Facing Onslaught of Attacks, Cyber Teams Balancing Resources Between Prevention & Response, KLAS Finds

Driven by the increasing interconnectivity of systems, the rising sophistication of attacks, and limited budgets, healthcare organizations are working to balance their cyber resource allocations, according to the recent KLAS report, Cybersecurity 2025: Organizations Assessing Their Cybersecurity Posture amid Rising Threats.

A Balancing Act: Prevention and Preparedness

Healthcare IT leaders face a complex dilemma: how to prioritize between incident prevention and breach preparedness. According to the report, while proactive measures like network segmentation and third-party risk management dominate investment priorities, some organizations are equally focused on preparing for breaches.

“Incident prevention is top of mind for many organizations, yet a third are also prioritizing incident preparedness for post-breach recovery,” the report stated. This recognition is driving investments in areas such as business continuity plans, crisis resiliency, and recovery procedures.

The Role of Vendors and Technology in Cybersecurity Strategies

Organizations rely heavily on external vendors to meet their cybersecurity needs, with a particular preference for cross-industry providers offering broad platform capabilities. The report highlighted Microsoft as the most frequently mentioned vendor, noted for its identity management and data protection solutions. Other prominent names include CrowdStrike, valued for endpoint detection and response, and Cisco, a leader in network security. “Organizations often prefer vendors with broad capabilities, enabling them to address multiple vulnerabilities through a single platform,” the report noted.

Healthcare-specific vendors like Fortified Health Security and Imprivata also play significant roles. Fortified Health Security provides expertise in crisis resiliency and cloud security, while Imprivata excels in identity and access management tailored to healthcare’s unique requirements.

AI: A Double-Edged Sword

AI is emerging as both a solution and a challenge in cybersecurity. According to the report, many healthcare organizations are optimistic about AI’s potential to enhance threat detection and streamline processes. However, concerns about AI’s use by attackers are equally prominent. Sophisticated phishing and social engineering attacks powered by AI are already on the rise.

One respondent cautioned, “AI is just one more thing to monitor amid the growing list of vulnerabilities and threats.” Despite this, organizations are exploring AI’s potential to manage endpoints, investigate incidents, and fortify email security.

Internal Challenges Hindering Progress

The report underscored several internal barriers that impede healthcare organizations’ ability to implement effective cybersecurity measures:

• Staffing shortages: Nearly half of the respondents cited insufficient staff as a critical obstacle. Smaller organizations are particularly vulnerable, with lean teams unable to address the growing volume of threats.
• Budget constraints: Limited financial resources restrict the adoption of advanced technologies and services. This is a significant concern across organizations of all sizes.
• Cultural gaps: A weak internal culture around cybersecurity exacerbates risks. Many organizations lack sufficient training and awareness programs to create a security-conscious workforce.

The report emphasized the need for a shift in focus toward people-centric initiatives, such as fostering a strong internal cybersecurity culture and solidifying governance policies.

Investment Trends and Emerging Priorities

Healthcare organizations’ cybersecurity investments reflect a mix of traditional and emerging priorities. The top areas include:

• Third-party risk management: Organizations are strengthening vetting processes and oversight for external vendors, recognizing that breaches often originate from third parties.
• Network security and segmentation: Securing interconnected systems remains a foundational priority to limit potential attack surfaces.
• Identity and access management: Enhancing controls to ensure that only authorized personnel can access sensitive data and systems.

AI also features prominently in investment plans, especially among smaller organizations that see it as a tool for achieving efficiency. However, the report cautioned that “AI can drive increased threats, even as it offers potential solutions.”

The Role of Healthcare-Specific Consulting Firms

The fragmented nature of the cybersecurity market has led healthcare organizations to seek specialized expertise. Consulting firms like Fortified Health Security and Optimum Healthcare IT are helping organizations navigate complex challenges, from incident preparedness to regulatory compliance.

“Specialized firms bring invaluable expertise, particularly in areas like crisis resiliency and third-party risk management,” the report noted. These firms are often especially helpful for smaller health systems that lack in-house expertise.

A New Year’s To-Do List

Healthcare IT leaders can adopt the following measures to enhance their cybersecurity posture:

• Strengthen third-party risk management: Conduct thorough assessments of vendors and maintain continuous oversight.
• Develop incident response plans: Create and regularly test business continuity and recovery procedures.
• Invest in AI strategically: Leverage AI for threat detection while implementing safeguards against its misuse.
• Foster a culture of cybersecurity: Conduct regular training to build a security-conscious workforce.
• Engage specialized vendors and consultants: Partner with experts who understand healthcare-specific challenges.

A Call to Action for Resilience

The report advises that healthcare organizations must adopt a holistic approach to cybersecurity, integrating technology, governance, and culture. As threats evolve, resilience will depend on agility, proactive investments, and preparedness. “Cybersecurity in healthcare is not just a technology problem; it’s a resilience challenge requiring an all-hands-on-deck approach.”

Click here for more Cyber Resources content.