## 6 Discussion  
The purpose of this research was to present the attack path discovery method considering the unique characteristics of the healthcare information infrastructure, such as assets and their cyber and physical dependencies, vulnerabilities, threat actor and user profile, and IoC. A scenario in a real-life healthcare setting has also been used to prove the implementation of the attack path discovery method. The cyber threat landscape is constantly evolving, and threat actors are highly skilled in conducting sophisticated and multiple attacks on a number of infrastructures. They target the initial access point assets and exploit possible vulnerabilities to reach the target point through several intermediate nodes. Research shows that most studies on cybersecurity in the healthcare field focus on technical aspects [26]. Following this focus on technology, other significant components, such as threat actors' profiles and related psychosocial and behavioural characteristics remain understudied in the field [20]. This comes as a surprise when taking into consideration that most cyberattacks are caused by individuals and the adopted risk mitigation by technological solutions is successful to a limited extent. The core of a sturdy strategy for cyberattacks needs to be human-centric and consider attackers' profiles for ultimate benefit. It is worth noting that attack potentials are positively connected to attackers' profiles, while studying this further would shed light on the early detection, prevention, and protection of cybersecurity incidents within healthcare organizations. Examining involved human aspects is also of paramount importance to further investigate how healthcare professionals understand data privacy and security and its significance. This significance lies on the attitudes towards cyber threats, operations, and related controls. The proposed methodology provides an understanding of possible entry point assets for the studied context and possible paths to reach the target point asset. It adopts the CVSS metrics and its exploitability feature for a common understanding of how the threat actor can exploit particular attack paths. Additionally, threat actor individual and exploitability capability are also taken into consideration for attack path generation and prioritisation. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Vulnerability**} & \multirow{2}{*}{**Asset**} & \multicolumn{2}{c}{**Individual**} & \multicolumn{5}{c}{**Threat Actor’s Exploitability Level**} \\ \cline{3-8}  & & \begin{tabular}{c} **Vulnerability** \\ **Level (IVL)** \\ \end{tabular} & \begin{tabular}{c} **Capability =** \\ **Very Low (VL)** \\ \end{tabular} & \begin{tabular}{c} **Capability =** \\ **Low (L)** \\ \end{tabular} & \begin{tabular}{c} **Capability =** \\ **Moderate (M)** \\ \end{tabular} & \
\begin{tabular}{c} **Capability =** \\ **High (H)** \\ \end{tabular} &
\begin{tabular}{c} **Capability =** \\ **Very High (VH)** \\ \end{tabular} \\ \hline V1 & A1 & IVL(A1,V1) = VH & M & H & VH & VH \\ V2 & A1 & IVL(A1,V2) = VH & M & H & H & VH & VH \\ V1 & A9 & IVL(A9,V1) = VH & M & H & H & VH & VH \\ V2 & A2 & IVL(A9,A2) = H & L & M & H & VH & VH \\ V1 & A6 & IVL(A6,V1) = H & L & L & H & H & VH \\ V2 & A6 & IVL(A6,V2) = H & L & L & H & H & VH \\ V1 & A8 & IVL(A8,V1) = VH & M & H & H & VH & VH \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Individual vulnerability exploitation.