Cybersecurity in the age of AI: how to protect the platforms that handle clinical data

Artificial intelligence is transforming medicine, and it is also changing the rules of cybersecurity. The same technologies that automate processes and speed up software development are being used to find flaws that had been hiding in code for years.

October 2026 made that clear. In a single week, between October 14 and 21, nginx, Java, Apache Tomcat, PHP and Node.js all shipped urgent security fixes: a large share of the technology foundation the world’s software runs on, clinical software included. At least two of those flaws were discovered with the help of AI, one of them hidden in the code for more than a decade. For one of the most serious, the NSA and FBI issued an unusual instruction: update immediately or take the system offline until you can. The American Hospital Association forwarded that advisory to its members the same day.

For a hospital, a clinic or an imaging center, the question that month leaves behind is not a technical one. It is this: can the platform that holds your patients’ clinical information today be fixed when it needs to be?

AI changed the speed of threats

For years, cybersecurity focused on protecting systems against known threats: unauthorized access, malware, ransomware. AI adds a new variable: speed.

The UK’s National Cyber Security Centre (NCSC) warns that AI makes parts of intrusion operations more effective and raises the frequency and intensity of threats. The researchers who found one of the October flaws put it bluntly: turning it into a working attack, a job that would once have taken a world-class team months, took a single person working with AI about a week.

Mandiant’s figures show which way the clock is moving. The average time between a vulnerability’s disclosure and its exploitation was 63 days in 2018. In 2024 it reached −1 day, and for 2025 it is estimated at −7 days. A negative number means that, on average, attacks begin before a fix exists.

An AI-assisted attacker racing against the clock while a radiology professional works with protected imaging studies

For a healthcare institution, this changes what to demand from a technology vendor. It is no longer enough for the platform to be secure on the day it is installed. What matters is its ability to react: how quickly it can fix a flaw when one appears, and whether it can at all.

The silent risk: platforms that can no longer be updated

Not every vulnerability comes from a sophisticated attack. Many become dangerous for a less visible reason: technology that stopped evolving.

A RIS/PACS, a results portal or a clinical system can run without problems for years and still depend on operating systems, languages, servers or libraries that no longer receive security support. As long as nothing happens, nobody notices.

October showed what happens when something does. Fixes were released only for supported versions. Oracle, for example, publishes its security updates only for versions still under support; several open-source projects confirmed that their older versions had the same flaws but would not receive fixed releases. For a platform built on those versions there is nothing to install. The only options are to migrate to newer technology, which in an architecture that has gone years without renewal can take months, or to follow the official recommendation: take it offline.

In an imaging department, taking the platform offline means no worklist, no viewer, no results delivery and no patient portal.

Old servers covered in cobwebs, showing a security alert and a sign that they can no longer be updated, next to a radiologist reading studies at a workstation

At that point, obsolescence stops being a technical limitation and becomes a risk to clinical information and to continuity of care.

The US National Institute of Standards and Technology (NIST), in its cybersecurity guide for PACS, already identified legacy components and the complexity of interconnected environments as factors that increase exposure.

To be fair: a system’s age does not, on its own, prove it is insecure. What matters is whether it is still supported, whether its flaws can be fixed and whether there is a real path to modernize it. And most institutions don’t know, because that question is rarely asked before signing.

A secure platform is a platform that can evolve

Security cannot depend on a configuration done years ago. It requires an architecture that can take in fixes, renew its components and respond to a new vulnerability without stopping clinical operations.

That goes hand in hand with the protections any clinical platform should have: encryption, role-based access control, traceability of every operation, backups and an incident recovery plan. It also includes the security of integrations with other clinical systems and of the AI components being added to these platforms.

Adopting AI is not just about adding smart features. It also means protecting the data those features process, controlling who can access them and managing the new risks they introduce.

How to vet your vendor

With a technology vendor, “our platform is secure” is not a verifiable answer. These are:

What technologies is the platform built on, and do they all have current security support? Ask for the component inventory (known as an SBOM) and the end-of-support dates for each one. If any component is no longer supported, ask for the migration plan with dates.
What did they do about the October 2026 security alerts? It is the most concrete test available today. A vendor on current technology can say precisely what affected them and what they fixed. A vague answer is also an answer.
How long does it take to apply a critical fix, and how will you be notified? That commitment belongs in the contract, just as uptime commitments are written in today.
Can it be updated without stopping operations? If every update requires a long downtime window, in practice updates will be postponed.
How does it protect the data its AI features use? What information they process, where, who can access it and whether it leaves the platform.
What evidence do they give you? Encryption, roles, access logs, backup and recovery tests: all of it should be demonstrable, not just claimed.

Asking a vendor for this is not distrust. Colombia’s data protection law (Ley 1581 of 2012) requires both the institution that handles personal data and whoever processes it on its behalf to keep that information “under the security conditions necessary to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access”, and similar obligations exist under most data protection regimes. Verifying that the platform can be fixed is part of meeting that duty.

A physician reviews a vendor checklist with an executive: documentation, protection, response times, updates, artificial intelligence and data

NOVA Imaging: technology that evolves to protect what matters

At NOVA Imaging we understand that building technology for healthcare carries a responsibility that goes beyond offering good diagnostic and image management tools.

Our platform is built on cutting-edge technology with current support, on an architecture designed to evolve. That lets us apply fixes when they are needed, without waiting on a migration or stopping our customers’ operations. The DICOM viewer is 100% web-based, so there are no programs installed on every reading workstation to update one by one: an improvement to the platform reaches every user at the same time.

On top of that come encryption, role-based access control, traceability of every operation, and backup and recovery strategies, in cloud, on-premise or hybrid deployments.

If you are evaluating vendors, ask all of them these six questions. Us included.

Tomorrow’s security is built today

AI will keep transforming both defensive tools and the capabilities of those trying to break into systems, and ever faster. That is why, when evaluating their technology vendors, clinics, hospitals and diagnostic centers need to ask a new question:

Will the platform protecting our clinical information today be able to keep protecting it tomorrow?

Cybersecurity is not a feature you install once. It is a capability that has to be maintained, reviewed and evolved. Cutting-edge technology is not only the kind that adds new features: it is also the kind that can stay secure while the world changes.

For the broader picture of threats and best practices in these systems, read RIS/PACS cybersecurity: protecting medical images and patient data.