Multimodal cyber threat intelligence fusion for healthcare cybersecurity risk assessment: A systematic review

Healthcare's digital transformation has drastically expanded its attack surface, making robust Cybersecurity Risk Assessment (CSRA) a critical patient safety imperative. However, a persistent "implementation gap"—manifest as an assurance deficiency—hinders the adoption of Cyber Threat Intelligence (CTI) in clinical practice. This review addresses this gap through a preregistered PRISMA protocol, synthesising 43 peer-reviewed studies (2020–2024). Our reproducible analysis, with sensitivity validation confirming taxonomy stability (κ = 0.85, asymptotic 95% CI: 0.78–0.92), identifies three recurring failure modes that underpin the implementation gap: (i) semantic misalignment between CTI artefacts and CSRA constructs, (ii) regulatory drift from absent clause-level traceability, and (iii) deployment discontinuity due to edge-resource constraints. From this synthesis, we derive a six-domain taxonomy that outlines the requirements for clinical deployment. The paper makes two interconnected contributions. First, we provide a systematic evidence synthesis that identifies and analyses the triadic constraint failure. Second, derived directly from this synthesis, we present a conceptual harmonisation framework—a design blueprint—that integrates explainability, regulatory traceability, and resource-aware fusion as coequal design constraints. The resulting framework offers a practical rubric for Security Operations Centres (SOCs) to evaluate the audit-readiness and deployment feasibility of CTI-informed risk assessment tools, and a clear, actionable research agenda including a defined pathway for empirically validating the proposed blueprint.