Cyber Threat Intelligence for Hospitals a A Systematic Literature Review

Hospitals are the places where society turns when the body fails, offering a continuous stream of care that keeps people alive. Because these institutions hold vast amounts of sensitive personal data and run the complex machinery that sustains life, they have become prime targets for digital attackers. When a hospital's computer systems are disrupted, the consequences are not merely financial; they can cost lives. To protect these critical facilities, security experts increasingly recommend a proactive approach known as cyber threat intelligence. Rather than simply building higher walls to keep attackers out, this approach involves gathering information about who the attackers are, what tools they use, and how they operate, then using that knowledge to anticipate and stop them before they strike. It is a shift from reacting to a breach to understanding the enemy before they arrive.

Despite the urgent need for such protection, a recent review of scientific research reveals a startling gap: there is very little specific knowledge about how to apply these intelligence methods within hospitals. Researchers from the Brandenburg University of Applied Sciences in Germany set out to understand why this is the case. They conducted a systematic search of the scientific literature, looking for any study published between 2020 and May 2025 that specifically addressed cyber threat intelligence for hospitals. They cast a wide net, searching through millions of records across major scientific databases, using terms related to hospitals, medical devices, and digital health. After removing duplicates and filtering out studies that did not fit their strict criteria, they were left with only seven publications that directly tackled the subject.

The scarcity of these seven papers tells a story of its own. The researchers found that most existing studies focus heavily on the technical collection of data—gathering raw information about attacks—but often stop short of explaining how that data is turned into useful intelligence for a hospital setting. While the studies propose various ways to gather information, such as monitoring network traffic or analyzing hacker forums, they rarely discuss the practical reality of a hospital. None of the seven papers considered the specific size of the hospital, the different departments within it, or the unique mix of standard computers and specialized medical equipment that make up a modern hospital's network. The research tends to treat hospitals as generic targets, missing the critical nuances that make them unique.

A significant portion of the existing research also struggles with a basic lack of agreement on what the terms even mean. In the world of cyber threat intelligence, different authors use different definitions for the same concepts, which creates confusion and slows down progress. Some papers define the process as a product, while others see it as a team or a set of activities. This lack of a shared language makes it difficult for researchers to build on each other's work. The authors of this review propose a clearer, unified definition to help future studies speak the same language, emphasizing that intelligence is a process of turning raw data into actionable knowledge to help defenders make better decisions.

The review also highlighted a critical disconnect between the digital world and the physical medical devices that patients rely on. While the studies mention medical devices, they rarely examine the specific types of equipment found in hospitals, such as wearable monitors, stationary imaging machines, or implanted devices. These devices often run on older software and have strict safety requirements that prevent them from being updated or monitored in the same way as a standard office computer. The existing research often overlooks these constraints, proposing solutions that might work for a bank or a university but could be dangerous or impossible to implement in a life-support environment. Furthermore, the studies rarely explore how hospitals could safely share threat information with their neighbors, such as emergency services or medical supply companies, without violating strict patient privacy laws.

Ultimately, the review concludes that while the idea of using cyber threat intelligence to protect hospitals is sound, the current research is too limited and too abstract to be truly helpful in the real world. The few studies that do exist are mostly theoretical proofs or simulations, rather than tests based on actual hospital operations. The authors argue that for this field to mature, future research must move beyond generic computer science concepts and deeply engage with the specific, high-stakes reality of hospitals. This means understanding the unique medical devices, the strict privacy regulations, and the organizational culture of healthcare providers. Until researchers focus on these real-world details, the promise of proactive protection will remain just that—a promise, rather than a practiced reality for the hospitals that keep society safe.