This page is optimised for desktop viewing.

For mobile, please rotate to landscape.

StrongKeep Clinic brief 2026

Cybersecurity
for clinics,
made simple.

Ready for Singapore's Health Information Act. Built for clinics that don't have a cyber team and don't want one.

strongkeep.com Plans from $39/month · Live in under an hour
SK · 2026
The risks

The Risks every clinic faces.

CIA 01
Confidentiality
Patient data leaks.
HIV status. Mental health notes. Fertility records. Diagnoses your patients trusted only with you — now traded on the dark web or used to blackmail them directly.
CIA 02
Integrity
Records are altered.
Wrong dosage. Wrong allergies. Wrong patient. The data still loads — but it's no longer true. Clinical decisions on altered records put patients at risk.
CIA 03
Availability
Systems go down.
Appointments cancelled. Payments halted. Surgery delayed. Your CMS, your imaging, your billing — frozen until you pay or rebuild.
2018 · SingHealth hack
1.5Mrecords stolen
State-linked actors exfiltrated 1.5 million patients' data plus 160,000 outpatient prescriptions. Singapore's largest cyber attack.
2021 · ERS ransomware
73,000records held hostage
Ransomware locked clinical systems at Eye & Retina Surgeons. Patient records exfiltrated and traded on the dark web. A specialist clinic — not a hospital — proving small targets are now hit.
2023 · Public hospital outage
7hrsservices down
A DDoS attack on Synapxe took down websites and internet-reliant services at 46 public healthcare institutions — including SGH, NUH, TTSH and polyclinics — for seven hours.
Sources: The Straits Times · MOH Newsroom · Synapxe
02 / 17
The Health Information Act

The HIA applies to every clinic.

Batch 1 · by Sep 2027
GPs, hospitals & labs
Outpatient GP, private hospital, clinical lab, radiology lab, nuclear medicine.
Batch 2 · by Sep 2028
Specialists & care services
Outpatient specialist, nursing home, contingency care, outpatient renal dialysis.
Batch 3 · by Mar 2030
Dental, surgical & pharmacy
Outpatient dental, ambulatory surgical centre, assisted reproduction, retail pharmacy.

Other HCSA licensees not in this table — cord blood banking, human tissue banking, emergency ambulance, medical transport — are not required to contribute to NEHR, but still need to implement the cybersecurity & data security measures by September 2028.

Clinics already protected by StrongKeep
03 / 17
Anti-objection

Your CMS handles the data. You handle everything else.

Your CMS vendor handles
The software and its data layer.
  • Secure software builds and patches
  • Hosting and infrastructure
  • Encryption at rest in the database
  • Vendor backups of the platform
  • The vendor's own internal security
You handle
Everyone and everything around the CMS.
  • Staff passwords — weak, shared, reused
  • Staff devices — malware, ransomware, lost laptops
  • Phishing and scam sites that steal credentials
  • Unencrypted patient data sent via WhatsApp, email or USB
  • Breach detection and notification within the legal deadline
Under the HIA, this is your responsibility — even with an approved CMS.
04 / 17
How HIA works

Self-declaration. No external auditor.

Similar to PDPA — you implement the controls and demonstrate them if asked. The 13 items below are MOH's official CS/DS Essentials (Table 1).

A · Cybersecurity
IT and software measures
  1. Updates — Install software updates on devices and systems promptly.
  2. Secure / Protect — Anti-malware and anti-virus solutions; IT access control on data and services; secure settings on procured hardware & software.
  3. Backup — Back up essential data and store it separately.
  4. Asset — Identify the hardware and software used and secure them.
0 Fully implemented by StrongKeep
0 Partially implemented by StrongKeep
0 Requires clinic to implement
B · Data Security
Data-related practices
  1. Secure — Know what data you hold and where; reproduce health information only when necessary; transfer it properly to avoid exposure.
  2. Identify — Differentiate and mark your health information.
  3. Access — Restrict access to health information to valid and relevant purposes.
C · Common Practices
Personnel, vendor & protocols
  1. Training & education — Equip personnel with cyber & data security hygiene as the first line of defence.
  2. Outsourcing & Vendor Management — Define responsibilities between your organisation and vendors.
  3. Security Reviews & Internal Audit — Regular checks on policies and processes to identify gaps.
  4. Disposal — Proper disposal of health information reduces unauthorised access.
  5. Emergency Planning for Contingency — Withstand service disruptions to maintain continuity.
  6. Incident Response — Be prepared to detect, respond, and recover.
Penalties

Apply for wilful or deliberate non-compliance: up to S$200K + 2 years' jail for individuals, up to S$1M for organisations. Ignorance is not a defence.

05 / 17
Our approach

We re-engineered cyber for clinics.

01 Affordable
Like IKEA.
"Custom carpentry > IKEA. But IKEA > not having a table at all."
Re-engineered to cost.
Cyber is over-engineered. We redesigned the pieces so a small clinic can afford them. Plans from $39/month.
02 Comprehensive
Like Xero.
Same shift accounting and project management already went through.
Bundled and productised.
Cyber tools are fragmented. We bundled what a clinic needs into one platform — anti-malware, DNS firewall, training, password manager, server scans.
03 Simple
Like toilets.
No one cares how the toilet works. They just want it to flush.
Built for non-techies.
Cyber tools are built for security pros. We hid the complexity so a doctor or practice manager can deploy it themselves — no IT team required.
98% Microsoft research: getting the basics of cybersecurity right stops 98% of attacks. The HIA is asking for those basics — nothing exotic.
06 / 17
The product

Four protections. One dashboard.

Pre-bundled. Powered by Palo Alto Cortex and A*STAR cyber research.

01
Devices
Endpoint detection & response
Stops malware and ransomware on every clinic laptop and server, in real time.
02
Inboxes & browsers
DNS firewall
Blocks phishing links and malicious domains the moment a staff member clicks.
03
People
Training, password manager & 2FA
Phishing-aware staff. Strong passwords for every system. Two-factor everywhere.
04
Servers
Configuration scanner
Continuous scans flag risky server settings before attackers find them.
05
Intelligence Soon
Virtual CISO 24/7
Deep intelligence scans for global threats, automatically defines risk-optimisation strategies, and deploys them to your context, keeping you safe.
Dashboard
Employee Risk Overview See all
Front desk 4 Clinicians 6 Admin 3
Name Grade Training Device Passwords Recommendation
Dr Tan A 98% No alerts No alerts All clear!
Nurse Lim B 84% 4 blocked sites 1 reused password Training: Phishing Sites
Nurse Rina C 83% 1 malware 3 weak passwords Reduced Access
Your whole team's posture, simplified. Focus on the riskiest staff; leave the safe ones to do their work.
07 / 17
Deployment

Simple enough for anyone.

Redesigning cybersecurity to be easy to deploy and use was the hardest part.

Fastest onboarding on record
7minutes
That's how quickly one customer self-onboarded and got their protection going.
Live in under an hour.
1
Scan your clinic
Free email and website scans. Find the gaps before attackers do.
2
Deploy protection to your team
One-click M365 or Google integration. We push device protection (anti-malware and anti-scam) to every staff laptop and phone.
3
Set up password protection
Centralised password manager and 2FA across the clinic. No more reused passwords on sticky notes by the front desk.
4
Set up training
Bite-sized awareness lessons and simulated phishing drills. Builds habits without classroom sessions.
08 / 17
Compliance

HIA compliance in days. Not months.

Auto-generate policies. Auto-collect evidence. Track every HIA control area from one screen. Most of the work is invisible — the controls deploy themselves with your protection.

  • Health Information Act (HIA) — Singapore healthcare baseline
  • CSA Cyber Essentials — Singapore cyber baseline
  • Data Protection Essentials — PDPA-aligned
  • Cyber Essentials Plus — UK enterprise procurement (coming soon)
Why this matters. Under HIA you must implement the controls and demonstrate them if asked. We bake the evidence in as you go — so when MOH asks, you have an answer ready.
HIA compliance
14 of 20 controls in place
70% completeReady to demonstrate in ~2 weeks
Asset register (devices & software)Complete
Password manager & MFAComplete
Anti-malware on all devicesComplete
Staff phishing awareness trainingIn progress
Data classification & handlingGenerating
Incident response planPending approval
09 / 17
Customer proof

Real clinics. Real results.

A specialist surgical clinic in Singapore preparing for the HIA. Needed protection beyond consumer antivirus, deployable without clinic IT.
Dr Harish at Neumark Surgery
Dr Harish
Doctor · Neumark Surgery
"The setup was straightforward and caused no disruption to our clinic operations. No technical expertise was required. It simply worked."
Read full case study →
A Singapore VC firm safeguarding sensitive investor and portfolio data. Their previous enterprise vendor required 1,000+ seats and dropped them. They needed something a one-person team could run.
Ling, IT Manager at Integra Partners
Ling
IT Manager · Integra Partners
"We don't have an IT department. I'm the one who deals with laptops, systems, and making sure everyone's devices are working. I needed something I could manage myself."
Read full case study →
A pest-control SMB hit with a sudden enterprise cyber requirement — get certified or lose a major contract. From zero to compliant in 8 days, run by Chee Keong himself.
Chee Keong, Sales Manager at AZAntz
Chee Keong
Sales Manager · AZAntz
"With StrongKeep's plan at $159 a month, we got both the compliance and the tools in one package."
Read full case study →
10 / 17
Partnerships

Partnered with companies you know.

Built with leading organisations who share our mission to secure smaller businesses worldwide.

Integrations · channel partners · certification bodies · research collaborators.
11 / 17
Speaking engagements

Briefing clinics, hospitals, and medical associations.

Gaurav has been invited to brief Singapore's largest healthcare clusters, private hospitals, and doctors' associations on the Health Information Act and clinic cyber risk.

SingHealth
Farrer Park Hospital
Mount Elizabeth Hospital
HealthTechX
AsiaMD
GP+ Cooperative
12 / 17
In the media

Featured in the media you read.

StrongKeep is a thought leader and advocate for SMB cybersecurity globally.

The Straits Times
"Think you're safe from cyber crooks? Why 99% of companies are exposed."

Plus opinion features on cyber piranhas (Oct 2025) and ransomware reporting (Jul 2025). Three Straits Times pieces in twelve months.
Straits Times: 99% of companies are exposed
Channel News Asia
"Leaked documents suggest 255 Singapore firms linked to critical infrastructure hit."
CNA: Leaked documents suggest 255 Singapore firms linked to critical infrastructure hit
TechInAsia
"A startup trying to IKEA-ify cybersecurity for SMEs."
TechInAsia: IKEA-ify cybersecurity for SMEs
Dark Reading
"Addressing the supply chain risk — why protecting smaller companies matters."
Dark Reading: Addressing the Supply Chain Risk
Bank InfoSecurity
"The Great Cyber Divide" — CEO on the security gap between large and small enterprises.
Bank InfoSecurity: The Great Cyber Divide
13 / 17
The team

Built by people who ran national cybersecurity, served small businesses, and live in deep-tech.

Gaurav Keerthi
BG(NS) Gaurav Keerthi
Founder & CEO
Former Deputy Commissioner, Cyber Security Agency of Singapore; CIO of Republic of Singapore Air Force; UN Cyber Expert. 20+ years in cyber, defence, and public-sector leadership.
Zaishao Cheng
Zaishao Cheng
Co-founder & COO
Product, engineering, operations. Former Temasek cyber investment lead. Former startup founder.
Clement Chai
Clement Chai
PM
Engineering and platform leadership. Formerly Singtel, led development of SaaS for 3000 SMBs.
Deep R&D

Agentic vCISO: a US$1M government-backed R&D grant.

StrongKeep is partnered with Singapore's A*STAR on a 7-figure cybersecurity R&D programme.

Research collaborators · A*STAR
Dr Dinil Mon Divakaran · Principal Investigator (network, AI, systems)
Dr Levente Csikor · Principal Investigator (next-gen security)
Dr Jehyun Lee · Senior Principal Scientist
Dr Kohli Varun · Senior Scientist
Dr Hao Anran · NLP, deep learning
14 / 17
Pricing

Plans start from $39/month.

Pay-as-you-grow. No long-term lock-in. The most affordable protection for clinics in the world.

Protection
$39/ month
Covers 5 devices. Add devices at $5.50/month each.
Includes:
  • Endpoint detection & response (EDR)
  • DNS firewall
  • Password manager & 2FA
  • Awareness training
  • Unified dashboard
Compliance
$159 / month
Everything in Protection, plus:
  • Automated policies & evidence collection
  • CSA Cyber Essentials submission support
  • HIA compliance
Resilience
From $999 / month
For larger clinics & regulated workloads:
  • 24/7 incident response
  • Continuous VAPT scanning
  • Dedicated customer success
Add-ons
Cyber insurance and incident-response retainers from just a few dollars per device per month.
Insurance Incident response
15 / 17
Security in a box

Five vendors to secure your clinic, or one box that just works.

Piece it together yourself
5 renewals
out of sync
Antivirus
separate vendor
Web filter
separate vendor
Password manager
separate vendor
Staff training
separate vendor
Phishing tests
separate vendor
4–5 billsto track and renew each year, from vendors that don't talk to each other.
StrongKeep: security in a box
One platform, five protections
Your team runs it all from a single dashboard
Antivirus & device protection
Included
Web filter that blocks harmful sites
Included
Password manager
Included
Quiz-based staff training
Included
Phishing tests for staff
Included
1 billOne dashboard, one subscription, one security grade you can see at a glance.
$39/mo
All five protections, up to 5 devices. Add more at $5 each.
~50%
less than buying comparable point tools separately.
< 1 hr
to deploy across your whole team — no IT project required.
Get started
Start with a free scan
16 / 17
Get HIA-ready before the deadline.

The Act is coming.
Hackers aren't waiting.

Get a free scan of your clinic today. Most clinics are live in under an hour.

Start with a Free Scan → Book a Demo
strongkeep.com [email protected]