What is a FutureNow Network in the NHS?

A compromised infusion pump shouldn’t be able to take down a hospital’s entire network.

FutureNow Networks give NHS organisations a self-defending campus fabric. One that identifies every device on the network, contains threats automatically, and turns cyber assessment principles into daily operational reality.

The business case

Independent analysis of large-enterprise deployments shows what a software-defined fabric returns in staff time, breach impact, and total cost.

67% savings in network provisioning time.
80% less time to issue resolution.
462% within five years ROI.
48% reduced impact from a security breach.
45% reduced total cost of operation.
49% more efficient network management staff.

The architecture: Three components, one fabric

FutureNow Networks unify wired and wireless, as well as acute and community sites, under a single automated policy model. This replaces manual VLAN changes and one-off firewall rules with intent that’s defined once and enforced everywhere.

Control: Catalyst Center
The SDN controller. Network and infrastructure teams design, provision, and apply policy from one console, with real-time assurance telemetry across every ward, site, and ICB location.

Policy: Identity Services Engine (ISE)
Authenticates every clinician, device, and system, then applies Scalable Group Tags so access is granted by role and risk – not by which port or VLAN something is plugged into.

Fabric: SDA
A programmable overlay across the physical estate. One infrastructure investment can host many logical networks: clinical, corporate, guest, IoMT. Each network is isolated from the others.

How it operates

FutureNow Networks run a standing loop of identification, segmentation, verification and response, rather than a static configuration set once at go-live. This is the same loop that assessors expect to see evidenced under the Cyber Assessment Framework (CAF).

Identify and profile every endpoint: AI-driven and machine learning-based analytics fingerprint equipment such as blood-gas analysers for infusion pumps as well as BYOD the moment they connect.
Segment by policy, not by port: Group-based access separates clinical, corporate, guest, and IoMT traffic with macro- and micro-segmentation from a single design.
Verify trust continuously: Endpoint behaviour is continuously monitored for risky behaviours, with a scoring system that allows network policy to respond to events as they occur.
Steer suspect traffic to inspection: Traffic from high-risk sources is routed to firewalls for stateful inspection before it ever reaches the wider estate.
Contain and isolate automatically: Compromised or rogue endpoints are quarantined in place, shrinking the blast radius before a human needs to act.

Mapped to the cyber assessment framework

The CAF-aligned Data Security and Protection Toolkit (DSPT) moved the NHS from checklist compliance to outcome-based principles. Intent-based networking gives you the live, technical evidence behind each objective, not a policy document describing intent.

OBJECTIVE A: Managing security risk A3: Every IoMT device is discovered, profiled, and registered automatically. This closes the blind spots that legacy, flat networks leave around unmanaged clinical devices.
OBJECTIVE B: Protecting against cyber attack B2/B3: Identity-based micro-segmentation grants a clinician access to the EPR system according to role and device posture, instead of static VLANs. B5: Self-healing fabric reroutes clinical traffic around a failed switch or link in milliseconds, with no human intervention required.
OBJECTIVE C: Detecting cyber security events C1/C2: AI-driven telemetry baselines normal traffic and flags lateral scanning or exfiltration attempts from a compromised legacy device immediately.
OBJECTIVE D: Minimising the impact of incidents D1/D2: A single command builds a digital quarantine zone around an affected network segment or site. This halts lateral movement while unaffected wards stay online.

The scenario every CIO plans for

When ransomware reaches a ward, only that ward goes dark.

In a flat network, one infected workstation can become a route to every site on the ICB. In a FutureNow Network, the same device sits inside a policy boundary that was already there before the attack started.

Network teams isolate the compromised assets with a single command or automated playbook instantly, without waiting for a firewall change request or a late-night bridge call.

The result is that your essential services (theatres, ICU, pharmacy dispensing) can keep running on within the affected segment while the incident is contained and investigated.

Where this shows up day-to-day

IoMT device onboarding
New infusion pumps, monitors, and imaging kit are profiled and segmented automatically. No manual VLAN request per device.

Patient and visitor Wi-Fi
Guest access is policy-defined once, then applied consistently across every site, with no route into clinical systems.

Multi-site ICB estates
Acute, community, and mental health sites can join a single fabric, so policy set centrally is enforced identically everywhere.

Faster incident troubleshooting
Rich per-device context and telemetry cut the time infrastructure teams spend tracing an issue across sites.

Clinician mobility
Consistent identity and policy follow staff as they roam between wards, sites, and device types, wired or wireless.

Data centre and cloud policy
Identity federation extends the same access policy from the campus into data centre and multi-cloud clinical systems.