Gaining Real-time Visibility into Healthcare Risk

On May 14, 2021, the heart of Ireland’s National Health Service (HSE) stopped. Radiology screens froze, replaced by a chillingly simple message: Your data is encrypted. Pay to recover. For months, providers were forced back to the era of pen and paper. But the most unsettling part of the HSE story isn’t the attack but rather what the post-mortem revealed.

Eight days before the total shutdown, a small regional hospital triggered an alert. Then another hospital did. Then six more. The HSE had the data. They had the tools. They even had the alerts. What they didn’t have was visibility. The dots were all there, but they weren’t connected.

As the healthcare industry continues to face new regulatory pressures and increasingly sophisticated cyber threats, the HSE story is a compelling illustration: You cannot protect what you cannot see.

Bridging the Healthcare Visibility Gap

Part of the problem is that, in 2026, healthcare organizations have access to an unprecedented array of sophisticated diagnostic tools and telemetry, enabling them to see almost everything. As a result, the core challenge is no longer a lack of visibility, but rather the fragmented nature of data integration. While security telemetry, infrastructure metrics, and compliance reporting provide a wealth of raw data, it often remains siloed. The challenge lies in the inability to turn this information into the actionable intelligence required for health system environments.

The Shift from Attestation to Proof

For years, healthcare cybersecurity was a “checkbox” exercise. If there were an EDR, a firewall, and a backup solution, the healthcare IT infrastructure would be considered secure enough for insurance and compliance purposes. Today, there is a shift, moving from attestation to demonstrable proof, driven by:

• Regulatory Updates: Proposed HIPAA updates (expected as early as May 2026) are redefining the standard of care. New regulations will require healthcare organizations to demonstrate they can recover critical assets within 72 hours, along with a mandate for active technology asset inventories, including medical devices (BioMed), cloud, and SaaS applications. We will also continue to see regulatory updates at the state level that drive security and infrastructure investments for healthcare.
• Making the theoretical measurable: Cyber insurance providers are no longer “taking your word for it.” They are performing unannounced external vulnerability scans and demanding pressure tests (often penetration tests) to prove the organization can actually stop an attack. Gone are the days when healthcare organizations could simply provide documentation; today, those capabilities must be demonstrated. Healthcare IT cannot just be compliant; it must be resilient. If the organization can’t demonstrate resilience, it will likely result in denied coverage or higher premiums.

Defining the Visibility Operating Model

The process begins with clear visibility into all the assets the organization is responsible for. This moves beyond having a team look at the right dashboard with a green checkmark; it involves establishing an operating model or an operational truth. It encompasses the ability to provide evidence-based answers to the fundamental questions that determine organizational resilience and decision-making capability, including:

• What do we have?
• What is truly protected?
• What is truly recoverable?
• What is most at risk right now?

To achieve visibility, healthcare organizations must master two distinct perspectives: internal and external.

Internal Visibility: Know Your Reality

The process of obtaining internal visibility begins with a deep dive into the organization’s specific environment, capabilities, and constraints. It moves beyond a list of servers and IT assets to an understanding of clinical dependencies.

• Asset & Dependency Awareness: This entails an understanding of what the organization has and how these systems connect. For example, if an oncology system goes down, what else breaks? Organizations need a map of how Protected Health Information (PHI) flows through every medical device and application.
• Backup and Restore Readiness: This means understanding the verified recoverability of the system. A “successful” completion of a backup job and successful replication to another site is meaningless if the data is corrupted or the system wasn’t included in the scope. A healthcare organization must verify that the backup is actually usable.
• Identity and Privilege Exposure: Most breaches start with administrative domain accounts. Visibility means knowing who has access to what, especially administrative and service accounts, and where protections like MFA are being bypassed.
• Vulnerability and Patch Reality: Understanding what is actually exploitable, considering the organization’s specific environment, and compensating controls.
• Clinical System Dependencies: Understanding which IT systems have a direct impact on healthcare delivery.

External Visibility: Know the Enemy

External visibility involves contextualizing the internal risks against the global threat landscape. This incorporates:

• Healthcare-Specific Intelligence: What are the active healthcare threats? What are the current campaigns specifically targeting healthcare organizations? As an industry, healthcare is getting better at sharing threat information, including intel feeds and real-time threat intelligence from sources such as ISAC, Google Threat Intelligence, Mandiant, and VirusTotal. Having access to these sources of information, understanding what’s being exploited in the field, and correlating that to the organization’s specific environment is what transforms global threat awareness into localized, actionable intelligence.
• Vulnerability Prioritization: Understanding which vulnerabilities are being actively exploited. This helps prioritize patching efforts beyond generic CVSS scores.
• Credential Exposure Trends: Monitor for compromised credentials related to the organization, vendors, and employees, across breach databases and the dark web.
• Threat Actor Patterns: Ransomware groups often have preferred entry vectors (like RDP through vendor VPNs). Is your organization monitoring for specific Tactics, Techniques, and Procedures (TTPs) used by threat actors?

The result is a contextualized view of external threats to your organization’s internal reality, creating a unique cyber threat profile that encompasses the threat landscape, the organizational profile, and risk and impact analysis.

Shared Responsibility: Integrating Security and Infrastructure

When visibility breaks down, the cause is rarely incompetence or a lack of technology investment; the challenge is predominantly people, process, and technology fragmentation.

The security team cannot be solely responsible for visibility. Cross-functional ownership and an integrated perspective are necessary to combat increasingly sophisticated threats. Infrastructure teams, application teams, governance bodies, and executive leadership all play a crucial part in taking ownership of improving visibility across the organization, with the end state being to focus on patient care as the foundation.

How to Improve Visibility Now

To start improving visibility this week, healthcare organizations should start by focusing on three pillars:

1. Establish Cross-Functional Governance: This starts with identifying cross-functional governance, bringing security, infrastructure, applications, and compliance to align on definitions, ownership, and operating rhythm.
2. Create a Current-State Risk Snapshot: Execute low-cost, high-impact audits to identify low-hanging fruit. For example, audit MFA bypass exceptions and perform directory service credential scans to remediate common identity-based vulnerabilities before they are exploited.
3. Measure Visibility Debt: Just as “technical debt” hampers software development, visibility debt is the cumulative operational burden created by siloed data and fragmented tooling. It is defined as the time, effort, and cross-functional coordination required to get basic answers about the organization’s risk posture. Every time a new siloed tool or infrastructure layer is added without a plan for integration, visibility debt increases. This debt is a structural vulnerability that grows until the cost of gathering information exceeds the speed of an active threat.

Taking the actions detailed above drives immediate clarity and creates the foundation for more sophisticated visibility capabilities over time.

From Compliance to Resilience: The Visibility Mandate

Healthcare organizations constantly face a changing regulatory and threat environment where documented policies are no longer “good enough.” The new standards require demonstrable capability backed by evidence. Visibility is what makes this possible.

Visibility enables prioritization, accelerated recovery, and stakeholder trust. By reconciling internal reality with the external threat landscape, healthcare IT leaders can transition from speculative budgeting to evidence-based investment in security outcomes.

Visibility is ultimately what moves us from being compliant to being resilient.

Interested in exploring this topic in depth? Watch our recent webinar, From Blind Spots to Insights: Gaining Real-Time Visibility into Healthcare Risk. which demonstrates how true cybersecurity visibility—across endpoints, cloud environments, and critical systems—enables organizations to detect threats sooner, respond decisively, and strengthen their overall security resilience.