Modeling the complexity of a hospital

Hospitals operate highly complex technology environments that can include medical devices, imaging systems, treatment equipment, legacy systems and newer technologies, all connected to the broader hospital network.

At the same time, hospitals generally cannot simply shut down systems whenever a vulnerability is identified.

“The hospital has to operate 24 hours continuously,” Comaniciu said. “You cannot just stop the hospital to upgrade.”

That creates a difficult decision-making problem for healthcare organizations. They may have numerous vulnerabilities to address, but must determine which ones take priority, which patches should be deployed, and when they can be installed without affecting clinical operations.

SHIELD is designed to address that problem by creating a virtual replica of a hospital environment. The simulated hospital network will include representations of the devices and systems that make up a real-world healthcare environment.

Other teams participating in the broader UPGRADE program will focus on areas such as detecting vulnerabilities and developing patches. Siemens Healthineers' role is to use AI to help determine how and when those patches should be deployed.

The system will take cybersecurity considerations into account alongside clinical factors.

“If a patient has an emergency, I cannot stop that emergency,” Comaniciu said. “I have to really, really take into consideration all clinical elements.”

Using AI to balance cybersecurity and patient care

The project builds on Siemens Healthineers' work developing what Comaniciu described as an “operational twin” of a hospital.

The operational twin uses large-scale simulations and AI-based agents to model hospital operations and support decision-making under dynamic conditions. SHIELD extends that concept into cybersecurity, using a virtual hospital environment to evaluate potential patching strategies.

The goal is to help hospital personnel understand the potential consequences of different approaches before making changes in a live environment.

“We get substantial data, then we run exascale simulations, and we create an environment according to which the hospital operating personnel can take decisions,” Comaniciu said.

Those decisions could include determining when to install a patch, how to minimize disruption to emergency services, and how a particular cybersecurity strategy could affect overall hospital operations and patient care.

Rather than treating cybersecurity as an isolated IT issue, the project is intended to account for the operational and clinical consequences of cybersecurity decisions.

Improving the patching process

Comaniciu said the project ultimately aims to improve several stages of the cybersecurity process, from identifying vulnerabilities to remediation and patch deployment.

“The goal of the project is to improve substantially the timing in which the patches are being deployed,” he said.

That includes improving vulnerability detection, remediation steps and the deployment of patches while maintaining the hospital's ability to provide services.

A potential byproduct, he added, could be reduced downtime for hospital equipment.

The approach could also help address one of the persistent challenges in healthcare cybersecurity: the tension between the need to quickly address vulnerabilities and the need to maintain continuous clinical operations.

Rural hospitals face additional challenges

The complexity of healthcare environments can be particularly difficult for rural hospitals, which often have fewer resources available for cybersecurity.

Comaniciu said differences can exist between academic medical centers and rural hospitals in areas including cybersecurity personnel, budgets, IT staffing, and the sophistication of cybersecurity measures.

“The overall capabilities to fight cybersecurity incidents is much, much lower,” he said of rural hospitals.

Siemens Healthineers is working with partners that serve underserved communities and rural hospitals, Comaniciu said. Those relationships could provide an avenue for applying the project's work to organizations that may have fewer resources to address increasingly complex cyber threats.

“Cybersecurity is one of the directions where we want to work very hard to help hospitals improve operations,” he said.

A three-year research effort

The SHIELD project is expected to run for three years, with the initial phase covering one year. Comaniciu said Siemens Healthineers is currently discussing continuation of the project with ARPA-H.

The work involves multiple teams, with different groups addressing areas such as vulnerability detection, patch development, and cybersecurity expertise. Siemens Healthineers' role is focused on developing the virtual hospital environment and conducting large-scale simulations to help determine effective strategies for deploying those patches.

Comaniciu said the collaborative nature of the initiative will be important to its success.

“It's more like something like a synergy has to happen in order for the overall program to be successful,” he said.

For Comaniciu, the project also represents an opportunity to apply AI and supercomputing to a problem that directly affects healthcare delivery.

The broader objective is not simply to patch systems faster, he said, but to shorten the time between discovering a vulnerability, developing a remediation, and deciding how to deploy it—while minimizing disruption to hospital operations.

“How do you handle better cybersecurity incidents? How do you prevent cybersecurity incidents?” Comaniciu said. “How do you shorten the time to patching … pending that you get minimal perturbations to the operations?”

That balance—strengthening cybersecurity while preserving the continuity of care—will be a central test of whether AI can play a larger role in helping hospitals manage increasingly complex technology environments.