Cincinnati Children's isn't a startup or a vendor - it's a 140-year-old nonprofit academic medical center, ranked first among all Honor Roll hospitals in the 2024-25 U.S. News & World Report survey. The attack surface here spans far beyond a typical enterprise: pediatric patient data for infants through age 21, federally funded research infrastructure (the second-largest recipient of NIH pediatric grants, with $239.1M in external research funding in FY25), and the systems that support training over 600 residents and clinical fellows annually.
That means the threat model includes everything from protecting sensitive health records under HIPAA across a multi-state footprint - Southern Ohio, Northern Kentucky, and operations reaching nationally and internationally - to securing research data pipelines and clinical education platforms. Healthcare-targeted ransomware, phishing campaigns aimed at clinical staff, and supply chain risks across medical device and research tool integrations are the daily terrain.
Security teams operating in this environment work at the intersection of healthcare compliance, academic research integrity, and patient safety. The scope isn't theoretical - it's protecting systems that directly support child health outcomes across one of the most recognized pediatric institutions in the country.
