The floor plan: how an attack moves through your hospital

The route we take most often in our hospital assessments: from the most open point of the building all the way to the patient records and the billing system.

What an attacker finds
What we test

Entrance

1

Reception

Open door, no time

2

Ward

Devices at the bedside, staff under strain

3

Corridor and network

The segmentation question Attacker's route

4

Server room and HIS

Records, billing, interfaces

We never actively attack medical devices during live operation; we test their network connectivity and remote maintenance access. The ICU, operating theatres and anything with direct patient impact are off-limits, set down in writing before the first step.

How a hospital pentest runs

Scope with patient safety in mind
Together we define what gets actively tested and what is only analysed passively. For anything with direct patient impact: when in doubt, test more cautiously.
Testing with an emergency contact
Network scans and manual testing within the agreed scope. If anything unexpected affects production systems, we stop immediately.
Report with B3S mapping
Every finding rated by severity, exploitability and impact on hospital operations, with a management summary.

Test matrix: our modules by B3S topic area

Section 391 SGB V names a BSI-approved industry standard, in practice the DKG's B3S, as a route to the state of the art. Which module covers which topic area, and where does patient impact limit the test?

Topic area	Our module	Limit set by patient impact
Network and systems security	Infrastructure Pentest	Production systems with patient impact passive only
Access and permissions management	Active Directory Pentest	No changes to production accounts
Physical security of server rooms and wards	Physical Pentest	ICU, operating theatres and patient rooms off-limits
Staff awareness and behaviour	Social Engineering and Phishing Simulation	No pretext referring to specific patients
Medical and networked devices	Custom assessment	The devices themselves are never actively attacked

Whether an area counts as met is decided by your B3S review, not our report. We deliver the technical findings and their classification.

What happened in four years

1 January 2022
Section 75c SGB V comes into force
State-of-the-art measures; since 26 March 2024 in Section 391 SGB V, without the two-year rule. The B3S is one named route.
September 2024
Wertachkliniken: a hospital without IT
Ransomware attack on the Wertachklinik group, based on public reporting.
March 2025
SiKIS documents vulnerabilities in HIS
Commissioned by the BSI, Fraunhofer SIT examined hospital information systems. The finding concerns the class of systems.
6 December 2025
NIS2 implementation act in force
The BSI Act was recast. For KRITIS hospitals the obligations remain and grow.

Among others, we work with Kreiskliniken Reutlingen on IT and medical technology security.

Questions from hospital boards and IT

Is a penetration test mandatory under section 391 SGB V?

Section 391 SGB V does not prescribe a test method; it requires appropriate measures reflecting the state of the art. A penetration test is the standard instrument to show that they work.

Can you test networked medical devices as well?

Within a tightly agreed scope. Medical devices must not be put at risk during operation, so we test network connectivity, segmentation and remote maintenance rather than the devices.

Which areas are off-limits during the physical test?

The ICU, operating theatres and anything with direct patient impact. The list is set down in writing beforehand.

What does a pentest for a hospital cost?

That depends on scope: sites, systems, medical device networks, physical and social engineering. After the initial consultation you receive a fixed-price quote.

A hospital campus has three doors an attacker actually needs

The floor plan: how an attack moves through your hospital

Reception

Ward

Corridor and network

Server room and HIS

How a hospital pentest runs

Scope with patient safety in mind

Testing with an emergency contact

Report with B3S mapping

Test matrix: our modules by B3S topic area

What happened in four years

Section 75c SGB V comes into force

Wertachkliniken: a hospital without IT

SiKIS documents vulnerabilities in HIS

NIS2 implementation act in force

Questions from hospital boards and IT

Is a penetration test mandatory under section 391 SGB V?

Can you test networked medical devices as well?

Which areas are off-limits during the physical test?

What does a pentest for a hospital cost?

The state of the art keeps moving.

Contact

Address

E-Mail

Phone

Company

Services

Regulatory pentests

Industries