Why EDR Is Now Standard in NZ Healthcare — and What Happens Without It

Following the Waikato DHB ransomware attack in 2021, the NZ health sector underwent a security posture review. Te Whatu Ora (Health New Zealand) subsequently issued updated information security requirements for health sector organisations — requirements that are progressively applying to DHBs and to the broader community and primary health sector through funding and contractual obligations.

Among the requirements: all internet-facing systems and all user endpoints should have endpoint protection consistent with current security standards — which, by 2023 interpretation, means behavioural EDR rather than traditional signature-based antivirus.

Why Traditional Antivirus Is Inadequate for Healthcare

Traditional antivirus works by matching files against a database of known malicious signatures. This approach has three fundamental limitations in the current threat environment:

Zero-day malware: New malware variants are created continuously. A malware sample submitted to VirusTotal for analysis is typically detected by 0–3 of 70+ antivirus engines on day one — meaning traditional antivirus across the industry collectively misses most new malware on initial exposure. Signature databases take days to weeks to incorporate new detections.

Living-off-the-land attacks: Attacks that use legitimate Windows tools (PowerShell, WMI) rather than new malware files have nothing for signature-based antivirus to detect.

Packed and encrypted payloads: Malware authors routinely use packers and encryption to transform known malware into signature-unrecognisable variants. New variants of commodity ransomware evade most signature-based detection despite being functionally identical to known strains.

What EDR Provides That Antivirus Cannot

EDR's behavioural approach addresses all three limitations. SentinelOne, for example, doesn't primarily use signatures — it monitors process behaviour in real time, identifying suspicious action sequences regardless of whether the process matches a known signature. A new ransomware variant that's never been seen before will still be detected when it begins enumerating directories and encrypting files, because that behavioural pattern is recognisable.

For healthcare providers, this difference is the distinction between an attack that's stopped before patient data is encrypted and an attack that encrypts clinical records, makes them inaccessible, and potentially exfiltrates them before anyone knows it's happening.

EDR Deployment for Community Healthcare

Optimyze deploys SentinelOne EDR for healthcare clients as a standard component of the managed IT service — covering every endpoint including clinical administration computers, reception desks, and laptops used by clinical staff. The deployment includes: automatic threat killing (no human intervention required to stop detected threats), rollback capability (encrypted files can be restored from pre-attack state), and threat telemetry flowing into centralised monitoring.

For NZ healthcare providers, the question of whether to deploy EDR has moved from "best practice" to "required by sector guidance." For practices that haven't yet made the transition from traditional antivirus, the risk of a significant incident affecting patient data and clinical operations is the consequence of delay.