Just 13.3% of healthcare pentest findings qualify as “serious”. This ranks healthcare 6th-best out of 13 industries.

71% of healthcare leaders cited GenAI as the top risk.

43% of healthcare organizations resolve critical findings in business-critical assets in one to three days.

Healthcare’s half-life for serious pen test findings was 244 days. This ranks healthcare 11th of 13 industries. Transportation had a half-life of 43 days.

Healthcare’s median time to resolve serious pen test findings was 58 days. This ranks healthcare 10th of 13 industries. Hospitality led with 20 days.

Nearly 40% of healthcare SLAs require serious findings in business-critical assets to be fixed within three days. Another 40% require resolution within four to 14 days.

37% of healthcare organizations resolve critical findings in business-critical assets within four to seven days.

68% of healthcare leaders cited third-party software as the top risk.

Healthcare expects a 53% rise in insider threats.

More than 80% of small healthcare practices expressed confidence in their current HIPAA compliance posture.

Nearly half of healthcare email breaches stem from Microsoft 365 alone.

In 2025, healthcare breaches took an average of 224 days to detect and another 84 days to contain—making it over 10 months total.

Vision Upright MRI faced a $5,000 fine plus two years of federal monitoring after a server breach exposed over 21,000 individuals' medical imaging records.

43% of small healthcare organisations reported experiencing a phishing or spoofing incident in the past year.

83% of small healthcare practices believe patient consent removes the need for encryption.

Solara Medical faced a $9.76 million class-action settlement following a phishing attack.

64% of small healthcare practices believe patient portals are required for HIPAA compliance.

20% of healthcare practices do not utilise any form of email archiving or audit trail.

98% of small healthcare organisations falsely believe they are HIPAA compliant.

Over 90% of U.S. healthcare providers operate as small organisations.