Cyber Attacks Cost Hospitals $600K Per Hour, But AI Is Changing the Equation

In the past, medical facilities were less vulnerable than they are today. Hackers once followed an unwritten rule to avoid targeting institutions where disruptions could endanger lives.

That era is over. The rise of ransomware-as-a-service and the high value of stolen health data have made hospitals prime targets, leading to unprecedented levels of attack.

Alberta Health Services (AHS) is refusing to be an easy target. The healthcare system is actively strengthening its cyber defenses with artificial intelligence.

By implementing AI-enhanced cybersecurity operations via the Securonix platform, AHS has reduced its average response time to high-priority incidents by over 30%. It has also cut false positive alerts by 90% and reduced daily workloads by 2-3 hours, saving hundreds of thousands of dollars.

“Many hospital networks are big, fat, easy targets,” Richard Henderson, AHS Executive Director and CISO, told VentureBeat. “I don’t sleep much, terrified of that 2 a.m. call saying our entire system is down from ransomware.”

Performing the work of 1,000 (or more) SOC analysts

AHS is North America's second-largest hospital network and hosts the world's largest single instance of the Epic electronic health records platform.

Henderson's team is responsible for cybersecurity for 106 hospitals, 800 clinics, 20,000 physicians, and 150,000 staff serving nearly 5 million Albertans. He describes AHS as a "massive on-premises organization," with every facility connected to the same Epic system.

“If it goes down, it goes down for everyone,” Henderson noted. “It’s no exaggeration to say an outage could directly impact patient lives.”

He added that a complete Epic outage—whether from ransomware or not—could cost the province of Alberta $500,000 to $600,000 per hour.

To prevent this, AHS has deployed the full suite of the Securonix platform. This includes AI-driven threat detection, investigation, and response capabilities through its Security Information and Event Management system, which combines log management, behavioral analytics, and a security data lake.

The network ingests terabytes of data into its SIEM, leveraging Securonix's cloud-native architecture and Snowflake backend for data normalization and routing.

Behavioral analytics is core to its strategy. The platform continuously learns 'normal' patterns for users, endpoints, and systems, helping teams spot subtle anomalies, like a trusted account acting slightly out of character.

“It looks for patterns and connects the dots,” said Henderson. “You could hire 1,000 security analysts and still not have enough people to sift through all the telemetry a modern enterprise generates.”

AHS reduces resolution time and accelerates response

For example, AI tools learn standard network behavior across all hospitals. If a device unexpectedly contacts an external server, it's flagged immediately. This can reveal a misconfigured tool before it's exploited.

“Such misconfigurations have led to catastrophic ransomware outbreaks in other hospital networks,” Henderson stated.

In another scenario, a suspicious, obfuscated payload might take humans considerable time to analyze. Now, the platform can deobfuscate it and determine the attacker's intent in seconds.

“The ability to converse with a computer naturally has transformed how we view AI,” he said. “Natural language processing isn't new, but this level of sophistication is staggering.”

Consequently, AHS has significantly reduced resolution times and improved response speed. Henderson reported response times for high-priority incidents are down by more than a third compared to last year.

AI handles the heavy lifting, helping analysts comprehend threats and attacker objectives. It has become indispensable for network detection, endpoint protection, and email security. “My team saves hours daily using AI tools,” he added.

The Securonix platform has also drastically reduced alert noise, slashing false positives for junior analysts. This “boosts focus and prevents burnout,” Henderson said.

While some fear AI will replace entry-level staff, Henderson disagrees: “AI won't replace juniors. It will help them learn faster, perform better, and better protect our environment.”

Rising attacks underscore the need for education

Given AHS's vast geographic spread, Henderson's team tracks where incidents are concentrated to identify potential regional targeting.

While Calgary and Edmonton are major cities, smaller rural hospitals are often targeted under the assumption their defenses are weaker.

AI maintains a real-time dashboard of incident locations, guiding targeted outreach. Henderson dedicates significant effort to human-factor security, educating nurses and doctors about past attack methods.

“If we see a spike in attacks on rural hospitals, I'll launch an education campaign: ‘You're being targeted because they think you're vulnerable. Here's what to watch for,’” he explained.