Delhi NCR · Operating since 2002
Indian healthcare runs on systems that cannot stop. A hospital gets no maintenance window at 2 a.m., a CT scanner takes no security agent, and a patient record cannot be cancelled and reissued like a card number. This is security operations built for that reality: 24×7 analysts, telemetry from your HIS, PACS, biomedical network and Microsoft 365, and every log retained inside India.
If the model itself is new to you, start with our explainer on SOC as a Service. This page covers what changes when the estate is a hospital or a pharma company, and how our 24×7 SOC monitoring in India is delivered for clinical environments.
The threat picture
Why healthcare is now the most-attacked Indian sector
CERT-In’s incident reporting has placed health among the most-attacked Indian sectors year after year. The reasons are structural, and three matter more than the rest.
Patient data holds its value. A stolen card number dies the moment the bank cancels it. A medical record bundles identity, insurance details and diagnoses that stay true for life — which is why health records have historically sold for more than payment data.
The estate is old by design. A CT scanner or analyser is bought for a ten-to-fifteen-year life; the embedded operating system froze the day it shipped, and the HIS server beside it often runs an OS the vendor stopped supporting years ago. That is not negligence; it is how medical capital equipment works.
Operations cannot pause for patching. A bank can take a service window at midnight; a hospital cannot take one at all when the systems in question monitor patients in intensive care. Clinical uptime wins every internal argument, so unpatched systems accumulate.
Coverage
What a hospital estate actually feeds the SIEM
Detection quality is decided by what you collect. A hospital monitored only at the firewall misses the record export that mattered, so onboarding starts with a source inventory across six families of telemetry.
HIS and LIS
Admission, discharge and transfer events, logins, privilege changes and — above all — bulk exports of patient records. A query pulling forty thousand records at 3 a.m. is the most valuable alert in a hospital.
PACS and medical imaging
DICOM traffic, modality worklist behaviour and storage access, watched passively because the modalities cannot run agents.
Biomedical devices
Infusion pumps, patient monitors and analysers. No software touches the device; we baseline each device class and alert when one starts talking somewhere it never has before.
Pharmacy and billing
Drug inventory movements, high-value claim manipulation and billing tampering — fraud telemetry most security programmes ignore as “finance’s problem”.
Microsoft 365 and identity
Email is still where most incidents begin: sign-in logs, MFA fatigue, mailbox forwarding rules, impossible-travel alerts.
Network and perimeter
Firewalls, the VPN concentrators carrying remote clinicians, and the wireless segments shared by staff, patients and devices — the seams where segmentation either holds or does not.
Collection runs on our PrahiX Ora platform, on FortiSIEM, or on a SIEM you already own — the source list matters more than the logo. The monitoring function behind it is described on our SOC as a Service page.
The decision nobody wants to make
The ransomware calculus — why hospitals pay, and how detection shortens the decision
Hospitals pay ransoms more readily than almost any other sector, and it is worth being honest about why: their downtime is measured not in lost files but in diverted ambulances, cancelled surgeries and patients moved on paper charts. Attackers know this arithmetic as well as hospital boards do.
The real decision at 3 a.m. is not “pay or don’t pay”. It is “how many systems are encrypted, how long will restoration take, and can we run the emergency department meanwhile?”. Each question is answered better the earlier the intrusion was caught. Detected at the phishing email, it is one mailbox. Detected at lateral movement, it is a VLAN isolated and two servers rebuilt. Detected at encryption, it is a board meeting about the ransom. Detection does not remove the calculus — it moves it to a point where the numbers are survivable.
“We are a 120-bed nursing home — too small to be a target”
Ransomware distribution is opportunistic. The scan that finds an exposed remote-access port does not check bed count, and smaller hospitals are attractive precisely because their defences and backups are thinner.
“Paying the ransom restores operations”
Attacker-supplied decryption is slow, frequently partial, and says nothing about whether the stolen records were already sold. Paying resolves the extortion pressure, not the incident.
The decision window is set by detection speed
Dwell time — the gap between initial access and encryption — is typically days, not minutes. A monitored estate spends those days investigating; an unmonitored one spends them being mapped.
Medical devices
You cannot install an agent on a CT scanner — so we don’t try
Regulated medical devices run embedded operating systems under vendor warranty and clinical certification. Installing third-party software on them is usually not permitted at all, so monitoring has to happen from the network.
Our device-layer monitoring is passive. We mirror device-segment traffic from SPAN ports or taps, identify each device from its behaviour, and baseline what normal looks like per class — which servers a monitor talks to, on which ports, how often. Detection is then deviation: a device reaching the internet for the first time, a new host on the clinical VLAN, a scanner suddenly speaking a protocol it never used. Nothing touches the device, so warranty and certification stay intact.
Around that we engineer the controls the devices cannot provide: segmentation keeping the biomedical network away from guest Wi-Fi, controlled jump-host access for vendor maintenance engineers, and virtual patching at the intrusion-prevention layer for the device that will never receive a real one. Our compliance services team documents these as compensating controls — exactly how auditors expect legacy medical systems to be handled.
India, specifically
DPDP, ABDM and the obligations a hospital cannot delegate away
The DPDP Act 2023 treats health data as personal data, full stop. Every hospital, diagnostic chain and clinic processing it is a data fiduciary — and the Act contains no small-hospital exemption. Size changes the penalties you can absorb, not the obligations.
Three duties land directly on hospital IT. Reasonable security safeguards — the Act’s schedule prices failure at up to ₹250 crore per instance. Breach notification to the Data Protection Board of India and to every affected patient. And accountability for your processors: the HIS vendor, the cloud hoster and the SOC provider all sit under your responsibility — so the SOC’s certification and log-handling are your problem, not theirs.
Alongside DPDP, CERT-In requires specified incidents reported within six hours of being noticed and logs retained for 180 rolling days within Indian jurisdiction — both satisfied as a by-product of a monitored estate. Meanwhile the Ayushman Bharat Digital Mission is wiring hospitals into ABHA identifiers and consent-managed record exchange: every integration is new API surface, and the National Health Authority’s health-data policies already expect participating facilities to run security monitoring. Outsourcing the monitoring is permitted; outsourcing the accountability is not.
Pharma and research
Pharma and clinical research: a different adversary entirely
A hospital worries about ransomware because it stops operations. A pharmaceutical company or CRO worries about a quieter adversary, because what it holds — formulations, bioequivalence studies, trial data, regulatory submissions — is worth more copied than encrypted.
The monitoring emphasis shifts accordingly. Egress and data-movement detection on R&D and QC networks matters more than commodity malware signatures. Endpoint telemetry on scientist workstations, access patterns around the document system holding submission dossiers, and intrusions that dwell for months are where the real risk sits. Manufacturing adds a second estate: formulation lines and cleanroom controls are operational technology with the same no-agent constraints as medical devices, monitored the same passive way.
What does not change is the model: one platform, one roster, and analysts who know an unusual 40 GB upload from a formulation server is a different emergency than the same upload from a backup system. That judgement — not tooling — is what a healthcare SOC is actually selling.
Money
What it costs a 200-bed hospital, against the in-house alternative
We do not publish a tariff because the honest figure depends on log volume, monitored assets and sites. What we can publish is the other side of the comparison, so the arithmetic is on the table before anyone quotes you.
Covering one console seat continuously is 8,760 hours a year. One analyst, after leave, public holidays and training, delivers roughly 1,900 productive hours — so one seat needs about 4.6 people, and you hire five or six to survive a resignation. A credible three-tier roster comes to roughly ₹1.4 crore a year in base salary, before recruitment, facilities and the SIEM licence. No 200-bed hospital can justify that against clinical staffing — the subscription model exists precisely to share those specialists across many estates.
Scroll the table sideways →
| Item | Built in-house, 200-bed hospital | SOC as a Service | The honest catch |
|---|---|---|---|
| People | 5–6 hires for one seat; ~₹1.4 crore/yr for a real three-tier roster | Shared roster across many estates, included in the subscription | The provider must learn your estate — onboarding is weeks, not a switch-flip |
| Platform | SIEM licence scaling with data volume, plus threat-intelligence feeds | Included, or run on a SIEM you already own | Log volume is the main cost driver either way — scope it before signing |
| Night cover | The seats most likely to be vacant, cut or fictional | The entire point of the model — same tiers at 3 a.m. as 3 p.m. | Confirm containment authority in writing, not just monitoring |
| Time to value | 12–18 months of hiring and tuning before detection is trustworthy | Meaningful coverage in four to six weeks, on proven detection content | Device baselining still takes real weeks — distrust day-one promises |
For a single hospital the subscription typically lands at a fraction of the in-house floor; chains share one deployment and the per-site cost falls further. The line-by-line cost drivers are in our guide to SOC as a Service pricing in India. We will scope your estate and quote a specific monthly figure with this comparison beside it.
Straight answers
SOC as a Service for healthcare, answered
Can you monitor medical devices without installing agents?
Yes, and for regulated devices it is the only legitimate way. We monitor passively — mirrored traffic from SPAN ports or taps — baselining each device class and alerting on deviation: a device reaching the internet for the first time, a new host on the clinical VLAN, an unexpected protocol. Nothing is installed on the equipment, so warranty and certification stay intact.
Does the DPDP Act apply to hospitals?
Yes. Health data is personal data under the DPDP Act 2023, and every hospital, diagnostic chain and clinic processing it is a data fiduciary. There is no small-hospital exemption: consent, security safeguards and breach notification to the Data Protection Board and affected patients apply regardless of size. Large chains may additionally be designated Significant Data Fiduciaries, adding audit and DPO duties.
What does SOC monitoring cost for a hospital chain?
It is scoped per estate — log volume, monitored assets, number of sites — so we quote after scoping, not before. The benchmark is the alternative: a genuine in-house 24×7 roster costs roughly ₹1.4 crore a year in base salary alone. A single-hospital subscription typically lands at a fraction of that, and chains share one deployment, so per-site cost falls. The cost drivers are itemised in our SOC as a Service pricing guide for India.
Are patient logs stored in India?
Yes. Security logs are retained for a rolling 180 days within Indian jurisdiction, as CERT-In requires, and our platform and analysts are in India. Residency rules govern where data sits, not where analysts sit — ours are in Delhi NCR, which helps response time and context, but that is an operational advantage rather than a legal claim.
How do you handle systems that cannot be patched?
By controlling the blast radius you cannot remove. The unpatched HIS server or legacy modality gets segmentation limiting what can reach it, virtual patching at the intrusion-prevention layer, strict connection allow-listing, and heightened detection rules watching it specifically. The vulnerability stays; exploiting it becomes visible and contained. Auditors recognise this as compensating controls, which we document accordingly.
Can you monitor our HIS?
Yes. Hospital information systems used in India generally expose syslog, database audit trails or both, and we integrate read-only — we never modify the application or its database. The detections that matter are admission/discharge anomalies, privilege changes, and especially bulk patient-record exports outside normal patterns. If your HIS vendor restricts log access, that is a contract question for them, and we can tell you what to ask for.
How long does onboarding take for a hospital?
First log sources are ingested within days, and meaningful coverage — identity, email, network, HIS — is in place within four to six weeks. The honest constraint is tuning, plus the extra weeks of passive baselining medical-device segments need before deviation alerts are trustworthy. Anyone promising reliable detection on day one is describing alerting, not detection.
Who responds if ransomware hits at night?
An L2 analyst validates the alert and opens the case, and for a P1 you get a phone call — not an email into a shared mailbox. What follows matches the authority agreed in the contract: monitoring-only means we advise and you act; full response means we contain first — isolating VLANs, disabling accounts — and tell you immediately. That boundary is agreed at contract stage, because 3 a.m. is the wrong time to negotiate it.
Next step
Find out what your hospital would cost to monitor
We will scope your log sources, device segments and sites, quote a specific monthly figure, and put the in-house comparison next to it. If a co-managed model or a SIEM you already own fits better, we will say so.
P J Networks Pvt Ltd · C-160, Mayapuri Phase II, New Delhi 110064
+91 98183 61787 · sanjay@pjnetworks.com
Related
Related to SOC as a Service for healthcare: the main SOC as a Service page, 24×7 SOC monitoring in India, SOC as a Service pricing in India, our SOC services and SLA, managed SOC services, managed SIEM, and compliance services for DPDP and CERT-In obligations.