Landspítali is Iceland's national hospital, and it runs across more than 100 buildings and 16 locations. It may be small on a global scale, but its digital infrastructure is anything but simple. It reaches from patient care all the way through to administration, and every part of it needs strong cybersecurity.
This is a story about visibility, and about how a hospital that was once blind to its external attack surface came to watch it every single day.
Along the way, you'll hear from two people who lived it: Auður Ester Guðlaugsdóttir, Team Lead of Operations and Infrastructure, and Guðjón Hauksson, System Administrator at Landspítali.
The IT operations and infrastructure team at Landspítali carries a heavy load. It runs everything for Iceland's hospital needs, from patient systems to administration and management.
Clinical staff, understandably, spend their days on patient care, so cybersecurity sits far from the front of their minds.
The problem is that ransomware or a system failure can reach patient care in an instant.
For a long time, the team simply didn't have the budget or resources for proper security assessments. They ran external scans by hand, and only now and then, which left them blind to their own attack surface. To make things harder, they'd inherited systems with poor security practices, alongside live web portals and contractor-built sites that came with their own risks.
It's not that Landspítali had no partners. Syndis ran their security operations center, and they used services from Defend Iceland too. Those were real steps forward, but they weren't enough on their own.
The team still had very little insight into their external exposure, including leaked credentials and where staff were using work accounts online, and that turned out to be a critical gap.
Things changed when a new CTO joined in 2022. He won the internal recognition and funding that security had been missing, and he introduced the team to Aftra. They saw the value straight away, because Aftra was the only product they could find that showed both their external attack surface and their user exposure in one place. They started rolling it out in 2023.
Aftra went straight at the blind spots. It gave Landspítali:
On a day-to-day basis, these are the few features that do the heavy lifting:
Choosing Aftra also backed something the hospital cares about: a commitment to local innovation.
Landspítali is the first to say the work is never really finished. They don't chase perfect security, because they know 100% security isn't realistic.
Instead, the goal is the widest coverage they can get, so that an attacker looks elsewhere for an easier target.
Aftra keeps them focused on where they stand rather than on some idea of absolute security, and it supports their ongoing effort to shrink their attack surface and keep their footprint small.
The first is that leadership buy-in changes everything. A security-focused CTO brought both visibility and funding, and without the ear of leadership, none of it would have moved.
The second is to speak the customer's language. Cyber risk only landed once it was framed in healthcare terms, including the very real threat to patient care.
The third is to complement what already works. Aftra sat alongside Syndis and added proactive, continuous coverage instead of tearing anything out.
And the fourth is that partnerships carry the load. The results came from Aftra and Syndis working together, not from any one piece on its own.
By bringing in Aftra, Landspítali changed its whole approach to external security and became proactive. The platform added capabilities its other partnerships didn't cover, and it delivered the visibility and reporting needed to bring C-level leaders in and support the hospital's NIS2 work.
Aftra filled a gap that nothing else could. It gave the team a single view of their external attack surface and their user exposure, retired the slow manual scans, and produced reporting that leaders could follow.
It's the only product they found that covered both sides at once, and it fit their commitment to local innovation, which made the choice an easy one to stand behind.