Customer story: How a French hospital eliminated its network blind spots with Jizô AI

"We needed to see what neither the EDR nor the firewall could see. The network was our last remaining angle of attack and our final blind spot." — CISO & Head of Infrastructure

Sector — Healthcare · Hospital

Scope — ~2,500 IPs · 1,050 workstations · 300 servers · a growing biomedical device fleet

IT team — 15 people, including 4 technical administrators

Deployment — ~1 day

Operating model — Managed probe via partner integrator

The context

This French healthcare facility, an operator of essential services (OES) under the NIS Directive, runs a dense information system of roughly 2,500 IPs. Beyond traditional workstations and servers, its estate includes a growing share of connected biomedical devices: laboratory analyzers, imaging equipment, and clinical sensors on which no EDR agent can be deployed.

The IT team of 15, primarily focused on support and applications, has only 4 technical administrators to run the infrastructure.

No in-house 24/7 monitoring capability.

The wake-up call: 12 days of blind spot

The incident that reshaped their perception of risk: a laboratory analyzer infected during a maintenance operation. Sealed by design, agentless, with no possible visibility, it took the hospital 12 days to notice. The EDR and perimeter firewall had seen nothing. Only the network could have betrayed the compromise.

The challenges

Three major constraints framed the decision to equip the facility with a network probe:

Cover non-instrumentable assets: biomedical devices, analyzers, and shadow IT on which nothing can be installed.

Choose a sovereign French solution, a condition for eligibility to the public funding mobilized (France Relance, regional programs).

Add zero extra load on the IT team: no 24/7 monitoring, no ramp-up on a new console.

The Jizô AI solution

After several comparative studies between 2019 and 2022 (open-source, American, Israeli, and French solutions), Jizô AI was selected for three decisive differentiators:

Detection natively driven by AI. Where the competitors evaluated relied almost exclusively on static rules, Jizô combined rule engines, indicator aggregates, and artificial intelligence from the outset. The result: alert pre-triage that removes the noise before it reaches the analysts.

A sovereign French architecture. French vendor, French integrator: a non-negotiable prerequisite for a healthcare OES and a condition for access to public funding.

A turnkey managed model. Traffic supervision and analysis are handled by a partner integrator, removing the barrier to entry for facilities without an in-house SOC.

On-site deployment: about one day, with cabling and rack mounting accounting for most of the time. No disruption to operations.

The results

"With Jizô, things that were supposed to have been fixed by our vendors hadn't been. The probe proved it to us."

Full visibility over biomedical devices and analyzers previously invisible to the tools in place.

Detection of a residual Java vulnerability on a vendor solution declared patched: a persistent risk invisible to the other tools.

Control over generative AI usage: detection of user attempts to bypass the blocks placed on AI tools — a use case that has become central, preventing leaks of sensitive data.

Compliance and data-leak alerts: abnormal outbound volumes, communications to sensitive destinations, exfiltration via hosting platforms.

Near-zero operational load for the IT team, thanks to outsourced monitoring and concise status reports.

The 6 key benefits of Jizô AI for this facility

01 AI-enriched detection : A combination of rules, indicator aggregates, and AI engines. Noise is filtered upstream, so analysts handle only relevant alerts.

02 Visibility over non-instrumentable assets — Mapping and monitoring of medical devices, analyzers, and shadow IT equipment — everything on which no agent can be deployed.

03 Express deployment : Seamless rollout in about one day on the facility's side, with no interruption to clinical operations.

04 French sovereignty : French vendor and integrator. Eligibility for public funding, a non-negotiable criterion for healthcare OES.

05 Managed probe, zero operational load : Supervision and analysis are handled by a partner integrator. No in-house SOC required, no 24/7 watch to organize.

06 Continuous scalability : Regular updates to the AI analysis engines, new detection capabilities (notably on generative AI usage), enriched compliance reporting, and regular exchanges with the vendor and integrator on areas for improvement.

A word from the CISO

"Today, we could no longer run a hospital IS of this size without a network probe. It has become as structural as the firewall — except that here, someone is actually watching behind it."