Cindre Health
A managed SOC and NIS2 readiness programme across eleven hospital sites sharing one clinical record system.
- Sites monitored
- 11
- Median time to triage
- 9 minutes
- Detections written to their estate
- 184
- False positives, month twelve
- down 71%
The mandate
Eleven sites, one shared clinical record system, and a security team of three people covering office hours. Everything outside those hours was a phone tree.
They did not need a platform. They needed someone awake.
What we did
The first quarter was not detection work at all — it was finding out what the estate actually logged. Four of the eleven sites had no usable telemetry from their clinical workstations, and one was forwarding logs to a collector that had been full since 2022.
Detection content came after that, written against their own log sources rather than shipped as a generic ruleset. A hospital’s normal is not a bank’s normal: a radiologist opening two hundred records in an afternoon is a Tuesday, not an exfiltration.
What changed
Median time to detect went from whenever someone noticed to eleven minutes, and median time to triage to nine. The number that mattered more to their team was the false positive rate, which fell by 71% over the first year — because a SOC that cries wolf gets ignored, and an ignored SOC is worse than none.
The NIS2 evidence package came out of the same work rather than being assembled separately for the auditor.