Cybersecurity and Privacy

Session Focus

Lee framed the session as the other half of the Forum’s story. Most of the program concerns what AI makes possible in medicine. This panel concerned trust, on the grounds that no innovative technology gets rolled out without it, and that trust in healthcare rests on robust cybersecurity and privacy guardrails.

He was explicit that the session would not be doom and gloom, and would focus instead on practical considerations for the year ahead. The panel brought together the health system view, the manufacturer view and an analyst’s cross-industry perspective.

What Changed This Year

Tal Liani, who has covered cybersecurity for roughly 25 years, opened with a joke about having the best job security at his firm, since the problem never gets solved. His reasoning: a cure for cancer will arrive before a solution to cybersecurity, because the problem never stays the same.

What changed in the last year is agentic AI. He illustrated with a consumer example deliberately outside healthcare.

When you buy something online you are typically interacting with a commerce platform managing your cart. An AI agent can now do that for you, handling product discovery, negotiating and buying automatically at a price threshold you set.

For that to work, two things must happen. You grant the agent permission to act on your behalf, and the platform must enable an agent to purchase and pay.

The risk follows directly. How do you know the agent is legitimate? How do you know it is doing what it is supposed to do? What happens if it goes out of alignment and starts buying everything available with your credit card on file?

His general conclusion: as the world gains new ways to communicate, manage and become more efficient, the cybersecurity problem only grows.

Jane Moran named a different concern, and noted she would not have given this answer a year ago. Assuming positive intent across all Mass General Brigham employees, people may not realize that a tool or agent they subscribe to puts organizational data at risk. Her conclusion was that governance and education now matter more than any technical control, because eliminating the risk technically is the hardest problem.

Julia Strandberg identified the speed and scale at which cyber risk now translates into patient safety risk. As clinicians adopt technologies for clinical, operational and financial use, those tools become embedded in workflows and the attack surface grows substantially.

Her point as a manufacturer was that she can no longer manage only her own portfolio as deployed into a health system. She has to think about how her technology connects with the wider ecosystem and the health system’s infrastructure. Given that the problem will not be solved, the goal becomes cyber resiliency: durability and sustainability of the system so it can keep moving forward.

Zero Trust and the Agent Problem

Liani traced how identity security evolved. It used to be that connecting to your workplace meant receiving a code by text and entering it. At that point you were in, and once trusted you could cause damage.

Until roughly two years ago, the single biggest risk factor was the employee. An email arrives, someone clicks and opens a file, and an intruder is inside.

Zero trust changes the premise. Even after verifying identity, the system does not trust the user. It travels with them everywhere and inspects what they do. Are you allowed to make this purchase? To access this data? To use this credit card?

His analogy: at a bar, you present ID to the bouncer and are let in. Under zero trust, the bouncer has to accompany you and make sure you do not drink too much, do not fight and do not cause trouble.

The reason this matters now is scale. Instead of employees, an organization may have thousands or hundreds of thousands of agents taking independent actions it explicitly permitted because they create efficiency.

Moran extended the concern specifically. Agents act independently, which means one agent could call another and request a password reset for a third system. Treating every agent like an employee under HR-style monitoring is a reasonable starting point, but the oversight has to be real.

Why Defenses Expire

Liani illustrated the pattern with a company he took public. Incoming email was not delivered directly to the recipient. It went first to a sandbox that imitated the recipient’s screen and computer, and the system watched what the email tried to do. Attempting to open a file, launch a spreadsheet or retrieve data identified it as an intrusion rather than a real message.

Within nine or ten months, intruders adapted. Having worked out that an email sits in the sandbox for around six minutes, they instructed their attacks to do nothing for ten minutes before acting. The systems stopped detecting them.

He tracked the market consequence dryly: the stock went from ten dollars to ninety, then back to ten.

His conclusion is that cybersecurity requires advancing at the pace of the threat, ideally a step ahead. Anything slower opens gaps.

Getting to Yes in a Health System

Lee asked Moran how a health system with an enormous number of connected devices and sensitive patient data says yes so that researchers and clinicians can use AI productively.

Her answer began with the alternative. If the posture were to shut everything down, nothing would ever happen. Mass General Brigham maintains layered defenses across network, databases and application stack.

The biggest unlock in the past year was not technical. It was education and training, evolved from existing programs, combined with a structural step: a ring-fenced environment the organization calls the AI zone, where clinicians can use large language models safely without exposure to the open internet.

She noted the current tension honestly. The organization would like to open internet access but remains concerned about patient data, and expects to work through that.

Where the Market Is Heading

Liani closed with what he tells investors. The direction is away from single-purpose tools and toward platforms that connect identity, endpoint and data protection under one detection engine.

Strandberg’s parallel point for manufacturers was that security can no longer be scoped to a single product line, because the deployment environment is a connected ecosystem.

Key Takeaways

1. Agentic AI is the year’s change. Permissions granted to agents become the attack surface.

2. Governance and education now outrank technical controls. Moran said she would not have given that answer a year ago.

3. Zero trust means supervision after authentication, not better authentication.

4. Cyber risk converts to patient safety risk at speed. Embedded clinical workflows make the two inseparable.

5. Every defense has a shelf life. The sandbox example expired within ten months of deployment.

6. Ring-fencing enables adoption. A safe internal environment let clinicians use LLMs without exposing patient data.