Name: Register Now
Uploaded: 2025-10-02T14:16:07.862Z
Duration: 1 h 1 min 56 s
Description: Register Now

Transcript for "Register Now": We'll just give it a couple of seconds for people to join. Okay. And I think we're, good to get started. Thank you everyone for taking the time to join this webinar by Fortinet, Armis, and Roche, from intake to discharge, holistic health care cybersecurity for IOMP, OT, IT, and beyond, where we plan to discuss the holistic attack surface and strategies to secure your health care delivery organization. Now just to give a quick overview in terms of what the agenda is for today, we wanted to start off by giving an overview on the expanding attack surface of a health care organization. A lot of little nuances that sometimes get overlooked when we're thinking about cyber cybersecurity in a health care environment, but also dive into what the threat landscape and actual attacks look like, as attackers continue to exploit health care, one of the most targeted, industries across the globe. And what we're seeing, of course, is an increasing regulatory pressure in the EMEA region, really driving organizations for compliance and what this means for your, attack surface. We'll double click on a case study with we have our guests and friends from Roche online, and then we'll go through some strategic takeaways for your organization to help you get started on this track and implement, implement strategies tomorrow. So actionable takeaways at the end of this. I wanted to introduce our esteemed panel here. So myself, I'm, Mohammed Waqas. I'm the CTO of health care for Armis. I'm also joined by Antoine, d'Haussy, OT security practice head for EMEA from Fortinet, Geri Révay, principal security researcher from FortiGuard Labs from Fortinet as well, and, of course, Olivier Convard, the global CISO for Roche Diagnostics. So I'll kick things off, and I wanted to paint a little bit of a picture for what a hybrid nature of health care environment really looks like. And I like to talk about it as health care being one of the most diverse asset ecosystems across any industry, really. So if we were to think about the patient journey to start off with. Right? When a patient enters and goes through that care cycle, we often think about the admissions, the diagnosis, how are they entering the hospital, they're getting registered into, the EMR system. They'll be doing, maybe logging into some type of a patient portal, interacting with medical devices, whether it's, an infusion pump or some type of laboratory equipment doing blood tests, really that diagnosis phase. And then, of course, the treatment. As I mentioned, there might be bedside monitors, infusion pumps. There might be some, medication dispensing systems involved in there as well. And then if all goes well, then it's to the discharge phase with discharge phase with, you know, e prescribing some additional take home medication and things of that nature. So I think this is a flow that a lot of folks, think about when we are thinking about healthcare processes and the patient journey. But what can get overlooked a lot of times is all the underpinning care enabling services. And what I mean by that is when you are arriving to the hospital, a lot of HDOs and healthcare delivery organizations may overlook those parking gates and those automated doors and those elevators that are so crucial to getting the patient to where they need to get to for getting care. If the elevators are down, if the doors don't open, well, that patient isn't getting access to the care that they need. But also, things that impact patient flow. So think about digital signage is to be able to get to the surgery if they're delayed from that or even during care. One of the things that I love talking about are the OT systems such as HVAC units. Right? So think about an operating environment, operating room where that AC and that humidity regulator is so critical to patient care. If that goes down and humidity levels rise, you're looking at canceled surgeries. So direct patient care impact from a nonmedical device, similar to treating tuberculosis, the airflow regulation that's required in a ward without which treatments treatments get compromised and in fact, it can lead to a, an infection outbreak on the unit. So really painting that picture of how critical not only medical devices are or cloud infrastructure or server infrastructure that host EMRs, but also to plant that seed for this, webinar that the OT devices, the building management systems are so critical as well. And so with that, just that overarching picture where when we're looking at the overall facility, think of HVAC systems, think of building managed systems, think of your badge readers, your all your hospital and, patient registration apps, your cloud infrastructure, digital signage, of course, your Wi Fi access points, your VoIP phones, nurse call systems, of course, your medical, systems as well. Just to give an idea on how expansive the attack surface is that attackers are targeting, exploiting, and that poses a challenge for health care security, teams to have to protect. Alright. Then I will continue with the threat landscape. Next slide, please. So first, let's start with some numbers. So health care is the most targeted critical infrastructure industry, you know, based on multiple research. 90% of health care organizations experienced some kind of, cyberattacks in the last, in the past year, and, 99% of hospitals have some kind of OT, IOMT device that has, a known exploitable, vulnerability. So that's a that's a pretty significant thing. On the vulnerability front, the German BSI also did the research a few years ago on medical devices, and they also found 150, at the time, unknown vulnerabilities on those. So vulnerabilities in device is definitely a problem, especially with legacy devices because it's really hard to really hard to patch them, and it's really hard to, get around, the problem. And one we are gonna talk a little bit about ransomware. So just to start it off, ransomware downtime averages around eighteen days, when, healthcare organization is, is compromised. That's also a pretty significant downtime. Next slide, please. Alright. So I already mentioned ransomware, so we go there a little bit more. This is a recent attack. It was a health care provider that was targeted by the Interlock ransomware group, in the 2025, and the impact was pretty significant. It was $13,000,000, in various costs, and 1.5 terabyte, stolen data. Now the the stolen data included basically everything that they know about the patients. So personal data such as, names, date of birth, but also treatment information, insurance, and tax information. So more or less everything. Next slide. And, as I said, this was done by the internal transfer group. They are relatively new. They started, in 2024. They kinda, act like, the Robinhood of ransomware groups. You know, they say that they are relentless collective that exposes directlessness of companies. But, you know, whatever they say, they're still a criminal organization, you know, with, with financial goals. And, if you see somewhere the dot interlock extension on on a computer, then, then raise the alarms because you have been, infected. And they do, double extortion, which means that, the first extortion, step is to encrypt all your data and, basically, it'll, try to, get you to pay by, you know, selling you the decryption software. But they also steal the data. As I mentioned, it was, in this case, 1.5, terabyte 1.5 terabytes, with the, with the next step of extortion that they threaten that they are gonna leak the data if you don't pay. And, lastly, regarding ransomware, I wanted to clarify a little bit that often I see that, people think in OT that the ransomware is not a huge threat because in OT, the the crown jewel is the operation and not the not the data as it is in IT, and ransomware targets the data. Unfortunately, ransomware is as effective in OT as it is in, in IT, mostly because the operating systems are more or less the same, in both environments. So, you know, your MRI machine might be managed by, by a Windows, machine or your, embedded medical devices run some kind of, Linux operating systems. And in these cases, off the shelf ransomware software will be, will be as effective, against these, devices as, in an IT environment. And, unfortunately, even though that the data might not be significant when it comes to OT and IMT devices, but the availability is. So when the ransomware infects, a computer, even though it can still boot so that you can read the ransom note, but it's not gonna be functional. So, you know, your MRI machine not it's not gonna be able to run because, you know, most of the data will be encrypted, including the software that that should run these, devices. So, so you will experience downtime whether it's because of your data or whether it's because of infection in your OT, which is gonna pressure you, into into paying. So, you know, the the point here is that, ransomware is a huge threat in, in OT environment, in health care as well. Next slide, please. Going to another to other threats, this is a report from from from the Fortinet Recon team, regarding, initial access brokers in health care. So initial access brokers are the groups that are basically selling the keys to kingdoms. So they are they are who break in, but they don't use the access themselves, but they sell it to, other organization who cannot decide whether they will do ransomware or espionage or whatever they they are interested in. And, what we can see here is that, since the second half of, 2024, we have seen 139% increase in initial access brokers selling access to health care organizations, on the dark web. This is if we go back, till 2023, it's still a significant increase. Next slide, please. And, what is it that they sell? So, usually, it's some kind of compromised account, whether to some cloud infrastructure infrastructure or, some, panels that are available, on the Internet. But then there's also corporate VPN, RDP, and, you know, all the other, remote access tool that are available. But in case of health care, compromised accounts is the most, most significant. Next. Yes. So just a quick summary of the threat landscape. So as I mentioned, health care is the most targeted, critical infrastructure industry. And when it comes to threats, initial access brokers are increasingly interested in health care. Ransomware is getting more and more efficient, in health care and in not just in IT, IT, but also in OT environment. And, of course, espionage and Infostealer. Infostealers are mostly because of the, patient data, but these are also serious debts, in, in the health care industry. When it comes to targets, it's IT, OT, and, and, IOMT as well. I think I already mentioned the, the the problem with vulnerabilities. Because of that, I what's important is to, because it's hard to fix these devices, it's important to think about, the defensive the in-depth approach, so to to look into some kind of security architecture, that you can, you can, implement to to protect your environment. Alright? Thanks very much. Back to you, Moh. Great. Thank you. So with that, what I what I wanted to dive into a little bit is with this hybrid attack surface, what does this mean for the different regulations that are that are being passed and enforced? And how do health care organizations, and not only health care organizations, but also medical device manufacturers, what role do they play and how is it that we can help improve and increase that compliance, not only from a scope perspective, but also from how fast organizations can actually audit their environment. So a couple of key themes. Right? Whether you're looking at NIST two, DORA, CAP, you know, previously, you know, DSPT, MDR, which I love because for medical device manufacturers, they're increasingly being brought into the fold. So almost shifting left of medical device security as opposed to all the focus being on HDOs and having them have to secure, medical devices as well, the environments and flat networks, etcetera. It's increasingly with medical device manufacturers baking security in to help healthcare organizations get one step ahead of attackers as well. So really critical and that's why I wanted to include that similar thing with, with GDPR and the data security side of the house. So what are a couple of core, themes across all of them? Well, first and foremost, of course, real time asset visibility. So the idea of inventory being more than simply a list of laptops and servers that you have, but it's also expanding that scope into the unmanaged OT, IoT, the cloud infrastructure, but also software inventory that gets overlooked. So a lot of health organizations, whether it's, in in in house developed applications, whether it's cloud portals and things of that nature, we often have minimized inventory to the hardware enterprise assets, and usually software inventory gets overlooked or our ability to define what our patient critical applications and services, that's what we're these regulations are really, really pushing towards as well. And, of course, the vulnerability and risk management. And the reason I emphasize risk management here is vulnerabilities are one part of that formula, those technical CDEs. But those insecure configurations or the access to those, environments or the fact that, flat networks lead to larger blast radius, this is all different elements of risk management including down to downtime procedures. So from a holistic view, continuous assessment and prioritization of that, and then of course, what are the security controls, whether there's direct patching, whether it's a process, whether it is related to compensating controls. All of these encompass guidance related to that. And something that's, of course, increasing, and I think on everybody's radar now, is supply chain risk management. So third party, risk management, not only when you're purchasing devices, but also think about all the different, vendors that might have access into the network, direct site to site VPN tunnel that were established twenty years ago, that still provide unfiltered, access directly into the environment. Lack of MFA on those types of connections, but, of course, insecure libraries and things of that nature that are embedded into medical devices. A lot of the illness and a lot of the industries are now changing again as we're bringing medical device manufacturers into the fold for that. And, of course, you hope for the best, but prepare prepare for the worst incident response. Not only is it a matter of do you have the appropriate processes to limit downtime and impact, but also increasing regulatory reporting requirements around if there is an in incident experience, including the leakage, of course, of patient data, which brings me to the last and, final point. All of this is centered around the core crux of of health care delivery, giving patients the right access to the right care at the right time. If any of these pillars go down, of course, we're looking at not only an impact for a couple of days, the eighteen days as an example that was just mentioned, but also the months and months of scheduling delays of revenue impact and the cascading effect, essentially. So I just wanted to outline a couple of, quick examples, with NIST two. Right? So I mentioned that asset full risk management, full, asset visibility, the incident response requirements in article 21, asset intelligence threat detection. We're probably really good at enterprise side of the house. We're not so good at the unmanaged side. And a bun a couple of different preambles from '58 59 all around the vulnerability response. But, again, you can see a direct call out to compliance. And the last piece is when we evolved from that level of vulnerability, kind of that CVE focus and we we expand out, you can see that the risk prioritization elements that start to come in are related directly to patient harm, operational disruption, privacy breaches, data integrity, care delay. As I was mentioning those three pillars, all of this, all the different risk and all the different impact start impacting these different areas. With that, Antoine, if you wanna give us some insights on building cyber resiliency. Sure. Thank you, Moe, and welcome, everyone. So we we just heard from from Geri and Moe that cybersecurity must evolve with the threat landscape and the rapid digitization of health care, cyber physical system. Also, our strategy should align with established NGO health care security framework. Ultimately, we must remember that cyber resilience is not a one off project. It's a continuous journey. So we want to have a look at what a comprehensive cyber security program for health care operator could look like. What we're seeing here is basically something that is hybrid in nature, taking into consideration IT, cloud, OT, and IOMT. There are actually many ways to, structure a program. This is one approach. It's inspired by the, SENS Institute, and I like it because it's simple and to the point. The first two steps are shown in red because they are critical and too often overlooked. So first, secure leadership, support, and funding. Not always easy, especially in health care. So use the, for example, the return on security investment model. Use regulatory compliance requirement to make the business case. Next is to build the right team, and the most successful programs bring together people with IT cloud, IONT, and ICS backgrounds or capabilities. Once the team is in place, identify your regulatory obligation and the key cyber risk, then focus on developing your standard operating procedures or the SOPs and embedding best practices such as zero trust, segmentation, and difference in-depth. And fine finally, it's, all about execution, and that's really a continuous process. So better to think agile, not waterfall, setting small milestones and start with proof of concept, and then evolve your policies and procedures as you understand better, your risk as it matures. Alright. Now that we have a sense of what the Converge cybersecurity program for health care can look like, let's move on the the next step, how key frameworks fits, into, programs. So what we are seeing here is that Fortinet and Armis capabilities map to the key cybersecurity frameworks for OT and IT. Here, we want to look at a key one, which is the new CSF in its version two. Why? Because it help us remember that security has several pillars or functions and critical categories below them. It's also important to remember that technology is an enabler, that won't cover every single category fully. For example, defining the business environment or setting the risk management strategy will always require leadership governance and process decisions. And that said, let's see where Fortinet and Armis will strongly support your journey. First in Identify, we we deliver continuous asset discovery and risk context across IT, OT, IOMP, and cloud, revealing what's connected and where vulnerability exists. In protect, we enforce zero trust access, data security, and segmentation, making sure sensitive clinical processes run without disruption. In detect, we add deep anomaly detection, behavior analytics, and threat intelligence to surface malicious activities quickly. And in response, we enable automated containment, playbook driven actions, and clear communication between the SOC and clinical teams to minimize the impact. Now in recover and govern, this lean more heavily on policy training and and business processes. And here, our platforms still provide forensic cost incidents, insight and continuous improvement data that supports those activities. So here, the key message is that frameworks define the what, but platforms like Armis and and Fortinet deliver the how. Together, they give health care operator a strong technical foundation to meet compliance requirements and improve the back patient safety. Okay. With this mapping in mind, let's now let's now let's now have a look at, technology adoption, over time. And so this is a a capability match maturity model, integration that c c two m I illustrating the typical technology required to achieve the security control in a in a converged CPS environment and how they are often deployed in sequence as you, your cybersecurity program matures. That sequence, however, is just indicative. It's not prescriptive. There is no fixed order, and it will vary with the level of security you want to reach. You might, for instance, deploy a SIEM in your SOC or with an an an an an MSSP before implementing tools like sandboxing, or you could prioritize deception technology in life science over microsegmentation, for example. The idea is to assess your program maturity against proven deployable technology and evolve in a way that makes the most sense for your organization risk profile and resources. In fact, maturity isn't only about tools. It's about the the continuous evolution of people and processes, supported by technology that expands visibility, strengthen to control, and builds resilience step by step. The focus should always be on steady, measurable progress, start with asset management and basic segmentation, move towards control and detection, and then embed automation and continuous improvement into your your operation. Okay. So we have a look at, we have a look at the maturity journey. Let's let's look at how this capability comes together in a in a ref reference, architecture. And in this section, we'll explore you can step back. We'll we'll explore a Fortinet reference architecture for health care security. And for the purpose of this joint webinar, the architecture will highlight, how Fortinet and Armis technology and their broad integration work together across the architecture. And not that a mix of other security vendor integration are, of course, possible since Fortinet has more than 400 stake alliance partner. But the one way display allows you to address a full networking and defense in-depth with only two vendors platform, which is quite unique among our close CVS IDS partners. The goal here is to show how all the capabilities we have, discussed so far come together in a real world blueprint that protects, clinical operation without disrupting, care. Next slide, please. So let's start exploring how this architecture come together. Yes, it's, it's small and packed, but no worries. We'll zoom in. So, click. Our architecture, first of all, is informed by the core health care industry framework that defines how health care environment must operate These requirements, shape the control and and design decision, we we can enable up to the highest security level. Node security level should be adjusted to zones and risk profile. What we'll be showing is the actually, the highest security level. Next, we bring in Armis, platform and Fortinet Security Fabric as the foundation, identifying networking and security into a single integrated architecture. This includes visibility, secure networking, and advanced threat protection across your hybrid states. Next, we look at a main hospital site, which could be the core for larger health care group, securely connected to other entities such as satellite hospitals, diagnostic and imaging centers, labor labor labor laboratories, and and life science facilities, and they will be connected through Secure SD WAN. Next, our OT and IONT security services will provide deep protocol inspection for medical and industrial standards like DICOM, HL7, OPC UA, Modbus, or BACnet. And this is really critical for securing clinical workflows without disrupting them. And next, finally, we can expand this, secure foundation into the cloud layer if required, integrating with major provider like AWS, Azure, or GCP while enabling secure remote access, telemedicine application, and and and seamless collaboration with partners. The message here is simple. Security has to follow the data from the clinical operation to the cloud while staying compliant and context, aware. Now we're gonna zoom in again and look more closely at the enterprise and cloud edge right here. So this is the layer, and you can click, where most, health care organization are accelerate accelerating their digitization transformation. At this level, we are dealing with the core IT infrastructure, data centers, clinical information system, EMRs, imaging, archives, and business application, all of which must remain highly available, compliant, and secure. It's also where connectivity extend outwards to the cloud, to remote site, and to clinical environments deeper inside, the network. So key building block here is segmentation and secure connectivity with things like secure SD WAN enabled nationwide. We connect the hospital labs and satellite facilities with encrypted high performance transport and full visibility. So the SLA can be maintained even as data volumes grow with imaging AI and telemedicine workloads. If some workload shift to the cloud, secure service edge expand those protection to SaaS and IS environment, ensuring consistent policies from the the data center to sovereign cloud services. This is also where AMIS brings visibility and context by discovering and providing, profiling every connected assets, including, unmanaged IT, IoT, and medical device. Armis will enrich the, security posture with real time intelligence that helps prioritize risk, detect, abnormal behavior, and support zero trust decision at scale. So together, Fortinet and Armis strengthen the enterprise edge with policy enforcement, identity integration, and threat intelligence, ensuring that security follows the users, the device, and the workload. Finally, this is a layer that makes the bridge between IT and OT, so we're gonna go next to look at the the OT side, and now we are really entering the clinical and the IONT zone. This is the crown jewels of the architecture where passion care, safety, and operational continuity depends directly on the resilience of connected devices and system. So this environment is very different from the IT domain. Here, we deal with medical device, biomedical equipments, building automation, OT controllers, and IOMT sensors, many of them running on legacy operating systems or design without security in mind, and yet they are, increasingly network connected and exposed to threats. This is where Armis deliver very good feasibility value. It provides passive agentless discovery profiling of every connected device from infusion pumps and passion monitors to imaging systems and building automation controllers. And that deep device context allows us to prioritize risk, identify vulnerability of abnormal behavior, and and understand how each device is tied to, the clinical workloads. And on top of that, visibility, Fortinet enforces the security controls that protects those assets with network segmentation, micro parameters, zero trust policy. We can ensure that each device, only communicate with what it needs to. For example, an infusion pump can talk to its management server, but it's blocked for reaching the Internet or other sensitive systems. And when suspicious behavior occurs, automated response and containment capabilities driven by Fortinet and informed by Armis's telemetry can isolate a compromised device without taking down the entire service of disrupting patient care. So this is the art of cyber physical security in health care, depleasibility plus enforced control plus safe response, all designed to protect clinical outcome, passion safety, and operational continuity. Great. That was quick for a fairly, fairly big, architecture that would require much more discussion, and we'll be happy to, to deep dive with you in the future. But before, let me end back to, tomorrow. Yeah. Great. Thank you so much for that. I think that that's a great lead into, what we wanted to do is I wanted to walk you through what that looks like, from, two use cases actually. The onboarding of a medical device and how Armis and Fortinet work together to proactively, reduce the attack surface. And then, you know, again, going back to that notion of hope for the best but prepare for the worst, What happens if one of those devices is actually compromised? How is it that our platforms come together to help secure the environment in the event of any type of incident? Now, this is predicated on, using the network as a compensated control, so segmentation. And as as, as was mentioned as Antoine was mentioning, it's really about how we work together. So Armis has the ability as well, you know, when we're talking to health care organizations, generally flat networks. That's the focus used to be on just digitizing patient care. Let's get things up and running. But now what we're seeing is, of course, the blast radius is still large. That segmentation is one of the most crucial, compensating control, and just security control in general for hospitals to adopt. So Armis has the ability not only to provide deep levels of visibility in terms of what the assets are, but by monitoring how they're behaving and combining it with our asset intelligence engine, we can also propose ACLs to help streamline that segmentation project. So understanding what the device is, understanding how the device is behaving, generating recommended ACLs based on what the device is and its profile and how it should be operating, And then integrating with, the Fortinet platform, including Fortinet, including the firewalls to help actually enforce different types of segmentation approaches and policies, and that too dynamic and in real time. So if a device is authorized to be on the network, but then all of a sudden we see that it's operating outside of its norm, orchestrating and informing the Fortinet platforms to enforce different security policies, given the deviation in behavior. So with that, I'm gonna walk through a couple of things. There's gonna be a couple of different steps here, but I wanna walk through it one by one. In this case, there's the integration that happens between Armis platform and Fortinet's platform. And what we're gonna see is there's a MRI device that gets connected to the network. It reaches out, right, getting information, getting its IP, information, you know, whether it's a DHCP request or whether it's reserved, and it's doing that broadcast and announcement over the network. Now what what's what's gonna happen here is Fortinet's gonna apply a new device policy. It's, hey, what is this device until we Armis profiles it, we're gonna have it contained in a new device VLAN. Armis comes in, we do that deep, packet inspection, we do that protocol analysis and identify this device as being a medical device, specifically as, an MRI. That identification gets, updated and passed on to Fortinet. Now we're not just gonna let a medical device on the network. What we're actually gonna end up doing is we're gonna put it into a device configuration VLAN. So the clinical engineering teams, the diagnostic imaging teams, they can actually harden that device. Hey, there's firmware updates. There's software updates. There's other, aspects. We wanna change default credentials. So allowing them to do a secure configuration, Armis also has the ability to, a what we call active smart active query to probe the devices for different types of configuration elements. So services being enabled or disabled, understanding levels of encryption, and things of that nature. But we also have the ability to, once we do this, assign and identify various different risks that might still be there. And we also integrate with ticketing and CMMS systems. So our VIPER, which is vulnerability prioritization remediation model, can actually take those risks, come up with recommendations, and then integrate with existing ticketing and workflow systems to pass on that information to clinical engineers and diagnostic imaging teams in order to be able to remediate and mitigate those risks. So, hey, there's default credentials. One of the tickets is to end up changing some of those credentials. So, again, that hardening policy around the risks. Now once that's been implemented, those tickets automatically get opened. When they get closed, Armis can help validate that that risk has in fact been remediated, and then it passes that information again back to Fortinet to say, hey, this has been updated. It's now dubbed as security approved because we reviewed this device, and Fortinet then allows it to actually be applied that approved MRI policy and then therefore access internal resources. So from the from the, moment that the devices are connected and pro Armas is helping profile, we also do that risk assessment and mitigation process and flow. And Fortinet, through its expansive platform, helps enable and helps enforce the appropriate policies depending on where that device is in its life cycle from procurement, configuration, deployment, maintenance, and then, of course, decommissioning. Now I'm gonna quickly go through a slightly lighter, diagram in terms of what does it look like when that approved device actually exhibits, compromised behavior. So in this case, the device is already connected, but Armis and Fortinet were both detecting, different types of anomalous behaviors, call outs to different ransomware domains or those port scans that predate a ransomware execution. Well, in this case, Fortinet's gonna apply a ransomware quarantine policy or some type of a block all policy, or depending on the device, it might be a block Internet policy. Right? Because we don't necessarily wanna impact if this device is, touching a patient or, introduce patient harm as part of this. So with that, because Armis itself also has about 200 plus integrations, being able to integrate across the different, platforms that might exist in your security, stack, Open up in this case, I've I'm I'm picking ServiceNow. Execute a ServiceNow incident response playbook that can be assigned to multiple different teams, multiple different child, tickets associated with a much broader incident response because that process and workflow is just as important as a technical, technical control as well. Once they have been remediated, again, that information can flow back into SentriX. SentriX also helps lift and orchestrate some of the quarantine, from your existing and other security solutions. And ultimately, Fortinet can also then allow it back on the network. Hey, we validated that this device has been mitigated or remediated. Things look good. We're not seeing that threat, that threat or malicious or anomalous behavior. Therefore, we'll let you back on to that approved MRI segmented network there. So kind of two different aspects that I just wanted to quickly walk you through, before I hand the mic over to Olivier to discuss the use case that we have with Roche. Thank you, Moh. Hi, everybody. Happy to be here. My name is Olivier Kornberg. I'm the head of product security and privacy organization at Roche Diagnostics. Roche Diagnostics is a leader in the development of innovative products and services that address the prevention, the diagnosis, monitoring, screening, and treatment of diseases. With over 125 in health care and decades in digital expertise, we are a trusted partner in safeguarding data and systems. And when we are talking about product securities, especially with, medical device regulation, we obviously talk about connectivity, but also interoperability and system integrations. And none of this can occur without a very strong cybersecurity framework. Indeed, you don't easily replace your medical records, as you would do with your credit card when it get compromised. And that today, I'm delighted, and honored to be speaking alongside Fortinet and Armis, both recognized cybersecurity leaders that are helping to strengthen, Roche's position in the digital ecosystem. As a matter of fact, health care runs on an increasingly complex ecosystem of connected assets, and you cannot protect what you cannot see. Therefore, we came up with a program to other customers based called digital trust, which is based on secure, compliant, and confident referrals. And I will come, more into the details of of, of this program. Want to go to the next slide, please? When we talk about customers for diagnostics, we talk about labs, hospitals, point of care. And and when we look at labs and as a digital transformation they went through after this pandemic, it's also an evolution in becoming, unfortunately, a target more for ransomware. We know ransomware are exploding. There is an estimate of the cost for 2025 that will be over 57,000,000,000. And the health care is definitely the health care sector is definitely one of the primary targets. On top of that, there are regulatory frameworks that are getting stronger and stronger, that forces as well, labs and hospitals to adjust and adapt. The ISO twenty seven zero one is becoming the benchmark for any providers to submit into, a litigation or, in a in a public standard. And, also, we look at, like like Moh mentioned, the CAF framework, NIST two, and some also privacy regulatory, new laws, new standards such as c five in Germany, but also ENS in Spain or HDS in France that are forcing, in the way we collect, manage, and process, patient data. Furthermore, the average cost of a data breach is very high, and not only is the cost of solving the issues, the technical cost, but there's also a reputational cost associated to this. And finally, the potential disruption in services is also, a major concern for lab and hospital. Actually, it goes beyond purely disruption and, rescheduling of intervention. Last June, in in in The UK, the NHS, for the first time, acknowledged that the death of a patient was directly linked to a ransomware. Indeed, the patient didn't get the blood test result in time and and was not diagnosed with a severe condition and therefore passed away. So we also see that there is clearly, a different evolution and different risk associated. It goes beyond the security risk. It goes directly to the patient safety. If you go to the next slide. And that is why the program is around the patient safety. And like with everything else we do at Roche Diagnostics, we put the patient in the center. And when you look at the different combination of the different pillars of the program, you can easily link them together. The transparency in the communication clearly goes with the shared responsibility and the response time. You need to be a trusted partner. You need to also understand the ecosystem and act with your different partners to make sure that you can resolve, communicate, and and bring the issues in a timely manner to your customers, to the authorities, and, of course, to the patients. When we look at the cybersecurity and and the data and the systems, we can also link it to the data privacy protection because it's both of them are combined and are not very important to, also create this confidence and and obtaining consent of the patient and also making sure that we have a robust data governance to understand what is collected, what is processed and discarded. And from a compliance perspective, there is clearly a a link with the trusted data use, making sure that you are doing the right thing for the right time. And when thinking about new development and with the use of AI and and new technologies in development of algorithm, clearly, the ethical dimension of the compliance and the trusted data use is becoming, critical for, the different players. You go to the next slide. And finally, the digital trust framework is really based, as I mentioned, on these three pillars, the privacy, the data privacy, collecting, informing, as well as the patient, but obtaining the consent, understanding the governance, and making sure that you also collect, what you need and and and clearly, disclose secondary use of the data development assessment, as I mentioned, development of algorithm, and so on. So you can have, this agreement on what do I collect, trusted data used, which brings you, as well, in in a better relationship in the data flow, understanding where's the data is, what you're collecting, what you're processing in a very distributed environment. Today, a lot of the data is collected in devices that are at home, in the patient home, sometime in the hospital, in laboratories. So it's a multitude and very segregated, very diverse environment of connected devices that are bringing all that information around the patient. And finally, the cybersecurity framework and with like you've seen with Armis and Fortinet, bringing and ensuring the confidentiality of the data, of course, the availability of the data and the integrity of the data, because as I mentioned, medical records are unique and need to remain untouched, and and uncompromised if you want to make sure that we get the best results and the best prediction to ensure the patient's safety. And with this, I will give it back to more. Thank you so much. And so I'm gonna quickly go through what does this unlock for a health care organization? What's the impact, to the different metrics, whether it's related to, the visibility, speed, cost metrics? But one of the things that I do wanna emphasize that Antoine, Geri, Olivier was mentioning is that it all comes down to having a program. Right? So the the common theme that we've also been speaking about whether it's compliance or is that the platforms, they integrate really well to help bolster a overarching program that you have. And if not, right, we can always discuss on what is a standardized program that we're seeing health organizations globally adopt. But if you look at this right side here, how do you develop that maturity over time? Well, with that dynamic and real time, assessment, visibility into your environment, maintaining that is crucial to helping automate and helping ensure that you're monitoring your risk in a continuous manner so that you can also, reduce it and mitigate it. And when you're able to get into a more streamlined version on this right side here, the inventory profiling, leveraging automation and workflows, proactive risk reduction like we were also mentioning with the, segmentation, not only reactively, but proactively. What you start unlocking is on this left side here. Process optimization, not only for, you know, IT and security teams, but really linking it back to the availability and the clinical workflow, that at the end of the day is the most critical thing for, any team in a hospital to help enable. So not only process optimization, operational efficiency, helping streamline patient flow, but doing so securely. So at the end of the day, if the platform's working together to help bolster maturity of a security program in order to unlock different operational efficiencies across the different teams in a health care environment. And what do some of those metrics look like? Well, first and foremost, what we've seen, is a complete, it's it's it's a unparalleled speed to identification and visibility. We've gone from, organizations that used to take a minimum of two to three hours from understanding and getting visibility into when assets are connected, to under a minute. Because the moment these devices are coming online and they're trying to communicate, those deep packet inspection and protocol analyzers help to identify assets within seconds. But beyond that, 50% faster time to patch for HTMs because coming out with what is it that you actually have to do. And then as I was mentioning through that automation and integration, 80% reduction in manual overhead. And what does this mean? Not only do health organizations struggle with limited, limited resources and personnel, but instead of having those limited personnel, having to manually open tickets, assign, resources, assign ownership, having to close them, Well, we can help cut through that and ensure that the resources are more focused on helping mitigate the actual risk as opposed to the overhead that's gonna be involved in, the processing that relate and lead into it. With this, we've also seen a 50% reduction, in associated with recalls and patient safety related manners. But if we look at the actual close rates of vulnerabilities and what we've enabled there, this partnership, and Armis visibility, seven x increase in closed security findings. So not only the vulnerabilities, but those security findings, insecure configurations, and it helped reduce, the actual manual efforts of those by 90. So you can imagine the the value that's being unlocked here. And if we go over to the clinical side of the house, again, the clinical workflows, helping avoid downtimes by almost 30%. So improving 30%, in terms of patient outcomes by helping avoid ransomware downtimes and in other cases, helping accelerate the recovery from any type of incident. Now we all know, unfortunately, that, hospitals, of course, have very tight, budgets and, spend ability. But when we look at, inventorying medical devices, when they're being used, where they're located, and helping understand when they're online or if they're offline for an extended period of time, again, linking back to the benefits of real time visibility, we've been able to help, hospital organizations of varying size, save up to 7 figures and more, related to optimizing their medical device fleet, deduplicating purchasing, helping ensure their actual medical device fleets are online faster. So all of this coming back to helping improve patient care flow, helping, reduce costs, helping ensure availability enough time, and it all starts with the, tight integration and ability of our platforms to provide visibility and enforcement, and then, of course, help organizations mature in their overarching security journey. And with that, Antoine, I think you're gonna help us walk through some strategic takeaways. Absolutely. And you can go on next. Thank you, Moh. So as we as we, wrap up, let's bring everything together and and look at what this means, in practice for health care operators. I would say it start with, a good tech alliance, putting the best vendors together. What we're trying to achieve today is show what is, Armis plus Fortinet capabilities com combining their strengths to deliver unified visibility control and automated response, to reduce complexity and strengthen the overall resilience. And this is, this is not just theory, it's proven in the field. Industry leaders like Roche have already demonstrated measurable gains in visibility, regulatory compliance, and and patient safety, through this joint approach. There are several other cases. Another critical element is optimizing total cost of ownership, especially in this industry. And for this consolidated platform and automation really reduce, tools fragmentation. It lowers the staffing needs and really simplify operations, which is essential under today's tight budgets. We also need security that spans IT, OT, and IOMT seamlessly. Protection must extend across every layer of the, health care environment without disrupting, the care delivery. And please mind the fact that security is not only about feasibility, and that's why we also show the new CSF framework with all these, dealers. Most importantly, we must turn strategy into tangible outcomes, so better visibility, stronger segmentation, faster incident, response, and improved operational efficiency, all of which translates directly into safer patient care. And all of this is about, at the end of the day, difference in-depth, sovereign SASE. There is cloud involved, OT Aware, SecOps, and expert services. We didn't talk much about services, but this is, of course, a critical aspect that we didn't have time to discuss. Delivering security, really, from the plant floor all the way to the passion floor. And, ultimately, I would say it's about people, process, and technology working together to make health care not just more secure, but also more resilient, more efficient, and and more focused on the, patient's, outcome. And with that, taking the time, we've got, four more minutes, and, we would like to open the floor for questions. There is, a question in the list here for for Moh. The Armis needs to module is currently in date beta release. Is there a quantified release date yet? I don't know if you're able to answer that one. I'm happy to take that offline for an official release date, but that is, soon. Whether that's a release or 02/2008, I'm I can check with our product team, but feel free to reach out to me directly, and I can get you that information. Great. There is another question. So, how does the proposed framework with Armis and Fortinet support hash patient data privacy and security? Is this something you want to, to take, Moh? Maybe Yeah. Yeah. For sure. I think when it comes to patient data and privacy, there's a couple of different ways. Right? There's, an unencrypted PHI, a, that can traverse the network. So having visibility into what, assets either transmit PHI or according to MDS squared files and properties, which one store PHI, that's number one in terms of getting visibility into it and then, you know, segmenting it based on, Fortinet's capability. But also when we see, large amounts and volumes of data going out to the Internet, our armistice detected terabytes coming from, different types of medical devices indicating anomalous drift in the data usage and transferring, that can also indicate that exfiltration phase, that pre that's a precursor to ransomware attacks. And then, of course, there's, non malicious types where, patients or staff might deploy, devices that are recording information in patient rooms. Right? Not for the not for any malicious purpose, but for, helping streamline patient care flows, but they need to go through privacy assessments. So all of these different cases, it starts with visibility and then the automated enforcement to ensure that the devices that are leveraging a process in PHI are secured, with priority. Great. Thanks a lot, Moh. I'm seeing another question from Daniel in the list. Are you able to say something more about other companies using the strengths of Fortinet and Armis. So I think we we Moh and I touched a little bit on that. Moh mentioned 200 other tech alliance that Armis with, has with other, security vendor. Fortinet has, 400 plus. This is, a webinar, as you understood, where, Fortinet and Armis come together, to, to discuss how we work well in the health care, domain, really on on the intertween between feasibility and, control, enforcement. There are other possibilities. Of course, there are not so many players that are, very good in in health care, so I'm not here to, to sell what would be the the best mix. But, again, there are many, many possibilities here. I mean, we also looked at, secure networking architecture where you could see Fortinet next gen firewall, industrial switches, and access points. I mean, those were Fortinet, but, of course, there are many instance where you would have a mix and match. What is important, is to, realize that, OS for security vendors need to be open. That there there is a lot of API and connectors, that are pretty much standards, and what is important is that you choose platforms that reduce your complexity, and improve your total cost of ownership. And we we we try to, to show something that that makes sense, but, of course, there are other possibilities. Anything you want to add here, Moh? No. I think, I think you hit the nail on the head there. Great. And with that, we are just on time for the end of the the webinar. So and thank you everyone, giving the opportunity for all the speaker to say bye. Great. Thank you. Thank you, everyone. Thanks a lot. Have a good day, everyone.