From preparedness to proof: The next test of healthcare cyber resilience

The next test of healthcare cyber resilience is proof: Can your organization contain an attack, restore critical systems and maintain care?

At a Glance

Healthcare cybersecurity is moving from preparedness to proof as organizations face greater pressure to demonstrate that security controls, recovery plans and Zero Trust strategies work in practice. Recovery testing, integrated security architecture and measures such as detection, containment and recovery times can help health systems show that they can limit disruption, restore critical services and maintain patient care after a cyberattack.

When was the last time, if ever, your health system demonstrated its ability to restore clinical systems after a major cyberattack or other catastrophic disruption?

Cyberattacks are a matter of “when,” not “if.” But the “if” has not disappeared. It has shifted from the likelihood of attack to the certainty of recovery.

For years, organizations focused on improving preparedness through governance, policies and security controls. Today, the focus is shifting from preparedness to proof: demonstrating that critical systems can be restored, operations can continue and patient care can be maintained when disruption occurs.

Last year’s Digital Health Most Wired cybersecurity analysis found that healthcare organizations had broadly adopted core security capabilities, but a 21.5% integration gap remained between deployed tools and fully coordinated security operations. The finding suggested that while many organizations had invested heavily in building cybersecurity programs, the next challenge would be demonstrating that those capabilities could operate together effectively during an incident. That challenge now sits at the center of cyber resilience.

If resilience is the objective, the question becomes harder: How does an organization prove it is prepared?

From documented to demonstrated preparedness

Imagine a ransomware attack has taken critical clinical systems offline. The incident response plan is activated, recovery teams assemble and downtime procedures are implemented across the organization.

On paper, the organization appears prepared. Policies have been documented, technologies deployed and responsibilities assigned.

Yet the questions that matter most cannot be answered by documentation alone: How quickly can systems be restored? Will recovery processes perform as expected? Can patient care continue safely during disruption?

Those questions illustrate the difference between documented preparedness and demonstrated preparedness.

Preparedness increasingly requires evidence. Incident response, disaster recovery and business continuity plans provide essential structure for navigating a cyber event, but the existence of a plan is only one step along the path to maturity. Testing begins to provide evidence.

The 2026 Most Wired survey examines how frequently organizations test recovery procedures for restoring services after a cybersecurity incident, differentiating between organizations that conduct regular disaster recovery and business continuity exercises and those that test annually, during actual incidents or not at all.

The maturity path continues after the exercise. Organizations can document what they learned, assign owners and deadlines to remediation efforts, track those actions to completion, update procedures and validate the improvements during subsequent exercises.

That creates a continuous cycle: plan, test, learn, remediate and retest.

Each step provides another layer of evidence that preparedness extends beyond documentation. A recovery plan may describe what should happen during an outage. Testing it can reveal what actually happens, where dependencies have been overlooked and whether the clinical and operational teams expected to execute the plan can do so under pressure.

Zero Trust reaches its proof point

Recovery exercises help prove resilience. Zero Trust helps create it.

While testing demonstrates an organization’s ability to restore operations after an incident, Zero Trust architectures are designed to limit lateral movement, contain compromise and reduce the operational impact of an attack in the first place.

Zero Trust is not a new concept in healthcare cybersecurity, and individual elements such as multifactor authentication and network segmentation have become increasingly familiar. The next question is how deeply Zero Trust principles extend across the enterprise and whether they function together as an architecture.

The 2026 Most Wired survey reflects that distinction. It examines maturity across a spectrum ranging from comprehensive implementation across identity, devices, networks, applications and data to partial implementation, early pilots and continued reliance on traditional perimeter-based security. It also drills into specific components including identity-based access controls, device trust verification, microsegmentation, application access, data-centric security, and analytics and automation.

For healthcare organizations, that creates another opportunity to move from assertion to evidence. The question becomes less about whether an organization can say it has adopted Zero Trust and more about where trust is continuously evaluated, how access is controlled and how consistently those principles operate across the environment. A CISO should be able to show leadership where those access decisions are enforced and how the organization verifies that they continue to work.

In that sense, Zero Trust maturity offers a practical example of the larger shift toward proof. Individual technologies establish capabilities. Their integration and operation demonstrate whether the broader strategy is working.

Measuring what resilience looks like

Ultimately, however, proof has to extend beyond controls and architecture. Healthcare organizations also need to understand whether those capabilities are making them more resilient.

There may never be a single metric that answers that question. Instead, evidence can come from multiple sources: whether attacks are detected and contained, whether recovery procedures work as expected, whether weaknesses identified during exercises are remediated, and whether subsequent testing validates those improvements.

The 2026 Most Wired survey is examining that performance through measures such as mean time to detect, respond, contain and recover; incident severity; successful versus blocked attacks; false-positive rates; and threat coverage.

Taken together with recovery testing and exercises, those measures can move the conversation closer to what matters most when cyber risk becomes operational risk: If an attack gets through, can the organization contain the damage, restore critical services and continue caring for patients?

Raising the standard of evidence

Healthcare’s cybersecurity maturity journey did not end when organizations moved beyond compliance, adopted more sophisticated security controls or developed resilience strategies. Instead, that progress has raised the standard by which preparedness can now be judged.

The next step is demonstrating that controls are integrated, Zero Trust principles extend beyond isolated technologies, recovery procedures work and lessons learned become measurable improvements.

If the article’s opening question was difficult to answer, that may be the place to start.

About the Author

An accomplished executive in technology, security, and risk management, Chris Logan, Healthcare CISO at Zscaler, specializes in driving business agility through technical innovation, aligning strategic objectives with operations, and fostering high-performing teams. In his current role at Zscaler, he acts as a trusted advisor to executive teams and boards, translating complex cyber risks, compliance requirements, and emerging threats into clear, strategic, and actionable guidance to bolster operational resilience.

Chris’s extensive background includes serving as the Chief Risk and Information Security Officer for multiple highly regulated institutions across the healthcare, finance, technology, and education sectors. Additionally, he has academic experience teaching at Providence College’s graduate business school and served as an Information Assurance Officer in the U.S. Marine Corps. Chris earned his MBA from Bryant University and remains deeply committed to aligning risk management strategies with core business goals and outcomes.

About Zscaler

Zscaler (NASDAQ: ZS) helps healthcare organizations accelerate digital transformation so they can deliver connected care with greater agility, efficiency, resilience, and security. The Zscaler Zero Trust Exchange platform protects healthcare organizations from cyberattacks and data loss by securely connecting clinicians, staff, devices, and applications across hospitals, clinics, and remote care settings. Distributed across 200+ public data centers globally and thousands of private sites at the edge, the SASE-based Zero Trust Exchange is the world’s largest in-line cloud security platform, helping healthcare organizations safeguard sensitive patient data and support secure access to critical clinical systems.