Healthcare Cybersecurity: AI-Enhanced Next-Gen Firewalls

Healthcare organizations face an increasingly complex challenge in protecting sensitive data as cyber threats grow more sophisticated. Cybercriminals are becoming adept at evading detection, often using less aggressive tactics like compromised login credentials, according to IBM. The sheer volume of attacks is staggering; Microsoft, for instance, reports blocking 600 million cyberattacks daily. Moreover, while artificial intelligence (AI) enhances productivity across industries, it also provides hackers with powerful new tools.

To counter these evolving threats, organizations are increasingly turning to AI-enhanced next-generation firewalls (NGFWs) as a critical component of their overall security infrastructure. Vince Tsugranes, chief architect at Red Hat, explains the transformative role of AI: “AI acts as the brain of the next-generation firewall, moving beyond the static, rule-based logic of previous generations. This cognitive capability allows the firewall to not only enforce policies but also understand the nuances of network traffic, anticipate future threats and adapt its defenses in real time.”

Why Traditional Firewalls Fall Short in Healthcare

Traditional firewalls typically offer insufficient protection in today’s modern cybersecurity landscape due to their simplistic design. They operate much like a single security guard checking IDs at a front door but lacking the ability to monitor activities once inside the building. A traditional firewall permits or denies online traffic based on basic parameters such as IP addresses and port numbers. If a hacker gains access to a hospital’s electronic health record (EHR) system through an allowed port, a traditional firewall might fail to detect suspicious activities that follow, such as the exfiltration of critical information.

In contrast, an NGFW utilizes deep packet inspection to analyze the content and origin of online traffic. In the EHR example, an NGFW could be configured to allow access through a specific port only if the traffic originates from a trusted application, such as Epic or Oracle. It could also prevent users from uploading data to unauthorized third-party applications. Beyond enhanced security, NGFWs can also aid in ensuring HIPAA compliance by providing precise monitoring of access controls for protected health information (PHI) and implementing encrypted traffic inspection to prevent patient data from being illicitly removed.

The Strategic Role of Next-Generation Firewalls

NGFWs are not isolated solutions but rather a crucial element within a comprehensive, platform-based cybersecurity strategy. Experts emphasize that these firewalls should be integrated throughout an organization’s internal systems, extending beyond just the network perimeter.

Tsugranes highlights this shift, stating that security protocols need to “make it down to the application level. That’s way more than just host-based firewalls and intrusion prevention systems. It’s traffic management between application components, containers and functions, which is about as granular as we can get.” Rick Miles, vice president of product management for cloud and network security at Cisco, foresees NGFWs evolving into “a distributed firewalling solution,” stressing the necessity of ensuring security at every layer, “from a box at the edge of a data center to applications deployed in the cloud.”

This distributed approach is vital for containing threats. For instance, if a workstation in a radiology unit becomes infected by ransomware, and an attacker attempts to exploit this vulnerability to access other parts of the hospital’s network, a distributed firewall with a microsegmentation policy could isolate the radiology workloads. This prevents the hacker from reaching other critical systems, such as the EHR.

AI-Enhanced Firewalls, Alert Fatigue, and Staffing Challenges

Pairing NGFWs with AI not only strengthens an organization’s security posture but also helps alleviate the workload on cybersecurity professionals. AI-powered tools from leading vendors such as Fortinet, Juniper Networks, Palo Alto Networks, and Splunk can analyze traffic patterns, identify irregularities, and deploy automated responses—like stopping a suspicious data transfer—much faster than a human analyst could.

This type of automated reaction is crucial for preventing “alert fatigue” among IT teams. Agentic AI can investigate and respond to lower-risk issues, such as blocking a phishing email to a single user, thereby freeing human employees to concentrate on more complex, organization-wide threats. While AI significantly augments security capabilities, Tsugranes believes humans will always be responsible for defining an organization’s specific security policies. He notes that even with enhanced AI tools implementing protocols, “ultimately, the company’s still responsible for what happens.”

How Cybercriminals Are Using AI to Bypass Security

The adoption of AI-enhanced NGFWs has become imperative to combat increasingly sophisticated hacking techniques. Cybercriminals are leveraging AI to build convincing profiles that mimic legitimate accounts, making their infiltration tactics less detectable to firewalls. The speed at which hackers can develop and deploy attacks has also accelerated due to AI. McKinsey reports a staggering 1,200% surge in phishing attacks since late 2022, coinciding with the public availability of generative AI tools like ChatGPT.

Miles warns that this new reality demands rapid organizational response to vulnerabilities. “It forces companies to think about new ways to reduce risks. Let’s adapt to that threat landscape and allow organizations to drive distributed exploits and patching within seconds instead of months,” he urges. He envisions “deploying a distributed exploit protection directly on the application itself that eliminates that attack path entirely but still allows the application to function.”

Finally, Tsugranes reminds IT professionals that NGFWs are not “set it and forget it” tools. Continuous monitoring of logs, establishing a feedback loop for teams to report issues, and regularly auditing policies are crucial to ensuring effectiveness, efficiency, and ongoing adaptation to new threats. This proactive and continuous process is essential for minimizing security risks in the dynamic healthcare environment.