Hospital cybersecurity has a peculiarity that no other critical infrastructure sector shares in full: when it fails, not only data or production are lost; human lives are put at risk in real time.
That was the premise with which Carolina Pizarro Díaz, CEO of Aura Cybersecurity and President of REDIAC, opened the panel «Seconds that save lives: simulations and responses to incidents in hospital environments» at the Industrial Cyber Summit Chile 2026, along with Cristian Donaire Bustos, CISO of RedSalud; Mario Alday López, CISO of Clínica Alemana; and Sergio Mella, CISO of Banmédica Empresas Prestadores.
Pizarro opened with three real-life cases that had ceased to be hypotheses long ago: in Germany, an attack on the ventilation system forced the closure of entire wards; in the healthcare network in San Antonio, Texas, malicious instructions in an environmental control software altered the ventilation of burn and virological wards, forcing the total closure of hospitals; and in Düsseldorf, a ransomware virus diverted an ambulance and cost a patient her life. These are incidents that rarely make headlines with the same intensity as a data breach, but that today directly affect patients on the ICU or the ER, procedures that are brought to a standstill halfway through and operations that simply cannot be performed.
The gap is not technological; it is a conversational one.
The question Pizarro brought to the three CISOs was what the main preparedness gap is between IT and OT when an incident occurs in healthcare. Cristian Donaire was the first to name the hidden cost of indecision: how long does it take an organization to understand that it should formally declare an incident, because every minute of delay puts the patient's life at greater risk. What was once thought of as a movie exaggeration—dying from ransomware—has already happened, and not just once. The underlying problem, according to Donaire, is that each area has its own continuity plan (IT, operational, cybersecurity), but those plans almost never talk to each other.
Sergio Mella was more specific about where that conversation breaks down: at the top management level, where IT and OT are still perceived as separate worlds. For years, he explained, the operations area—which handles IoT infrastructure, medical equipment, and air conditioning—was completely disconnected from the technology areas; only in the last decade, when those devices were connected to the network, did they begin to inherit the same cybersecurity risks that the IT world was already facing. To that is added a collateral effect of hypertechnologizing: clinics operated robustly without systems twenty years ago, and that «muscle» of working in manual mode is being lost just when it could be most needed.
Mario Alday, from Clínica Alemana, located the gap in a similar place but with a different name: the coordination between the world of cybersecurity and technology on the one hand, and medical technology and clinical staff on the other. His concrete proposal was to scale the exercises up in levels—starting by establishing the basic medical procedures well, then increasing them by turning off some specific systems, and only at a more advanced stage simulating a more comprehensive shutdown of screens and systems—so that the medical staff would reach each stage already trained by the previous one.
Manual triage and offline pharmacy: protocols that cannot fail
Donaire was specific about what it means to be prepared in practice, with RedSalud centers spread throughout Chile. If an incident is declared, he explained, it is because the OT protective layer has already failed—something that didn’t seem likely—and from there the priority is to distinguish what can be stopped temporarily and what cannot: an outpatient center may close for a few hours, but a patient in the ICU or the intensive care unit does not have that option. The protocols that support that distinction are, at their core, quite analogous: knowing how to perform a manual triage without the support of systems to determine the criticality of each patient, and having an offline pharmacy that allows knowing what medications were assigned to each critical patient even without access to the software. The key, he insisted, is that those protocols are tested and not just written in a manual that no one has opened in months.
| CISO / Institution | Noted gap | Concrete measure proposed |
|---|---|---|
| Cristian Donaire Bustos (RedSalud) | Continuity plans that do not communicate between departments | Manual triage and offline pharmacy tested, not just documented |
| Mario Alday López (German Clinic) | Disconnect between cybersecurity and medical/clinical technology | Exercises graded by levels of criticality |
| Sergio Mella (Banmédica Prestadores) | IT and OT still seen as separate worlds in senior management | Production system + isolated standby system as backup |
Source: Panel «Seconds that save lives: simulations and responses to incidents in hospital environments», Industrial Cyber Summit Chile 2026.
Mella added a distinction between the private and public sectors that is worth highlighting: the typical good practice of private clinics is to maintain a system that governs production and another in standby mode, isolated and with somewhat lower capabilities, ready to take over if the main system fails. In the public sector, the challenge is different and of longer duration: maintaining legacy IoT infrastructure from the first deployments over time, without losing protocols or maintenance being cut due to budget cuts. Mella also pointed out a point that often falls outside the technical radar: in many crisis exercises, the cybersecurity team ends up working alone while the rest of the organization watches from the gallery, without the legal department or HR being activated in time, and without an internal communication plan to prevent the employees themselves from learning about the incident from the news.
Training as the only real antidote
Towards the end, Pizarro asked the three to choose a single priority so that the healthcare sector could prepare better. Alday focused on the response time between the incident and the direct management of the patient, automating as much as possible—clinical records, data entry, pending protocols—so that they could get to the side of those who need it sooner, and understanding that this had to be tested in practice, not left to paper alone. Mella went for training as the central variable: the tabletops look good on paper, but the people who execute those processes are people who under real pressure react differently, and only frequent, rigorous, end-to-end training—not fragmented into parts—reveals where the real deficiencies are, rather than relying on the only person who knows the entire process from memory.
Donaire closed with the most forceful image of the panel: scheduling a tabletop meeting usually clashes with the schedule — »I can’t on Friday, let’s do it on Monday» — but a cyberattack doesn’t announce itself or get scheduled. If an earthquake leaves the CISO literally trapped under a bell, the organization has to be able to continue operating with protocols that the entire team understands, not just their leader. And that brings up a fact that any CISO in the industry should have memorized: the largest attacks statistically occur on Fridays, weekends, and the eve of dates like New Year, Christmas, or September 18, which means that a Monday-through-Friday exercise of just 8 a.m. to 6 p.m. simply doesn’t prepare the organization for the scenario where the attack actually happens.
Pizarro closed the panel by recalling that this challenge is not exclusive to the health sector, but that it takes on a different urgency there because what is at stake are human lives. The same logic of rehearsing before it actually happens connects directly with the gaze of cyber resilience That Cyber Summit is documenting in other critical infrastructure sectors, and with the reporting deadlines that the new Law 21.663 Today, it demands that any provider of essential services, including healthcare. For those who want to see how this same discipline of simulations is applied in another critical industry in Chile, it is also worth reviewing the Microsimulation of industrial ransomware held at the same event.
