Security operations
that protect
patient care.
CENTARGUS helps hospital security teams connect evidence, prioritize clinical risk, and keep critical containment decisions under human control.
Healthcare · One of the critical industries we serve
Built around the human decision
Select a system to explore its clinical context. Conceptual view.
The operating principle
Evidence informs.
People authorize.
Follow a signal toward a clinical system. See where analysis supports the investigation and a person takes responsibility for the response.
Interactive example / You make the decisionAnalysis recommends. People decide.
01 / Evidence
Every investigation starts with a signal.
Identity, endpoint, and network observations stay available for the analyst to inspect. A signal starts the investigation; it does not authorize a response.
Observed activity → reviewable evidence
02 / Context
See the service behind the signal.
Connect the evidence to the critical systems it can reach. Prioritization considers operational impact, so the analyst can understand why this path matters.
Connected evidence → operational context
03 / Human approval
A person owns the critical decision.
Analysis recommends. An authorized person reviews the evidence and operational consequences before authorizing, holding, or declining critical containment.
Make an example decision
04 / Audit record
The decision stays with the evidence.
Keep the recommendation, the human decision, and the rationale together. Incident review starts with a traceable record of what was decided and why.
No critical action has been authorized in this example. Return to human approval to make the decision.
The problem
An alert is a signal.
Care is the priority.
A stolen credential, an unusual connection, and a clinical workstation can look like separate events. The risk becomes clearer when an analyst sees how they connect.
CENTARGUS is built to rank what can interrupt care, explain the evidence, and keep critical containment behind human approval.
See why the context matters
Care continuity shapes the response
The systems behind every patient journeyApproach
Built around
clinical continuity.
Security and clinical teams need the same evidence, a clear view of operational impact, and a person accountable for the next step.
01Prioritize the protected-information path
Consider adjacency to protected health information and critical systems, with a readable explanation that an analyst can review and challenge.
02Keep critical action under human approval
Analysis can recommend. Containment that could affect care waits for an explicit decision from an authorized person.
03Retain deployment control
On-premises and air-gapped operation keep core investigation work within the organization's chosen boundary.
04Make decisions reviewable
The evidence, recommendation, approver, and rationale stay available for incident review.
Public incident record
What happened in healthcare.
Three documented incidents. Open each summary to read the public record and the operational lesson.
Public incidents are not customer case studies. These lessons do not imply that CENTARGUS would have prevented a specific event.
01February 2024Change Healthcare
Identity → lateral movement
UnitedHealth’s May 2024 congressional testimony described entry through compromised credentials on a Citrix portal without multi-factor authentication. Attackers moved laterally and exfiltrated data; ransomware followed nine days after initial access. The incident disrupted healthcare transactions and access to claims and payment workflows.
An entry event can become a path across systems before a disruptive payload appears. Identity context and connected evidence belong in the same investigation.
02June 2024Synnovis / NHS London
Pathology → clinical continuity
The cyber incident at pathology provider Synnovis disrupted services supporting NHS trusts in London. Official NHS updates continued to report postponed outpatient appointments and elective procedures eight weeks after the attack.
A service provider can be a dependency for many care teams. Security investigations need to connect technical impact to the workflows that rely on that service.
03May 2025Covenant Health
Unauthorized access → patient information
Covenant Health reported unusual IT activity on May 26, 2025. Its investigation found that an unauthorized party had gained access on May 18 and could access some patient information, potentially including treatment and health insurance details.
The interval between unauthorized access and discovery matters. Investigators need to correlate activity and understand which information and systems were in scope.
01How does CENTARGUS support hospital systems?
CENTARGUS connects identity, endpoint, and network signals so hospital security teams can investigate attack paths and keep critical containment decisions under human control. Healthcare is one of the critical industries CENTARGUS is built for.
02Does CENTARGUS act without a person?
Analysis can run continuously. Containment that could affect clinical or mission systems requires explicit human approval. The platform records the recommendation and the decision.
03Can CENTARGUS run without a cloud connection?
CENTARGUS is designed for on-premises and air-gapped environments where security data cannot leave the site for core operations. Deployment requirements and the update process are reviewed during a briefing.
04What does clinical risk prioritization mean?
It means considering how an investigation relates to patient records, imaging, identity, and other critical systems. Analysts can review why a path matters before deciding what action is appropriate.
05What should we bring to a briefing?
Bring your environment type, deployment constraints, approval responsibilities, and the outcomes your team needs. Do not submit patient data, credentials, network diagrams, or confidential incident details through the public website.
Your environment.
Your decision authority.
Start a confidential briefing about your security operations, clinical priorities, and deployment requirements.