CVSS severity alone, correlating CVEs, manufacturer advisories, clinical criticality and network exposure without active scanning. Behavioural monitoring runs continuously to detect anomalies, malware indicators and unauthorised connections, which matters most for legacy and unmanaged clinical devices that cannot run security agents at all. The platform reports protecting nearly two million connected devices, trust from more than 500 organisations across healthcare, banking and manufacturing, and named healthcare deployments including Dayton Children's Hospital and Freeman Health System. Initial discovery is stated to complete within 48 to 72 hours. Ordr IQ is a natural language orchestration layer letting non-technical staff query asset intelligence. Compliance evidence collection aligns to NIST, CIS, HIPAA and PCI. Note on sources: Ordr publishes its own comparative rankings of IoMT security platforms using a proprietary ranking algorithm, in which it places itself among the leaders. That content is factually useful on competitors but is self-interested, and this record relies on it only for the company's own product claims.

Healthcare cyber risk management operating on a fundamentally different model from the device security vendors that dominate this category: Censinet RiskOps is a cloud-based risk exchange where healthcare organisations and vendors share assessment data collaboratively, so the asset compounds with network participation rather than being rebuilt by each customer. Boston based, founded by CEO Ed Gaudet, and an American Hospital Association Preferred Cybersecurity Provider. The scope is third-party and enterprise risk rather than connected devices: assessing the vendors, products and services a health system depends on, spanning medical devices, cloud software, robotics and consulting, with assessments flowing into structured remediation workflows and continuous oversight rather than point-in-time reviews. Reported reach exceeds 1,000 healthcare organisations across a network of over 50,000 vendors and products. Delivery is flexible between fully self-operated, co-managed risk management services, and the on-demand Censinet One model. The 2026 direction is the interesting part for this index. At ViVE 2026 the company set out a Censinet GRC AI vision extending from third-party risk into an AI-native governance, risk and compliance platform, and launched capabilities operationalising the HSCC Sector Mapping and Risk Toolkit framework, mapping vendors to the 17 critical functions underpinning healthcare delivery, with a healthcare-specific FICO-style inherent risk score from 300 to 850, concentration risk and chokepoint visibility to expose systemic dependencies, and network-powered intelligence drawn from the exchange. It also announced AI Telemetry, providing continuous evidence-based visibility into a health system's AI exposure across its third-party ecosystem rather than a point-in-time snapshot. That last capability is notable in context: this is a vendor whose product is partly governance of the AI its customers buy, which makes it structurally adjacent to what this index does. The Change Healthcare attack is the reference case the company cites for systemic concentration risk.

Exposure management platform for connected device environments spanning IoMT, IoT, OT and IT, with healthcare delivery organisations as its founding and strongest vertical. Founded 2017, headquartered in Sunnyvale. The defining capability is contextual vulnerability prioritisation rather than discovery alone, which addresses the problem that actually defeats hospital security teams: a large hospital may run 10,000 to 25,000 connected medical devices representing 30 to 40 percent of all networked endpoints, and a raw vulnerability list across that fleet is unusable. Asimily evaluates each vulnerability in the context of the specific device's configuration and network environment, and prioritises by likelihood of exploitation and clinical or business impact, so remediation effort goes where risk is real. The company states this is necessary because IoT and IoMT devices exhibit network behaviour unlike conventional IT endpoints, leaving general purpose security tools unable to distinguish genuine risk from false alarms. The platform maintains an extensive knowledge base of connected and standalone medical devices, protocols, vulnerability research and manufacturer capability documents, and extends beyond assessment into orchestrated segmentation and risk mitigation, plus pre-purchase device evaluation so risk can be assessed before procurement. Ranked first in the KLAS 2026 Healthcare IoT Security report with a score of 96.6. Also ranked 13th fastest-growing cybersecurity company on the 2023 Deloitte Technology Fast 500 on reported 773 percent revenue growth, and selected for the US Department of Energy Clean Energy Cybersecurity Accelerator. Integrates with CMMS platforms including MediMizer bidirectionally, enriching its machine learning with medical device context while feeding security incidents into maintenance remediation workflows.

Healthcare cybersecurity platform, delivered as Medigate by Claroty (also positioned as Claroty xDome for Healthcare). Purpose built to discover, profile, and protect connected medical devices (IoMT), IoT, and building management systems on hospital networks, using passive deep packet inspection and light active techniques across a reported 500+ device protocols, with an Advanced Anomaly Threat Detection module that adds clinical context to prioritize threats. Protects a reported 20 million plus devices across 2,000+ hospital facilities and has been named Best in KLAS for Healthcare IoT Security multiple years. Claroty acquired Medigate in 2022.