Google cybersecurity subsidiary Wiz has launched Scan for Good, an AI-driven initiative that has already uncovered critical security exposures at a public hospital and a private hospital, making the Wiz Scan for Good hospital exposures findings an early data point in how AI can be turned toward defense.
How the Wiz Scan for Good Hospital Exposures Program Works
The program pairs Wiz’s AI-powered Red Agent penetration-testing tool with Google DeepMind’s Gemini 3.8 Flash Cyber model to scan public-facing websites, APIs, and applications for exploitable weaknesses. Targets include critical infrastructure, public services, healthcare organizations, and nonprofits. Wiz, which Google acquired earlier this year for $32 billion, built Scan for Good in partnership with Google DeepMind and the Cybersecurity and Infrastructure Security Agency.
Why the Partnership With CISA Matters
Involving CISA gives the initiative a government partner focused on protecting critical infrastructure. Acting CISA Director Nick Andersen said defensive vulnerability discovery helps strengthen the nation’s digital infrastructure, framing the program as a public-interest effort rather than a purely commercial product.
What the Wiz Scan for Good Hospital Exposures Uncovered at a Public Hospital
At one public hospital, missing access controls exposed staff contact information and let anyone online control the hospital’s mobile alert channel, Wiz said in a Sept. 24 blog post. The alert channel is the type of system hospitals rely on for internal communication, so unauthorized control could have allowed false or disruptive messages to reach staff.
A Simple Flaw With Serious Potential Impact
The flaw involved missing access controls, a basic configuration gap rather than a sophisticated exploit, which reinforces how routine misconfigurations can create significant exposure at public-facing systems.
What the Wiz Scan for Good Hospital Exposures Uncovered at a Private Hospital
At a private hospital, an unsecured upload feature on a public appointment-booking site let attackers control a hospital server and expose patient identifiers, clinical records, and consent signatures. This finding illustrates how a patient-facing convenience feature can become a path to sensitive data when it lacks proper safeguards.
Responsible Disclosure Before Publication
Wiz worked with both organizations to fix the flaws before publishing the findings and did not name either hospital. That approach follows standard responsible disclosure practice, though it also means the findings cannot be independently verified from the public record.
Scan for Good Findings Beyond the Wiz Scan for Good Hospital Exposures
Beyond healthcare, Scan for Good has also flagged exposures at a national archive, a municipal data system, a public rail operator, and several major technology platforms, according to Wiz. The company plans to publish anonymized findings on vulnerability patterns as the program expands.
Why Pattern Reporting Could Help Defenders
Aggregated, anonymized patterns could show hospitals and other organizations which types of weaknesses appear most often, letting them prioritize their own checks even without being scanned.
What the Wiz Scan for Good Hospital Exposures Mean Going Forward
The initiative arrives amid a broader push by AI companies to support healthcare defenders, including OpenAI’s $1 billion Daybreak for Frontline Defenders program and Anthropic’s expanding Mythos access for cyber defenders. AI-driven scanning is dual-use, since the same capabilities that help defenders find flaws could help attackers, which is why the pairing with CISA and the emphasis on fixing issues before publication matter.
What to Watch Going Forward
Observers will likely watch how many additional healthcare organizations the program scans, how organizations are selected and notified, and what the promised anonymized pattern reports reveal. The source does not describe how targets were chosen, and the announcement comes from Wiz itself. Given those limits, the Wiz Scan for Good hospital exposures findings are best read as an early illustration of AI-assisted defensive scanning rather than a measure of how widespread such flaws are across hospitals.
For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed
