Security Magazine logo
  • Sign In
  • Create Account
  • Sign Out
  • My Account
  • NEWS
  • MANAGEMENT
  • PHYSICAL
  • CYBER
  • BLOG
  • COLUMNS
  • EXCLUSIVES
  • SECTORS
  • EVENTS
  • MEDIA
  • MORE
  • EMAG
  • SIGN UP!
cart
facebook twitter linkedin youtube
  • NEWS
  • Security Newswire
  • Technologies & Solutions
  • MANAGEMENT
  • Leadership Management
  • Enterprise Services
  • Security Education & Training
  • Logical Security
  • Security & Business Resilience
  • Profiles in Excellence
  • PHYSICAL
  • Access Management
  • Fire & Life Safety
  • Identity Management
  • Physical Security
  • Video Surveillance
  • Case Studies (Physical)
  • CYBER
  • Cybersecurity News
  • More
  • COLUMNS
  • Cyber Tactics
  • Leadership & Management
  • Security Talk
  • Career Intelligence
  • Leader to Leader
  • Cybersecurity Education & Training
  • EXCLUSIVES
  • Annual Guarding Report
  • Most Influential People in Security
  • The Security Benchmark Report
  • Top Guard and Security Officer Companies
  • Top Cybersecurity Leaders
  • Women in Security
  • SECTORS
  • Arenas / Stadiums / Leagues / Entertainment
  • Banking/Finance/Insurance
  • Construction, Real Estate, Property Management
  • Education: K-12
  • Education: University
  • Government: Federal, State and Local
  • Hospitality & Casinos
  • Hospitals & Medical Centers
  • Infrastructure:Electric,Gas & Water
  • Ports: Sea, Land, & Air
  • Retail/Restaurants/Convenience
  • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
  • Industry Events
  • Webinars
  • Solutions by Sector
  • Security 500 Conference
  • MEDIA
  • Videos
  • Podcasts
  • Polls
  • Photo Galleries
  • Videos
  • Cybersecurity & Geopolitical Discussion
  • Ask Me Anything (AMA) Series
  • MORE
  • Call for Entries
  • Classifieds & Job Listings
  • Continuing Education
  • Newsletter
  • Sponsor Insights
  • Store
  • White Papers
  • EMAG
  • eMagazine
  • This Month's Content
  • Advertise
Security Magazine logo
search
cart
facebook twitter linkedin youtube
  • Sign In
  • Create Account
  • Sign Out
  • My Account
Security Magazine logo
  • NEWS
    • Security Newswire
    • Technologies & Solutions
  • MANAGEMENT
    • Leadership Management
    • Enterprise Services
    • Security Education & Training
    • Logical Security
    • Security & Business Resilience
    • Profiles in Excellence
  • PHYSICAL
    • Access Management
    • Fire & Life Safety
    • Identity Management
    • Physical Security
    • Video Surveillance
    • Case Studies (Physical)
  • CYBER
    • Cybersecurity News
    • More
  • BLOG
  • COLUMNS
    • Cyber Tactics
    • Leadership & Management
    • Security Talk
    • Career Intelligence
    • Leader to Leader
    • Cybersecurity Education & Training
  • EXCLUSIVES
    • Annual Guarding Report
    • Most Influential People in Security
    • The Security Benchmark Report
    • Top Guard and Security Officer Companies
    • Top Cybersecurity Leaders
    • Women in Security
  • SECTORS
    • Arenas / Stadiums / Leagues / Entertainment
    • Banking/Finance/Insurance
    • Construction, Real Estate, Property Management
    • Education: K-12
    • Education: University
    • Government: Federal, State and Local
    • Hospitality & Casinos
    • Hospitals & Medical Centers
    • Infrastructure:Electric,Gas & Water
    • Ports: Sea, Land, & Air
    • Retail/Restaurants/Convenience
    • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
    • Industry Events
    • Webinars
    • Solutions by Sector
    • Security 500 Conference
  • MEDIA
    • Videos
      • Cybersecurity & Geopolitical Discussion
      • Ask Me Anything (AMA) Series
    • Podcasts
    • Polls
    • Photo Galleries
  • MORE
    • Call for Entries
    • Classifieds & Job Listings
    • Continuing Education
    • Newsletter
    • Sponsor Insights
    • Store
    • White Papers
  • EMAG
    • eMagazine
    • This Month's Content
    • Advertise
  • SIGN UP!
CybersecurityManagementSecurity NewswireSecurity Enterprise ServicesSecurity Leadership and ManagementLogical SecurityCybersecurity News

How are healthcare CISOs reporting & measuring risks?

By Jerry Caponera
healthcare-freepik1170x658v57.jpg

Image by ipopba via Freepik

December 21, 2022

When someone begins to read an article about cyber risks for healthcare, their first thoughts tend to lean towards ransomware, loss of data, or other technical risks. Make no mistake - those risks are real and increasing in frequency and although I believe there are selective threats of which healthcare companies should be aware, there are other risks that they need to be tracking.

The top three risks I see for healthcare include two areas that are gaining more attention – vendor risk and insurance. Yet, 2023 will bring a new risk that hasn’t appeared for healthcare yet - and in my opinion this is the biggest risk healthcare faces - which is a change in how cyber risk is managed by healthcare companies and the sector in general. 

The Department of Health and Human Services (HHS) is “beginning to work with partners at hospitals to put in place minimum cybersecurity guidelines and then further work upcoming thereafter on devices and broader health care as well,” according to Anne Neuberger, the Deputy Assistant to the President and Deputy National Advisor for Cyber and Emerging Technology.

Increased guidelines and regulations will force healthcare organizations to scrutinize and possibly increase the cybersecurity investments they make. These regulations could open a new set of items with which healthcare companies need to comply that will put pressure on teams to do more with existing resources. Companies will struggle to balance spending more on cybersecurity while maintaining quality patient care when non-IT related healthcare costs continue to grow.

A second risk facing healthcare companies is the vendors upon whom they rely. Most hospital IT environments rely heavily on Commercial Off-The-Shelf (COTS) products. Breaches can come from a variety of sources including external actors, internal errors, but also from the COTS products themselves. 

A third risk is the increased cost and  ring fencing of cyber insurance. Cyber insurance provides a financial backstop for companies but the challenge they face is the rising cost of insurance (over 48% year-over-year by some measures) while the exclusions in the policies are increasing.

This trifecta of risk – increased oversight and guidance from regulators, vendor supply chain risk, and insurance growth – puts healthcare companies in a unique bind as they are unable to raise their prices as companies in other industries would. For healthcare companies to correctly manage these risks, they’ll have to re-think how they measure and manage cyber risk.

How are CISOs currently measuring and reporting on cyber risk?

So why is the change in guidance and increased regulation a risk to healthcare? After all, identifying the areas where the organization is lacking in security and fixing it is a good thing. Yet these guidelines will most likely conflict with a different reality where 60% of hospital IT teams said they have “other spending priorities”, with less than 11%  identifying cybersecurity as a “high-priority spend”.

This is going to force a sea change in how CISOs of healthcare companies measure and communicate on cyber risk. Although cyber risk is a business risk, many organizations measure and report on cyber risk in technical terms. They might report metrics that include how long it takes to respond to an incident, how many incidents occur per month, or how many vulnerabilities they have, patch, or find in a given timeframe.

These are good metrics to capture and track but they lack business context. For example, are five incidents per quarter good or bad? Would ten incidents have been an acceptable measure or should we aim for two?

The increase in guidance will also come with an increase in compliance requirements. Likely, however, funding will not increase. CISOs for hospitals must become very adept at prioritizing the right cyber investments to make with limited resources. The right thing to do from a security perspective is to ensure the hospital is as secure as it can be within given budget constraints. Reporting the number of incidents, vulnerabilities, or other technical metrics will not enable the organization to effectively meet or manage the guidance

A trend that is growing and will help healthcare CISOs is Cyber Risk Quantification (CRQ). A recent article in TechCrunch called “2023 the year of Cyber Risk Quantification. CRQ enables CISOs to measure and communicate cyber risk in financial terms and to also prioritize where to spend their next cyber dollar based on financial risk reduction vice technical measures.

CRQ is making headwinds in a number of industries which have faced risks similar to the risks faced by the healthcare industry. Using CRQ CISOs are now able to answer questions like, “how much would an attack cost us?” and, “are we spending enough on security?” Applying CRQ for healthcare will not only help CISOs prioritize the right security investments, but it will enable the entire organization to understand and balance cyber risks alongside other risks they face.

How does healthcare cyber risks translate into dollars?

What would it look like for a healthcare organization to translate cyber risk into dollars? First, healthcare organizations must understand what cyber risk actually is. Cyber risk is a combination of a technical risk with a business risk. In other words,, a material financial impact from a cyberattack is the result of an actor who launches an attack on an IT system that has financial value to the actor. 

The two pieces of the cyber risk equation for healthcare companies are their attack surface and their potential losses. A company's attack surface should look both at the external and internal  views of IT. External data includes scans that view how the environment looks from outside the organization. Internal data that is valuable to measure cyber risk includes the security technologies that are in place, how mature those solutions and processes are, and the vulnerabilities that exist in an environment.

Not every company has this data easily available. We see some companies struggle for a number of reasons including a lack of a central repository that captures technical asset data, their latest security assessment is stale, or their scans are out of date. However, companies overcome these hurdles through a combination of using data from similar companies, making assumptions that can be validated, or working with partners to obtain the data.

Potential loss data is typically hard for companies to obtain. After all, if a company has had many material breaches, the odds are that that company is in dire straits. The best solution is to work with a CRQ solution that brings that financial loss data together in pre-built models so that you can quickly and defensibly build and tune scenarios to model risk.

Cyber risk quantification provides a mechanism for pulling these two disparate pieces - attack data and loss data - together. CRQ solutions that combine both pieces, with existing data and models, enables healthcare providers to accurately measure risk and quickly start mitigation.

Starting a  CRQ effort opens up new conversations enabling risk to be viewed differently. Companies begin to create a risk tolerance for cyber which  enables them to define the amount of financial risk they will accept. Companies can then build a transfer plan which brings cyber insurance into the equation. Finally, companies can plan mitigations based on how their security investments buy down risk in financial terms, which are ultimately the solution to the key risks healthcare companies face in 2023.

Most persuasively, a recent report from IBM showed that companies who leverage CRQ techniques had, on average, a $2.1 million lower loss due to cyberattack than companies that do not use CRQ techniques. 

Although 2023 will bring new and challenging risks to the healthcare industry, the industry is well-positioned to incorporate new solutions to help manage and mitigate cyber risk as a business risk.


KEYWORDS: Chief Information Security Officer (CISO) compliance cyber security healthcare risk management

Share This Story

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Jerry Caponera is Vice President of Cyber Risk Strategy at ThreatConnect.

Recommended Content

JOIN TODAY
To unlock your recommendations.

Already have an account? Sign In

  • Security's Top Cybersecurity Leaders 2024

    Security's Top Cybersecurity Leaders 2024

    Security magazine's Top Cybersecurity Leaders 2024 award...
    Top Cybersecurity Leaders
    By: Security Staff
  • cyber brain

    The intersection of cybersecurity and artificial intelligence

    Artificial intelligence (AI) is a valuable cybersecurity...
    Logical Security
    By: Pam Nigro
  • artificial intelligence AI graphic

    Assessing the pros and cons of AI for cybersecurity

    Artificial intelligence (AI) has significant implications...
    Technologies & Solutions
    By: Charles Denyer
Manage My Account
  • Security eNewsletter & Other eNews Alerts
  • eMagazine Subscriptions
  • Manage My Preferences
  • Online Registration
  • Mobile App
  • Subscription Customer Service

Middle East Escalation, Humanitarian Law and Disinformation – Episode 25

Middle East Escalation, Humanitarian Law and Disinformation – Episode 25

The Money Laundering Machine: Inside the global crime epidemic - Episode 24

The Money Laundering Machine: Inside the global crime epidemic - Episode 24

Security’s Top 5 – 2024 Year in Review

Security’s Top 5 – 2024 Year in Review

More Videos

Sponsored Content

Sponsored Content is a special paid section where industry companies provide high quality, objective, non-commercial content around topics of interest to the Security audience. All Sponsored Content is supplied by the advertising company and any opinions expressed in this article are those of the author and not necessarily reflect the views of Security or its parent company, BNP Media. Interested in participating in our Sponsored Content section? Contact your local rep!

close
  • Sureview screen
    Sponsored bySureView Systems

    The Evolution of Automation in the Command Center

  • Crisis Response Team
    Sponsored byEverbridge

    Automate or Fall Behind – Crisis Response at the Speed of Risk

  • Perimeter security
    Sponsored byAMAROK

    Why Property Security is the New Competitive Advantage

Popular Stories

Rendered computer with keyboard

16B Login Credentials Exposed in World’s Largest Data Breach

Verizon on phone screen

61M Records Listed for Sale Online, Allegedly Belong to Verizon

Security camera

40,000 IoT Security Cameras Are Exposed Online

Security’s 2025 Women in Security

Security’s 2025 Women in Security

Red spiderweb

From Retail to Insurance, Scattered Spider Changes Targets

2025 Security Benchmark banner

Events

July 17, 2025

Tech in the Jungle: Leveraging Surveillance, Access Control, and Technology in Unique Environments

What do zebras, school groups and high-tech surveillance have in common? They're all part of a day’s work for the security team at the Toledo Zoo.

August 7, 2025

Threats to the Energy Sector: Implications for Corporate and National Security

The energy sector has found itself in the crosshairs of virtually every bad actor on the global stage.

View All Submit An Event

Products

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

See More Products

Related Articles

  • cyber security

    How CISOs can stay one step ahead of 2023’s risks, threats and attacks

    See More
  • SEC0820-Operations-Feat-slide1_900px

    How CISOs Can Effectively Measure and Report Security Operations Maturity

    See More
  • Notebook, laptop, and mug on desk

    How CISOs are grappling with budgets, burnout, and resource constraints

    See More

Related Products

See More Products
  • security culture.webp

    Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

  • school security.jpg

    School Security: How to Build and Strengthen a School Safety Program

See More Products
×

Sign-up to receive top management & result-driven techniques in the industry.

Join over 20,000+ industry leaders who receive our premium content.

SIGN UP TODAY!
  • RESOURCES
    • Advertise
    • Contact Us
    • Store
    • Want More
  • SIGN UP TODAY
    • Create Account
    • eMagazine
    • eNewsletter
    • Customer Service
    • Manage Preferences
  • SERVICES
    • Marketing Services
    • Reprints
    • Market Research
    • List Rental
    • Survey/Respondent Access
  • STAY CONNECTED
    • LinkedIn
    • Facebook
    • YouTube
    • X (Twitter)
  • PRIVACY
    • PRIVACY POLICY
    • TERMS & CONDITIONS
    • DO NOT SELL MY PERSONAL INFORMATION
    • PRIVACY REQUEST
    • ACCESSIBILITY

Copyright ©2025. All Rights Reserved BNP Media.

Design, CMS, Hosting & Web Development :: ePublishing

Security Magazine logo
search
cart
facebook twitter linkedin youtube
  • Sign In
  • Create Account
  • Sign Out
  • My Account
Security Magazine logo
  • NEWS
    • Security Newswire
    • Technologies & Solutions
  • MANAGEMENT
    • Leadership Management
    • Enterprise Services
    • Security Education & Training
    • Logical Security
    • Security & Business Resilience
    • Profiles in Excellence
  • PHYSICAL
    • Access Management
    • Fire & Life Safety
    • Identity Management
    • Physical Security
    • Video Surveillance
    • Case Studies (Physical)
  • CYBER
    • Cybersecurity News
    • More
  • BLOG
  • COLUMNS
    • Cyber Tactics
    • Leadership & Management
    • Security Talk
    • Career Intelligence
    • Leader to Leader
    • Cybersecurity Education & Training
  • EXCLUSIVES
    • Annual Guarding Report
    • Most Influential People in Security
    • The Security Benchmark Report
    • Top Guard and Security Officer Companies
    • Top Cybersecurity Leaders
    • Women in Security
  • SECTORS
    • Arenas / Stadiums / Leagues / Entertainment
    • Banking/Finance/Insurance
    • Construction, Real Estate, Property Management
    • Education: K-12
    • Education: University
    • Government: Federal, State and Local
    • Hospitality & Casinos
    • Hospitals & Medical Centers
    • Infrastructure:Electric,Gas & Water
    • Ports: Sea, Land, & Air
    • Retail/Restaurants/Convenience
    • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
    • Industry Events
    • Webinars
    • Solutions by Sector
    • Security 500 Conference
  • MEDIA
    • Videos
      • Cybersecurity & Geopolitical Discussion
      • Ask Me Anything (AMA) Series
    • Podcasts
    • Polls
    • Photo Galleries
  • MORE
    • Call for Entries
    • Classifieds & Job Listings
    • Continuing Education
    • Newsletter
    • Sponsor Insights
    • Store
    • White Papers
  • EMAG
    • eMagazine
    • This Month's Content
    • Advertise
  • SIGN UP!