CYBER-RESILIENCE

early three in four US healthcare

The study, based on responses from 705 IT and IT security practitioners at US healthcare organisations, found that 97 % had experienced at least one cyberattack in the previous 12 months, with 74 % reporting an impact on patient care.

The average number of cyberattacks increased to 51 per organisation, compared with 43 in 2025, while the average cost of the most expensive attack rose by nearly 8 %, from $ 3.9 million to $ 4.2 million.

Operational disruption emerged as the largest financial consequence of cyberattacks, with interruptions to normal healthcare operations costing organisations an average of $ 1.39 million. Idle time and lost productivity accounted for a further $ 1.05 million.

“ Cyber resilience has become essential to healthcare resilience,” said Ryan Kalember, Chief Strategy Officer, Proofpoint.“ When a cyberattack delays a procedure, extends a hospital stay, or forces patients to another facility, cyber risk becomes patient risk. AI is now adding another dimension as people and AI systems access the same sensitive data and clinical workflows. Healthcare organizations need security built around those interactions so they can adopt AI without compromising the trust patient care depends on.”

The research also highlighted a widening gap between AI adoption and security

Ryan Kalember, Chief Strategy Officer, Proofpoint

governance. While 45 % of healthcare organisations have integrated AI into cybersecurity operations or both cybersecurity and patient care, another 30 % plan to adopt the technology.

However, 60 % lack controls governing sensitive data used in AI systems, while only 42 % have implemented security measures specifically designed for AI systems, agents and generative AI. Just 32 % reported full visibility into employees’ use of unauthorised AI tools.

AI vendor supply chain risks were cited by 40 % of respondents, followed by data leakage through prompts at 36 % and AIgenerated phishing and social engineering at 34 %. AI agents operating without appropriate safeguards were identified as a cause of data loss by 24 % of respondents.

The impact of cyberattacks on clinical operations remains significant. Across cloud and account compromises, ransomware, supply chain attacks and business email compromise, an average of 53 % of respondents reporting care disruption cited increased complications from medical procedures. Meanwhile, 52 % reported longer patient stays and the same proportion experienced delays in tests or procedures.

Supply chain attacks had the greatest reported impact on patient care, with 90 % of affected organisations experiencing disruption, compared with 87 % in 2025.

Ransomware continued to affect clinical operations despite a decline in ransom payments. Among organisations experiencing ransomware attacks, 72 % reported patient-care disruption, up from 67 % in 2025. Of those reporting disruption, 70 % cited longer patient stays.

The proportion of ransomware victims paying a ransom declined from 33 % to 31 %, while the average costliest ransom payment fell from $ 1.2 million to $ 1.1 million.

Data loss also emerged as a significant concern. Healthcare organisations reported an average of 21 incidents involving the loss or exfiltration of sensitive healthcare information over two years. More than half, 54 %, said these incidents disrupted patient care, with 56 % of that group reporting increased mortality rates.

The shift towards cloud-based clinical applications is introducing additional exposure. The proportion of organisations moving clinical applications to the cloud increased from 30 % in 2025 to 35 % in 2026, while another 44 % plan to do so within the next two years.

Cloud and account compromises, averaging up to 20 incidents per organisation, disrupted patient care for 65 % of affected respondents.

32 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST