A cloud based security system for a medical data network, the security system comprising: at least one processor; at least one memory communicatively coupled to the processor; an input/output interface configured for accessing data from a plurality of medical hubs, each communicatively coupled to at least one surgical instrument; and a database residing in the at least one memory and configured to store the data; the at least one memory storing instructions executable by the at least one processor to: identify a first security threat by a first medical instrument communicatively coupled to a first medical hub located at a first medical facility, wherein identifying the first security threat comprises either: determining that an identification parameter of the first medical instrument is invalid; or detecting that the first medical instrument is transmitting a virus; or determining that the first medical instrument fails an authentication protocol; determine that a second security threat is present at a second medical hub located at a second medical facility, based on at least one common characteristic between the first medical instrument and a second medical instrument communicatively coupled to the second medical hub, wherein the at least one common characteristic comprises either: a first serial number of the first medical instrument and a second serial number of the second medical instrument both being within an invalid range; or a second serial number of the second medical instrument being a duplicate of a first serial number of the first medical instrument; and provide an alert to the second medical facility about the second security threat. at least one processor; at least one memory communicatively coupled to the processor; an input/output interface configured for accessing data from a plurality of medical hubs, each communicatively coupled to at least one surgical instrument; and a database residing in the at least one memory and configured to store the data; the at least one memory storing instructions executable by the at least one processor to: identify a first security threat by a first medical instrument communicatively coupled to a first medical hub located at a first medical facility, wherein identifying the first security threat comprises either: determining that an identification parameter of the first medical instrument is invalid; or detecting that the first medical instrument is transmitting a virus; or determining that the first medical instrument fails an authentication protocol; determine that a second security threat is present at a second medical hub located at a second medical facility, based on at least one common characteristic between the first medical instrument and a second medical instrument communicatively coupled to the second medical hub, wherein the at least one common characteristic comprises either: a first serial number of the first medical instrument and a second serial number of the second medical instrument both being within an invalid range; or a second serial number of the second medical instrument being a duplicate of a first serial number of the first medical instrument; and provide an alert to the second medical facility about the second security threat. identify a first security threat by a first medical instrument communicatively coupled to a first medical hub located at a first medical facility, wherein identifying the first security threat comprises either: determining that an identification parameter of the first medical instrument is invalid; or detecting that the first medical instrument is transmitting a virus; or determining that the first medical instrument fails an authentication protocol; determining that an identification parameter of the first medical instrument is invalid; or detecting that the first medical instrument is transmitting a virus; or determining that the first medical instrument fails an authentication protocol; determine that a second security threat is present at a second medical hub located at a second medical facility, based on at least one common characteristic between the first medical instrument and a second medical instrument communicatively coupled to the second medical hub, wherein the at least one common characteristic comprises either: a first serial number of the first medical instrument and a second serial number of the second medical instrument both being within an invalid range; or a second serial number of the second medical instrument being a duplicate of a first serial number of the first medical instrument; and a first serial number of the first medical instrument and a second serial number of the second medical instrument both being within an invalid range; or a second serial number of the second medical instrument being a duplicate of a first serial number of the first medical instrument; and provide an alert to the second medical facility about the second security threat.