Why Build Another Security Platform? Navigating the Noise in Healthcare Cyber Defense
Independent clinics today are drowning in a sea of telemetry. They don’t need another SIEM, another vulnerability scanner, or another high-level dashboard that prioritizes vendor lock-in over actionable insight. What they actually need is a reliable translation layer—a bridge between complex, raw technical data and the harsh reality of their daily business operations.
ResilAI was built to answer one fundamental, mission-critical question: “Can this clinic safely operate today?” To provide an answer that healthcare providers can actually trust, we chose to rely on the bedrock of deterministic math rather than the unpredictable nature of LLM inference.
Technical Architecture Overview
We’ve focused on a clean, maintainable stack designed to handle high-frequency data ingestion while remaining modular for rapid deployment in clinical environments.
- Frontend: React + Vite + TypeScript for a lightning-fast, reactive user experience.
- Backend: FastAPI Core, chosen for its asynchronous capabilities and high performance.
- Database: Cloud SQL (PostgreSQL) for production, with SQLite support for local development.
- AI Layer: Google Gemini 1.5 Pro (Restricted to narrative and summarization tasks only).
Core Components: The Engine of Resilience
1. The Connector Ingestion Layer
Our platform pulls normalized evidence from critical infrastructure points including Splunk, Wazuh, Elastic, Okta, various backup systems, and major cloud providers. A core design philosophy here is that these connectors are intentionally “dumb”—their only responsibility is transport. They never attempt to weigh, score, or calculate risk.
2. The Capability Engine (Deterministic Rules)
This is where the heavy lifting happens. We evaluate ingested evidence against standardized frameworks such as NIST CSF 2.0, CIS Controls, OWASP, internal lifecycle rules, and specific SLA requirements. By keeping this layer separate from AI:
- We eliminate hallucinations in risk assessment.
- We ensure there is no severity inference bias.
- We guarantee that scores are never subject to black-box manipulation.
3. The Business Moment Engine
Data is useless if it doesn't lead to action. Our engine transforms dry technical findings into human-readable risks by articulating the "So What?" for non-technical stakeholders:
- Context: What specifically happened.
- Relevance: Why it matters to clinical uptime.
- Operational Cost: Estimated fix time and resource requirements.
- Verification: Direct evidence references.
- Remediation: Clear, binary action items.
4. The AI Narrative Engine
We leverage Google Gemini exclusively for the final mile: executive summaries, plain-English explanations, and structured remediation instructions. We maintain a strict policy—LLMs are explicitly banned from the scoring pipeline. By decoupling the "what" (scoring) from the "how" (reporting), we maintain institutional integrity.
The Governance Health Index (GHI)
The GHI serves as our "North Star" metric for clinic readiness. It is a weighted, transparent calculation:
GHI = (Audit Score × 0.4) + (Lifecycle Score × 0.3) + (SLA Gap Score × 0.2) + (Compliance Score × 0.1)
This model offers three distinct advantages:
- Fully reproducible: You can run the math yourself and get the same result every time.
- Fully transparent: There is no hidden heuristic or "proprietary secret sauce" affecting your status.
- Fully auditable: Every point in the GHI can be traced back to a specific log entry or system configuration.
Why This Matters for Modern Healthcare
The healthcare landscape is rapidly shifting toward AI-integrated assistants, cloud-first workflows, and remote MSP support, all while navigating a tightening regulatory environment. When a clinic’s ability to treat patients is on the line, they require deterministic readiness—not probabilistic AI guesses.
By grounding our platform in verifiable math, we provide the clarity required to keep the lights on and the data safe.
Top comments (0)