Hospital cybersecurity has a peculiarity that no other critical infrastructure sector shares in full: when it fails, not only data or production are lost; human lives are put at risk in real time. <\/p>\n\n\n\n
That was the premise with which Carolina Pizarro D\u00edaz<\/strong>, CEO of Aura Cybersecurity and President of REDIAC, opened the panel \u00abSeconds that save lives: simulations and responses to incidents in hospital environments\u00bb at the Industrial Cyber Summit Chile 2026<\/a>, along with Cristian Donaire Bustos<\/strong>, CISO of RedSalud; Mario Alday L\u00f3pez<\/strong>, CISO of Cl\u00ednica Alemana; and Sergio Mella<\/strong>, CISO of Banm\u00e9dica Empresas Prestadores.<\/p>\n\n\n\n Pizarro opened with three real-life cases that had ceased to be hypotheses long ago: in Germany, an attack on the ventilation system forced the closure of entire wards; in the healthcare network in San Antonio, Texas, malicious instructions in an environmental control software altered the ventilation of burn and virological wards, forcing the total closure of hospitals; and in D\u00fcsseldorf, a ransomware virus diverted an ambulance and cost a patient her life. These are incidents that rarely make headlines with the same intensity as a data breach, but that today directly affect patients on the ICU or the ER, procedures that are brought to a standstill halfway through and operations that simply cannot be performed.<\/p>\n\n\n\n The question Pizarro brought to the three CISOs was what the main preparedness gap is between IT and OT when an incident occurs in healthcare. Cristian Donaire was the first to name the hidden cost of indecision: how long does it take an organization to understand that it should formally declare an incident, because every minute of delay puts the patient's life at greater risk. What was once thought of as a movie exaggeration\u2014dying from ransomware\u2014has already happened, and not just once. The underlying problem, according to Donaire, is that each area has its own continuity plan (IT, operational, cybersecurity), but those plans almost never talk to each other.<\/p>\n\n\n\n Sergio Mella was more specific about where that conversation breaks down: at the top management level, where IT and OT are still perceived as separate worlds. For years, he explained, the operations area\u2014which handles IoT infrastructure, medical equipment, and air conditioning\u2014was completely disconnected from the technology areas; only in the last decade, when those devices were connected to the network, did they begin to inherit the same cybersecurity risks that the IT world was already facing. To that is added a collateral effect of hypertechnologizing: clinics operated robustly without systems twenty years ago, and that \u00abmuscle\u00bb of working in manual mode is being lost just when it could be most needed.<\/p>\n\n\n\n Mario Alday, from Cl\u00ednica Alemana, located the gap in a similar place but with a different name: the coordination between the world of cybersecurity and technology on the one hand, and medical technology and clinical staff on the other. His concrete proposal was to scale the exercises up in levels\u2014starting by establishing the basic medical procedures well, then increasing them by turning off some specific systems, and only at a more advanced stage simulating a more comprehensive shutdown of screens and systems\u2014so that the medical staff would reach each stage already trained by the previous one.<\/p>\n\n\n\n Donaire was specific about what it means to be prepared in practice, with RedSalud centers spread throughout Chile. If an incident is declared, he explained, it is because the OT protective layer has already failed\u2014something that didn\u2019t seem likely\u2014and from there the priority is to distinguish what can be stopped temporarily and what cannot: an outpatient center may close for a few hours, but a patient in the ICU or the intensive care unit does not have that option. The protocols that support that distinction are, at their core, quite analogous: knowing how to perform a manual triage without the support of systems to determine the criticality of each patient, and having an offline pharmacy that allows knowing what medications were assigned to each critical patient even without access to the software. The key, he insisted, is that those protocols are tested and not just written in a manual that no one has opened in months.<\/p>\n\n\n\n Source: Panel \u00abSeconds that save lives: simulations and responses to incidents in hospital environments\u00bb, Industrial Cyber Summit Chile 2026.<\/em><\/p>\n\n\n\n Mella added a distinction between the private and public sectors that is worth highlighting: the typical good practice of private clinics is to maintain a system that governs production and another in standby mode, isolated and with somewhat lower capabilities, ready to take over if the main system fails. In the public sector, the challenge is different and of longer duration: maintaining legacy IoT infrastructure from the first deployments over time, without losing protocols or maintenance being cut due to budget cuts. Mella also pointed out a point that often falls outside the technical radar: in many crisis exercises, the cybersecurity team ends up working alone while the rest of the organization watches from the gallery, without the legal department or HR being activated in time, and without an internal communication plan to prevent the employees themselves from learning about the incident from the news.<\/p>\n\n\n\n Towards the end, Pizarro asked the three to choose a single priority so that the healthcare sector could prepare better. Alday focused on the response time between the incident and the direct management of the patient, automating as much as possible\u2014clinical records, data entry, pending protocols\u2014so that they could get to the side of those who need it sooner, and understanding that this had to be tested in practice, not left to paper alone. Mella went for training as the central variable: the tabletops look good on paper, but the people who execute those processes are people who under real pressure react differently, and only frequent, rigorous, end-to-end training\u2014not fragmented into parts\u2014reveals where the real deficiencies are, rather than relying on the only person who knows the entire process from memory.<\/p>\n\n\n\n Donaire closed with the most forceful image of the panel: scheduling a tabletop meeting usually clashes with the schedule \u2014 \u00bbI can\u2019t on Friday, let\u2019s do it on Monday\u00bb \u2014 but a cyberattack doesn\u2019t announce itself or get scheduled. If an earthquake leaves the CISO literally trapped under a bell, the organization has to be able to continue operating with protocols that the entire team understands, not just their leader. And that brings up a fact that any CISO in the industry should have memorized: the largest attacks statistically occur on Fridays, weekends, and the eve of dates like New Year, Christmas, or September 18, which means that a Monday-through-Friday exercise of just 8 a.m. to 6 p.m. simply doesn\u2019t prepare the organization for the scenario where the attack actually happens.<\/p>\n\n\n\n Pizarro closed the panel by recalling that this challenge is not exclusive to the health sector, but that it takes on a different urgency there because what is at stake are human lives. The same logic of rehearsing before it actually happens connects directly with the gaze of cyber resilience<\/a> That Cyber Summit is documenting in other critical infrastructure sectors, and with the reporting deadlines that the new Law 21.663<\/a> Today, it demands that any provider of essential services, including healthcare. For those who want to see how this same discipline of simulations is applied in another critical industry in Chile, it is also worth reviewing the Microsimulation of industrial ransomware<\/a> held at the same event.<\/p>","protected":false},"excerpt":{"rendered":" La ciberseguridad hospitalaria tiene una particularidad que ning\u00fan otro sector de infraestructura cr\u00edtica comparte del todo: cuando falla, no se pierden solo datos o producci\u00f3n, se ponen en riesgo vidas…<\/p>","protected":false},"author":6,"featured_media":22816,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-22815","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ciberseguridad-industrial-y-ot"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tThe gap is not technological; it is a conversational one.<\/h2>\n\n\n\n
Manual triage and offline pharmacy: protocols that cannot fail<\/h2>\n\n\n\n
CISO \/ Institution<\/th> Noted gap<\/th> Concrete measure proposed<\/th><\/tr><\/thead> Cristian Donaire Bustos (RedSalud)<\/td> Continuity plans that do not communicate between departments<\/td> Manual triage and offline pharmacy tested, not just documented<\/td><\/tr> Mario Alday L\u00f3pez (German Clinic)<\/td> Disconnect between cybersecurity and medical\/clinical technology<\/td> Exercises graded by levels of criticality<\/td><\/tr> Sergio Mella (Banm\u00e9dica Prestadores)<\/td> IT and OT still seen as separate worlds in senior management<\/td> Production system + isolated standby system as backup<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Training as the only real antidote<\/h2>\n\n\n\n