Institute of Oncology Ljubljana

The Institute of Oncology Ljubljana (Onkološki inštitut Ljubljana) is Slovenia's central national institution for comprehensive cancer care. Founded in 1938 as one of the first cancer centres in Europe, it is a public health institution operating at the secondary and tertiary levels, covering prevention, early detection, diagnosis, treatment, rehabilitation and palliative care. The Institute cares for roughly 70% of all cancer patients in Slovenia, employs more than 1,300 staff, directs the National Cancer Control Programme and hosts the Cancer Registry of the Republic of Slovenia. In addition to Slovenian patients, it also treats a significant number of patients from across the countries of former Yugoslavia, reflecting its regional reputation and referral role. It combines clinical excellence with active research and education and takes part in European healthcare and research initiatives.

Comprehensive, multidisciplinary oncology (prevention, screening, diagnostics, treatment, rehabilitation and palliative care); coordination of the National Cancer Control Programme; cancer epidemiology and registries (Cancer Registry of the Republic of Slovenia, DORA and ZORA national screening programmes); clinical research and medical education in oncology; and the operation of a large hospital IT environment handling highly sensitive health data.

Its information systems department runs a large, complex hospital IT environment serving over 1,300 employees, including Microsoft 365 with a hybrid Exchange setup, Active Directory and centrally managed Windows endpoints. Security capabilities include endpoint detection and response, email threat defence and day-to-day security operations — phishing and business email compromise investigation, incident triage and response — with ongoing work to align with NIS2.

The Institute of Oncology Ljubljana participates as one of the Slovenian pilot hospitals in ShieldHealthAdria. It provides a real-world tertiary-care environment for cybersecurity and regulatory-compliance assessment (NIS2, GDPR), takes part in the deployment and validation of security solutions, and engages its staff in awareness and training. Drawing on its in-house security operations experience, the Institute helps shape and validate a transferable model for strengthening cyber resilience across European healthcare institutions.

Providing a real, tertiary-care clinical and IT environment as a pilot site, bringing in-house security operations expertise, supporting the assessment and validation of solutions, and helping disseminate results across the Slovenian oncology and healthcare network.

Specific infrastructure brought to the consortium: an enterprise Microsoft 365 / hybrid Exchange environment with Active Directory and centrally managed endpoints; network security based on Palo Alto Networks firewalls, complemented by Cisco Secure Endpoint and Cisco XDR for endpoint detection and response, together with email threat-defence capabilities; in-house security operations and incident handling; an ongoing deployment of a Graylog SIEM solution; and extensive experience protecting highly sensitive health and national cancer-registry data under strict privacy requirements.

Healthcare increasingly depends on digital systems and connected medical devices, which widens the attack surface; when hospital IT is disrupted, patient safety and public trust are immediately at risk. By moving from a reactive to a proactive, NIS2-aligned security posture, the Institute of Oncology Ljubljana contributes a tertiary-care perspective that helps the consortium build practical tools, faster threat detection and continuity of care — captured in a replication model that can be transferred to other healthcare organisations across the Adriatic region and Europe.