Modern hospitals may have thousands of network-connected medical devices that do everything from monitoring patients’ hearts to infusing lifesaving drugs. Protecting those devices from cybersecurity attacks is a time-consuming task for information security (InfoSec) staffs at every hospital.
 

A new project underway at Georgia Tech aims to help hospital staff protect those devices while providing critical information about the overall security of the networks on which they operate. Funded by the Advanced Research Projects Agency for Health (ARPA-H), the Hospital-Integrated Vulnerability Identification and Proactive Remediation (H-VIPER) project will help hospital InfoSec staff find, track, and fix potential security risks in medical devices used to deliver patient care. 
 

“Today, it is very hard to know which devices are vulnerable, how urgent each vulnerability is, and whether fixing a device might disrupt patient care,” said Brendan Saltaformaggio, the project’s principal investigator and an associate professor in Georgia Tech’s School of Cybersecurity and Privacy and School of Electrical and Computer Engineering. “H-VIPER will create a digital twin of a hospital’s network and devices, giving InfoSec teams a safe way to proactively find vulnerable devices, build and test fixes, and understand the impact of those fixes before deploying them.”
 

Easing the Cybersecurity Burden on Hospital Staff
 

The challenge of protecting medical devices can be complex because hospitals often use equipment from multiple manufacturers that rely on different software versions with varying potential vulnerabilities, noted Trevor Lewis, a principal research scientist at the Georgia Tech Research Institute (GTRI). As part of a collaboration with other Georgia Tech units, GTRI researchers are developing a tool, the Vulnerability Mitigation Platform (VMP), that will show the status of each medical device in a hospital’s inventory.
 

“Our goal is to reduce the burden on hospital staff by providing solutions to help them more quickly identify, track, and mitigate vulnerabilities, especially when critical software patches are released,” Lewis explained. “This is an issue for small rural hospitals all the way up to large, super-sophisticated organizations.”
 

The VMP would be able to operate within each healthcare facility’s unique IT infrastructure, using small network sensors deployed throughout the system to detect changes in the cyber environment that could point to security concerns. It will automate inventorying of patient-focused medical devices, mapping points where attackers could compromise the hospital networks. It will also identify both equipment vulnerabilities and the updates available to counter those threats. 
 

As part of the VMP development process, GTRI is working with three Georgia healthcare systems: Children’s Healthcare of Atlanta, Dalton-based Vitruvian Health, and Atlanta-based Emory Healthcare. The partnership will enable the researchers to test the VMP in diverse healthcare settings.
 

The GTRI team includes approximately 20 researchers with specialties that include medical devices, software development, and artificial intelligence. The researchers are already testing infusion pumps typical of those used in hospital emergency rooms, trauma centers, intensive care units, and other treatment settings. They are also developing a network testbed that can provide information on each device and how it interacts with the overall system.
 

Setting the Stage for Proactive Security
 

This project could set the stage for more advanced research to help hospitals stay ahead of malicious actors.
 

“The next step will be to make hospital cybersecurity truly proactive: not waiting for attacks, alerts or emergencies, but continuously finding risks and fixing them before they affect patient care,” said Saltaformaggio. “Long term, we want to get H-VIPER into hospitals across the U.S., but that will require continued federal investment in fundamental research. Healthcare cybersecurity has unique challenges that will require novel science to solve.”
 

Support for the overall project could total $12 million over three years. The first phase began in September 2025 with $4.9 million in funding.
 

Taking Advantage of Georgia Tech’s Strengths
 

Saltaformaggio says the project demonstrates the role that Georgia Tech can play in taking advantage of the Institute’s strengths in cross-disciplinary research and collaborations with outside entities. 
 

“H-VIPER brings together academic researchers pushing the science of cybersecurity with GTRI researchers who understand complex, mission-critical systems,” he said. “Through our close partnership with Children’s Healthcare of Atlanta, we are developing novel solutions designed to work in real hospitals. That combination lets our team build technology that is ambitious, practical, and grounded in real patient-care environments.”
 

What will this effort ultimately mean to hospital patients?
 

“With these improvements in place, hospitals will have greater confidence that the medical devices providing care are protected from potential vulnerabilities and their hospital staff can quickly address any identified threats,” Lewis said. “This will allow hospital clinical staff to focus on their first priority: providing patient care.”
 

About GTRI: The Georgia Tech Research Institute (GTRI) is the nonprofit, applied research division of the Georgia Institute of Technology (Georgia Tech). Founded in 1934 as the Engineering Experiment Station, GTRI has grown to more than 3,000 employees, supporting eight laboratories in over 20 locations around the country and performing more than $1 billion of problem-solving research annually for government and industry. GTRI's renowned researchers combine science, engineering, economics, policy, and technical expertise to solve complex problems for the U.S. federal government, state, and industry.

Writer: John Toon (john.toon@gtri.gatech.edu) 

GTRI Communications
Georgia Tech Research Institute
Atlanta, Georgia USA