Asimily

Models rank and classify inside a platform with other value. Asimily says it analyzes each vulnerability with patented AI and ML alongside its Asimily Labs researchers, cross-referencing EPSS, SBOMs, CVE lists, MITRE ATT&CK and NIST guidance against each device's configuration and network context, and it feeds device telemetry into behavioral modeling for classification and anomaly detection. Inventory, recall tracking, pre-purchase lookups, configuration control, patching and segmentation through existing NAC and firewalls would still stand without the models.

Changes are simulated before they are applied, and the approval rule is not published. Segmentation Orchestration generates policies that are enforced through the hospital's own NAC and firewalls, and the company offers a risk simulator that shows the effect of a mitigation before it is taken; administrators can quarantine a device through the NAC. Nothing states which actions run automatically and which wait for approval, or what happens after a wrong quarantine.

The approach is named without models or versions. Asimily describes a patented prioritization algorithm that cross-references EPSS, SBOMs, CVE lists, MITRE ATT&CK and NIST guidance against device context, behavioral modeling of device telemetry, and discovery that combines passive and active scanning with device profiles. No model, version, update practice or accuracy figure is published.

A short chain built in house, with hosts named and no subprocessor list. The prioritization algorithm and behavioral models are Asimily's own, with no outside model provider mentioned, and the product security page names Google Cloud as host, AWS and Oracle Cloud for non-US regions, and says PII and ePHI stay at the Edge. Vendors are risk assessed, but no subprocessor list is published.

Named customers and vendor figures without method. MemorialCare, Methodist Le Bonheur Healthcare and Tufts Medicine are quoted, MemorialCare reporting 98 percent NIST compliance against a 71 percent average for 60 similar organizations; an unnamed 15-site hospital network reports 98 against 56 percent. The home page claims more than 10,000 high-risk vulnerabilities removed in three months. KLAS rated Asimily first in its 2026 Healthcare IoT Security report at 96.6, a satisfaction measure. None of these carries a method or date.

Categorical commitments, with training use unstated. The product security page says neither PII nor ePHI is transmitted out of the on-site Edge appliance, data processed at the Edge is not written to disk, in-memory data is deleted after processing, cloud data stays in the country of origin, nothing is shared with third parties without customer authorization, and each customer runs on dedicated instances. Nothing says whether customer telemetry trains Asimily's models, and no retention period is published.

The product is scoped out of PHI in plain terms, without an agreement published. The product security page says PII and ePHI never leave the Edge appliance and that what reaches Asimily is technical data such as addresses and device classifications, with an on-premises deployment for organizations that want nothing in the cloud; the HIPAA page explains how the platform supports a covered entity's Security Rule work. The privacy policy covers the website only, and no business associate agreement or statement of status is published.

A recognized attestation is named, with the report on request. The product security page states SOC 2 Type II and C5 compliance, with the SOC 2 report available by email to security@asimily.com, and describes controls in detail: TLS 1.3, ChaCha20-Poly1305 from Edge to server, single-tenant cloud instances, geo-fencing, OWASP practice with static and dynamic analysis, Tenable scanning, internal and external penetration testing and verified builds. There is no trust center or ISO certificate.

The company engages the device regime its customers live under, without stating its own position. The FDA page parses FDA and manufacturer recall notices into assignable work matched to devices, and discusses the 2023 medical device cybersecurity requirements; ProSecure draws on manufacturer MDS2 statements and SBOMs before purchase. The platform makes no device claim, but no page states Asimily's own regulatory position.

Methods are named and nothing evaluates them. The prioritization algorithm is described as patented and grounded in MITRE ATT&CK, EPSS and in-house research, and changes can be simulated before they are made. No governance framework, accuracy figure for prioritization or classification, or statement on whether one customer's device data informs models used for others is published.

The mechanism is visible and nothing measures or backs it. Risk is ranked by likelihood of exploitation in each device's configuration and network rather than by raw severity, and recommended mitigations come with the ranking. The home page says customers typically remove more than 10,000 high-risk vulnerabilities in their first three months, with no method or denominator. No error rate, warranty, indemnity or remediation commitment is published, and the ranking logic is not auditable by the customer.

It does not connect to the clinical record; its integrations are with the hospital's security and clinical engineering systems, named without production evidence. The integrations page describes two-way sync with CMMS and CMDB systems, automatic work orders for anomalies and vulnerabilities, NAC-driven segmentation, SIEM syslog export, vulnerability scanner, DHCP and IPAM, IAM and RTLS feeds, and shows Accruent, TRIMEDX, TruAsset, Cisco, Palo Alto Networks, CrowdStrike, Arista and Axonius. No named hospital is shown running a two-way CMMS sync.

Options, residency and isolation are documented, with one border question in the text. Asimily runs as cloud (Google Cloud in the US, AWS or Oracle Cloud for other regions) or fully on premises, with an on-site Edge appliance either way; each cloud customer gets its own server instances in its country of origin, with no multi-tenancy, and data access is geo-fenced. The same page says daily server snapshots are stored in the US multi-region, which a customer outside the United States should reconcile with the country-of-origin statement.

No price is published, and the sales route is discoverable. The platform is sold through demos and channel partners, with ProSecure pre-purchase lookups and the CMMS integrations as named capabilities. No unit of charge or tier is published.

Healthcare settings are named and supported by named sites. Asimily covers medical devices, IoT, building and OT systems and IT endpoints in hospitals and health systems, with hospital-specific functions (FDA recall matching, pre-purchase device risk lookups, device utilization), named customers MemorialCare, Methodist Le Bonheur Healthcare and Tufts Medicine, and a KLAS evaluation of health system users; it also sells to manufacturing, energy, finance and other sectors.