Cyber security
Information security remained a priority for Amsterdam UMC in 2025. Cyber threats continued to intensify: state-sponsored actors are increasingly targeting patient data, medical research and the disruption or blackmail of healthcare organisations. The use of generative AI in cyberattacks is also on the rise, as is the number of incidents occurring through suppliers and digital supply chains. This makes vulnerabilities in the supply chain almost as critical as the security of our own infrastructure.

To tackle this, Amsterdam UMC further reinforced its cyber resilience programme in 2025 and will need to continue working on resilience from 2026 onwards, having also planned the necessary investments required for this. The focus was on threats from state-sponsored actors and on the use of AI-supported detection and response. The CERT (Computer Emergency Response Team) has been further developed into a central coordination point for monitoring, incident response and threat intelligence. Targeted campaigns, training and phishing simulations have also been used to make staff aware of the part they can play in limiting risks.

Amsterdam UMC also achieved significant milestones in 2025 in the areas of certification and legislation and regulations. Certification for the new NEN 7510:2024 and ISO 27001:2023 standards has been completed, and preparations for the Cybersecurity Act (Cyberbeveiligingswet) (NIS2) are well underway. Amsterdam UMC therefore remains well-placed to ensure the availability, integrity and confidentiality of data and services in a digital healthcare environment that is becoming increasingly complex thanks to AI, supply chain dependencies and geopolitical tensions.

Knowledge security
International collaborations provide Amsterdam UMC with opportunities in the core tasks of healthcare, research, education and training, and valorisation, but they also come with risks. Knowledge and innovation are increasingly being used as tools of power and this calls for vigilance. The present geopolitical developments

underline the importance of strengthening knowledge security. The risks include the unwanted transfer or theft of knowledge, technology, materials and data, espionage, phishing and covert influencing by state-sponsored actors or third parties. Amsterdam UMC applies the principle: ‘open research where possible, protecting knowledge where necessary’. The aim is to enable legitimate knowledge transfer while preventing undesirable risks. Amsterdam UMC follows the central government’s National Knowledge Security Guidelines and current legislation and regulations. Amsterdam UMC also collaborates with VU and UvA to ensure knowledge security.

Significant steps were taken in 2025 to strengthen knowledge security further at Amsterdam UMC, one example being an awareness-raising communication campaign. The internal knowledge security helpdesk was opened and provides staff with questions about knowledge security with advice and support. Drawing up guidelines for foreign business trips is part of the process to reinforce knowledge security. The knowledge security policy framework was also adopted and implemented in 2025. It provides managers and researchers with tools enabling them to identify and control risks in international collaborations in a timely manner. Lastly, a knowledge security check has been introduced for the recruitment and selection of international researchers and PhD students to ensure that potential risks are identified at an early stage and carefully assessed. With these measures, Amsterdam UMC is ensuring that international collaboration can take place safely and responsibly.

Amsterdam UMC will continue to develop its risk management framework in the coming period to enable risks to be identified in a timely manner and appropriate control measures to be taken in an increasing complex digital, social and geopolitical environment.