New Spotlight Report on Healthcare Identifies the Need for a Culture of Cybersecurity – Source:levelblue.com

New Spotlight Report on Healthcare Identifies the Need for a Culture of Cybersecurity

New Global Data Helps Set Priorities in Preparation for Emerging Attacks

Cybersecurity is a business requirement. Taking a holistic view of cybersecurity as part of the business means that risk, budget, and innovation can achieve balance.

In a global survey of 220 healthcare organizations the prevailing wisdom shows that 43% effectively align business risk appetite with cybersecurity risk management, 43% allocate cybersecurity budget to every project from the beginning, and 55% believe they can risk more with innovation because they take an adaptive approach to cybersecurity.

These numbers are telling a strong story about the alignment of cybersecurity and the line of business, the need for cybersecurity to be a through-line budget item on every project, and the promise of innovation because cybersecurity is, in fact, a business requirement.

By aligning cybersecurity and the line of business, healthcare organizations are moving to eradicate silos that can cause severe unintended consequences. Cybersecurity teams need to understand the critical key objectives of the line of business and make sure that priorities are understood and communicated. Ideally, this alignment obviates a reactive and transactional cybersecurity team.

With an aligned cybersecurity and line of business, innovation can flourish. Healthcare organizations allocating cybersecurity budget at the start of every new project means cybersecurity is architected in at the beginning instead of being transactional and bolted on once there is a problem.

Measure and Manage to Build Resilience

Healthcare organizations should look for ways to build a culture of cybersecurity to build a strong and resilient business. One way to accomplish this move to a cyber-resilient organization is for all leadership roles to have cybersecurity responsibility, with KPIs and metrics.

Healthcare organizations assign KPIs and metrics to leaders at a rate of 59%. This is a key indicator of cybersecurity being woven into all aspects of the business.

Assigning KPIs for cybersecurity across leadership helps foster a whole organization approach. Another metric of cybersecurity being central to a culture is how prepared organizations are to handle incidents. Unfortunately, only 38% of healthcare organizations have a formalized and codified incident response plan.

Healthcare organizations should focus on making sure an incident response plan is well documented and understood across the organization. When building out formalized response plans it is critical to take into consideration the impact of an attack on a healthcare organization.

Software Supply Chain Visibility Needs Improvement

In addition to building a culture of cybersecurity and a resilient organization, healthcare organizations need to have greater visibility into their software supply chains. Today, 54% of healthcare organizations have low to moderate visibility of their software supply chain.

Today’s software supply chain is made up of source code coming from a variety of places such as open-source repositories, in-house developed code, third-party proprietary code, and commercial-off-the-shelf software. All of this software works together seamlessly until it doesn’t. Understanding vulnerabilities, the impact of failed patch releases, and assigning confidence levels to suppliers are some of the steps organizations should take to have clearer visibility into the software supply chain.

The software supply chain is quickly becoming a critical part and potentially weak link of a business’ operations and intellectual property. Yet, only 19% of healthcare organizations plan to engage with their software suppliers about their security practices over the next 12 months.

Compare Your Organization to the Healthcare Survey Participants

We invite you to download our new LevelBlue Spotlight Report: Cyber Resilience and Business Impact in Healthcare. Use the report as a guidepost to determine how your own organization compares to the 220 global healthcare participants in this research.

Determine how you stack up to your peers with preparedness for AI-driven attacks, building a culture of cybersecurity, software supply chain visibility, and more.

Survey results are based on the input of 220 healthcare cybersecurity leaders and decision makers across 16 countries.

We invite you to get your own copy of the 2025 LevelBlue Spotlight Report: Cyber Resilience and Business Impact in Healthcare.

The content provided herein is for general informational purposes only and should not be construed as legal, regulatory, compliance, or cybersecurity advice. Organizations should consult their own legal, compliance, or cybersecurity professionals regarding specific obligations and risk management strategies. While LevelBlue’s Managed Threat Detection and Response solutions are designed to support threat detection and response at the endpoint level, they are not a substitute for comprehensive network monitoring, vulnerability management, or a full cybersecurity program.