Healthcare is becoming increasingly digitally dependent resulting in an increased cybersecurity threat and an elevated risk for data and functionality loss

Award Details: The University of Texas MD Anderson Cancer Center received a $3.41 million Cooperative Agreement from the Department of the Interior (Interior Business Center) under the Advanced Research Projects Agency for Health (ARPA-H, CFDA 93.384) on August 20, 2025. The award extends through August 19, 2027, and is performed in Houston, Texas.

Products and Services: Under this award, MD Anderson will develop CyberHealthIntelligence, an artificial intelligence-driven cybersecurity system that extends the Department of Energy-funded Common Weakness Enumerations (CWE) framework to healthcare environments. The project will leverage large language models (LLMs) and retrieval-augmented generation (RAG) interfaces to create an intelligence-driven system capable of identifying and mitigating cyber vulnerabilities across connected healthcare devices and hospital infrastructure at scale. The work involves eight tasks, including device identification and security classification by the UTMDACC Cybersecurity Team, LLM training on public and domain-specific data by the Cybersecurity Manufacturing Innovation Institute of Texas at San Antonio (CYMANII), and development of a self-aware, contextually informed cybersecurity system using novel LLM prompting techniques. The initiative represents a convergence of AI-driven cybersecurity and healthcare systems to address vulnerabilities that exceed current manual mitigation approaches.

The goal of cyberhealthintelligence is to extend a previously DOE funded technology common weakness enumerations (CWE) to create an intelligence CWE driven system. This technology applied to the full ecosystem of connected things in healthcare and combined with novel orchestration and machine learning capabilities will dramatically improve cyber defenses for hospital systems. The project will extend the CWE framework to healthcare using large language models (llms). A secondary objective of this proposal is to explore novel prompting with the LLM to create a self aware cybersecurity system. These objectives will be achieved through completion of eight tasks. Which includes the utmdacc cybersecurity team to identify devices to be considered and automate the output of the device security information while using data collected for training of all the llms presented. The cybersecurity manufacturing innovation institute of texas at SAN antonio (cymanii) will train the first LLM on public data obtained. The cymanii team will train other LLM teams using public data and real domain specific data collected utilizing security event and incident management data along with historical data which will create a retrieval augmented generation (RAG) interface that can work with any of the llms. IT is anticipated that collection and curation of data will be ongoing as models are being trained and refined. In total this proposed research is revolutionary because IT represents a significant leap forward in the convergence of AI driven cybersecurity in healthcare. The fundamental reality is that the sheer volume of cyber vulnerabilities cannot be addressed by current approaches. The CWE approach coupled with a contextually aware LLM informed cymanii health ATT CK annex provides the ability to scale within the healthcare setting and continue to scale as this threat continues to evolve. This revolutionary approach is necessary as one critical pillar to secure the healthcare institutions.