What happened
The Advanced Research Projects Agency for Health (ARPA-H), part of the U.S. Department of Health and Human Services, has granted $19 million to Northeastern University’s Archimedes Center to develop high-fidelity “digital twin” models aimed at improving cybersecurity across hospital networks and medical devices. The funding is part of ARPA-H’s Universal Patching and Remediation for Autonomous Defense (UPGRADE) program, which seeks to foster autonomous cyber defenses that help detect and remediate vulnerabilities more rapidly and accurately.
Who is affected
The initiative directly involves major health systems, including Michigan Medicine, Massachusetts General Hospital, Beth Israel Deaconess Medical Center, University of Colorado School of Medicine, UC San Diego, and the Michigan Center for Rural Health, and health tech partners such as Medcrypt, ForAllSecure, and Virta Laboratories. Broadly, the technology could affect healthcare IT security teams and patients served by systems that adopt these tools.
Why CISOs should care
Healthcare remains a frequent target for disruptive cyberattacks due to extensive device ecosystems and the criticality of uninterrupted patient care. Digital twins, virtual replicas of network environments and connected devices, offer security teams a way to simulate network behavior, identify likely attack paths, and test patches without risking production systems. This investment accelerates research into predictive threat detection and automated remediation, potentially shifting vulnerability management from reactive to proactive.
3 practical actions
- Evaluate digital twin readiness: Assess your organization’s current network and IoT/medical device inventory to determine where digital twin modeling could enhance visibility and risk prioritization.
- Pilot simulation tools: Identify safe non-production environments to pilot digital twin or simulation platforms that can model threat scenarios and patch impacts before deployment.
- Strengthen cross-team collaboration: Integrate IT security, clinical engineering, and biomedical device teams to align on priorities for vulnerability scanning, model validation, and remediation workflows aligned with patient safety goals.