On-Prem and Air-Gapped Security Operations for Hospitals and Critical Networks

On Monday, October 26, 2026, a cyberattack hit the University of New Mexico Health Sciences Center. According to UNM's own updates and reporting by BleepingComputer and the Albuquerque Journal, the health system diverted ambulances to other hospitals for about two hours, limited new admissions, and cancelled that day's scheduled appointments and outpatient surgeries. Classes at its health sciences schools were cancelled through Tuesday. UNM says its teams began containment around 11 a.m., that the event affected some end-user devices but did not penetrate core systems or servers, and that clinical operations were fully functional again by Wednesday. A ransomware group has claimed responsibility. The FBI forensic investigation is still under way.

One day later, on October 27, the White House and South Carolina launched Project Lifeline 250, a six-month pilot to help rural hospitals keep treating patients during cyberattacks, Nextgov/FCW reported.

The lesson for anyone who runs a hospital, utility, water system, carrier network or government service is the same. The bill for an attack is not only the ransom demand. It is the downtime: diverted patients, cancelled procedures, manual operations and lost trust. Security operations have to be built around keeping the service running.

That is the problem CENTARGUS was built for.

What CENTARGUS is

CENTARGUS is an AI-augmented security operations platform for critical industries and networks, from The AI Cowboys in San Antonio, Texas. It is built for energy and utilities, telecommunications, water, transportation, healthcare and government.

It works in four steps:

1. Observe. Ingest identity, endpoint, network, cloud and OT telemetry.
2. Understand. Correlate events and assess how close they are to critical systems.
3. Decide. An authorized analyst approves, modifies or declines the recommended response.
4. Record. Keep the evidence, the rationale and the decisions for audit and post-incident review.

Why operational impact has to drive the alert queue

A stolen credential, an unusual connection and a clinical workstation can look like three separate events. The risk becomes clear when an analyst can see how they connect. CENTARGUS orders the queue by what an event can do to the services that must stay available, and it shows a readable reason beside each ranking so the analyst can challenge it.

The platform keeps identity, endpoint and network evidence together so an investigation shows a sequence rather than a pile of isolated alerts. Analysts can pivot from a credential to a host to a connection without starting over, map the activity to commonly used attacker behaviors, and see which systems sit next to critical operations and sensitive data across IT, cloud and OT.

A recommendation is not an authorization

In a hospital or a control room, an automated response can do as much damage as an attacker. Isolating the wrong workstation can interrupt care or operations. CENTARGUS separates analysis from authority:

• Analysis runs continuously, but containment that could affect control systems, network infrastructure, clinical systems or other mission systems needs explicit human authorization.
• Playbooks can recommend isolation, access revocation or a hold. Rules can stop automatic disruption of control, dispatch or clinical workstations.
• The record shows who approved, who declined and why. A shift handover or post-incident review starts with a traceable record instead of reconstructed chat logs.

The platform is designed to sit behind your identity provider, including multi-factor authentication, with role-based access so operators, investigators and leadership each get rights that match their job.

Built to run where your data has to stay

Many critical environments can't send security data to a public cloud, and some have no outside connection at all. CENTARGUS is designed so core detection, investigation and approval can run on-premises or fully air-gapped. The essential workflow does not need a continuous public-cloud connection. In an air-gapped deployment there are no runtime calls to public model services. Where policy allows connections, it can use your existing identity and telemetry sources.

That matches our company's positioning: AI for machines that cannot phone home. For our wider security work, see cybersecurity and AI trust.

What we don't claim

Buyers in regulated sectors deserve straight answers. The CENTARGUS site does not claim certifications such as FedRAMP, ISO or HITRUST, named customers, guaranteed breach prevention or verified performance metrics. Accreditation is specific to each deployment and customer engagement. Public incidents like this week's are not case studies, and we do not suggest any product would have prevented a specific event. The point is what they teach: identity context, connected evidence and accountable human decisions belong in the same investigation.

What to bring to a briefing

A briefing is a focused conversation with security and operational leadership. It goes faster if you come with answers to four questions:

• Your data boundary. Where does your identity, endpoint and network telemetry live, and what must never leave the site?
• Your critical dependencies. Which workstations, services and control systems must never be isolated automatically?
• Your approval responsibilities. Who can approve, decline or hold a response, and how does that hand over between shifts?
• Your review record. What evidence does an incident review or oversight body need?

Please keep patient or customer data, credentials, network diagrams and incident details out of the contact form.

Request a briefing

Downtime costs more than a conversation. If your team protects services that can't go dark, request a CENTARGUS briefing at www.theaicowboys.com/contact and choose the "Cybersecurity & AI trust" topic. Tell us your environment, your boundaries and the decisions your team needs to make. Product details are at www.centargus.com.