Building trust before a crisis: Z-CERT connects Dutch healthcare with Mattermost

The threat landscape facing Dutch healthcare has grown steadily more complex. Z-CERT points to a rising number of incidents affecting both healthcare organizations and the technology providers they depend on, including incidents involving major technology vendors in the Dutch market as well as smaller but equally consequential suppliers.

Effective response requires getting the right people into the same conversation quickly, across many independent organizations, each with its own obligations and its own caution about where sensitive information is shared. Traditional channels make that harder. A question answered by email or phone helps one organization and leaves everyone else in the dark, and many organizations or individuals are difficult to reach through those channels at all.

The harder problem is not technical but social. A sector-wide response only works if participants trust the space they are being asked to share. People need to know whom they can feel confident approaching, contributing with comfort, and have an established, trusted place to exchange information.

Z-CERT has used Mattermost for its community from the outset, alongside more formal email-based systems. The goal was never to replace existing communication channels. It was to create space for direct, accessible conversations that scale across organizational boundaries, and to build those relationships before a crisis requires them.

Z-CERT's choice was not driven by regulatory requirements. It came down to trust, and to three properties the organization names directly: self-hosted, open source, and a large install base.

Self-hosting is what makes the difference.

"An important aspect is that we host the platform ourselves. This gives participating organizations confidence that communications take place in a secure and trusted environment. As a result, organizations are often more willing to engage in discussions, share experiences, and exchange relevant information. This trust is essential when facilitating cooperation across a highly regulated sector such as healthcare."

— Daan Brinkhuis, Manager Relations, Z-CERT

For Z-CERT, this is the practical value of data sovereignty: it creates an environment where healthcare security professionals are genuinely willing to collaborate.

The deployment focuses on messaging rather than software development workflows, and participation is deliberately low-friction. Members can join conversations without installing an app, and discussions complement the organization's existing email-based communications rather than displacing them.

Mattermost supports Z-CERT's community throughout the incident lifecycle. Before incidents, members exchange knowledge and surface early signals, discuss emerging threats, and build relationships. During incidents, the platform helps Z-CERT and participating organizations share updates, answer questions, and bring the right people into the conversation. Afterward, it provides a space to discuss lessons learned and best practices.

Z-CERT describes several scenarios that illustrate how this collaboration works in practice:

Checking whether an incident is shared across organizations. A healthcare provider can ask other organizations whether they are seeing similar activity, helping participants establish a broader picture faster.

Exchanging threat indicators and investigative findings. A provider can share indicators of compromise with peers, helping other organizations investigate their own potential exposure.

Coordinating when multiple organizations are affected by the same supplier incident. Healthcare organizations affected by the same supplier incident can work together and exchange relevant information.

To keep sensitive material handled correctly as it moves through the community, Z-CERT classifies and shares information using the Traffic Light Protocol (TLP). As information-sharing communities grow, Z-CERT notes, support for workflows aligned with TLP classifications becomes increasingly important.

During recent incidents, Mattermost allowed Z-CERT, healthcare organizations, and cybersecurity professionals to share information, track developments, answer questions, and coordinate actions in a secure environment. It was not the only channel in use, but Z-CERT reports that it meaningfully improved the speed, clarity, and efficiency of information exchange across the network.

The relationships established through everyday discussion are what make those interactions easier. Familiarity with the platform matters, too: participants already know where to go when communication becomes urgent.

"To have a familiar platform in times of a crisis is one less worry."

— Z-CERT

Between incidents, Mattermost changes the texture of everyday communication between Z-CERT and its members, enabling more direct, accessible, and less formal communication than traditional channels allow.

It also changes who benefits from each answer. A question raised in the community can be discussed openly, letting other participants contribute expertise, learn from the exchange, and access information that would otherwise stay locked inside a single email thread or phone call.

The benefits extend well beyond incident response. Larger organizations can share expertise with smaller ones, giving members access to practical knowledge from across the healthcare community. Z-CERT sees this peer-to-peer support as a potential way to reduce demand on its help desk, although it has not measured that effect.

The community's value also extends to members who participate less frequently. Z-CERT describes a relatively small core of regular participants alongside a much larger audience that reads discussions or returns during a crisis. For those members, having an established platform of vetted professionals available the moment they need it is an important part of the service.

The platform is operated by Z-CERT in a highly available self-hosted configuration that allows flexibility, scalability and strong control over data. Security updates arrive in a way IT describes as timely and effortless.

"Mattermost gives us the flexibility to scale out and migrate to other underlying technologies without too much hassle. This gives us sovereignty and control over our data and the data of our participants."

— Z-CERT's IT team

Z-CERT is candid that it does not collect formal metrics for response-time or productivity improvements. Its reported outcomes are qualitative but consistent.

Chief among them is expanded reach. Mattermost helps Z-CERT connect with healthcare organizations and individuals who can be difficult to engage through traditional channels. It also reduces the time and effort required to assemble a response, making it easier to bring relevant experts, stakeholders, and affected organizations together around a specific issue.

In practice, this improves information sharing, strengthens coordination, and accelerates decision-making when timing matters.

As its community grows, Z-CERT aims to extend participation to more healthcare organizations, including smaller providers. For a CERT whose effectiveness depends on how freely the sector communicates, growth is about more than expanding access to a messaging platform. It is about bringing more healthcare security professionals into a community where they can learn from one another and establish trusted relationships.

When an incident occurs, they are not starting from scratch.