Healthcare and hospital systems

A hospital group's internet-facing surface is assembled from many directions at once: patient portals, appointment and telehealth systems, research and departmental sites, third-party clinical systems exposed for integration, and connected devices that somebody put on a network with an interface. Very little of it was inventoried centrally, and a lot of it was stood up quickly.

The platforms do not change by sector. What changes is which findings are urgent and how quickly they have to be closed. The pressure in healthcare is that availability and patient data sit on the same infrastructure, so an exposure is never only a confidentiality problem — a system taken offline is a clinical problem. That makes reachability, not theoretical severity, the thing worth ranking on.

What matters most here from Maphra

Maphra discovers everything your organisation exposes to the internet, decides what actually matters, and proves exploitability — continuously, without an agent and without a credential.

• External Attack Surface Management — Continuous discovery and attribution of internet-facing assets — subdomains, hosts, services, certificates, cloud endpoints and the shadow IT nobody registered.
• Comprehensive Security Analysis — TLS and certificate posture, security headers, DNS hygiene, email authentication and misconfiguration checks across every discovered asset.
• Breach & Brand Monitoring — Credential exposure in breach corpora, dark-web mentions, look-alike domains and impersonating apps — the attack paths that never touch your network.
• Threat Intelligence Hub — Advisories, CVE feeds and exploit intelligence correlated against the assets you actually operate, so a CVE only raises an alarm when it touches your surface.

What matters most here from AppSecD

AppSecD runs SAST, DAST, SCA, secret detection, IaC, container, Kubernetes and API security from one platform — wired into Git, gated at the pull request, and managed through a real vulnerability lifecycle.

• Supply chain (SCA) — Trivy and OSV across npm, PyPI, Go, Maven, RubyGems, Cargo, Packagist and NuGet, with typosquat detection, malicious-package detection, provenance checking and CISA KEV correlation.
• Static analysis (SAST) — Semgrep as primary engine plus Bandit, gosec, ESLint security, Brakeman, PHPStan/Psalm and SpotBugs with FindSecBugs — 20+ languages against OWASP Top 10, CWE Top 25 and custom rule packs.
• Infrastructure & containers — Terraform, CloudFormation, Helm, Ansible and Pulumi rules; Dockerfile hardening with image CVE scanning; Kubernetes RBAC, network policy and pod security context analysis.
• Vulnerability lifecycle — Deduplication across scans, new / reopened / fixed state, ageing and SLA, assignment, and maker-checker approval so a finding cannot be closed unilaterally.

Where to start

Discovery first, then triage by what is actually reachable. Findings that arrive with the raw evidence attached are also the ones that survive an audit conversation, which in this sector is not a secondary concern.

Maphra needs a domain name and no credentials, so the first pass costs the team nothing but the conversation. Book a walkthrough against your own estate, or read the Maphra detail and the AppSecD detail.