Visibility, blocking and blackout blueprints: Lessons learned from the cybersecurity tactical defense summit

Key takeaways

More than 85 percent of CHIME members have budgetary concerns around cybersecurity, yet speakers at the Tactical Defense Summit argued that with breaches averaging $7.4 million, health systems cannot afford to look away. Their advice centered on three moves: build an inventory tied to real usage data because vulnerabilities live in the systems you are not managing, resist the instinct to block sites and tools outright in favor of limiting actions while preserving access, and plan for the outage where systems look fine but staff cannot reach data. Franciscan Alliance’s post-ransomware Blackout Blueprint and HITRUST’s warning that third-party breaches have doubled in three years both point to the same conclusion, that vendor contracts, AI disclosure and outside partners now belong at the center of the defense plan.

Discussions around cybersecurity are never short on eye-opening statistics, whether it’s the lack of resources devoted to phishing education (4 percent of budgets) or the percentage of health sector security programs that run on 10 or fewer FTEs (40 percent, according to Health-ISAC).

One statistic, however, stood out at the recent State of Cybersecurity in Healthcare: Tactical Defense Virtual Summit: more than 85 percent of CHIME members have budgetary concerns around cybersecurity capabilities.

However, given the spike in attacks — the average cost of a breach is estimated at $7.4 million — it seems that healthcare organizations can’t afford not to invest in cybersecurity. For CISOs and other leaders, “the ostrich approach” of putting your head in the sand isn’t going to cut it.

To that end, leaders from health systems, vendor organizations, and associations spoke during the Summit about the challenges their teams have faced and offered “tangible, tactical solutions” that can be applied across the industry.

To set the stage, Denise Anderson, President and CEO of Health-ISAC presented findings from the 2026 CISO Benchmarking Report. Based on feedback from 76 leaders, she identified the top five responses to “What Keeps CISOs Up at Night”: Keeping pace with AI-powered adversaries; third-party and supply chain blind spots; ransomware impact on patient care delivery; regulatory complexity and compliance burden; and board-level understanding of cyber risk.

Anderson also identified five immediate priorities for CISOs that include making identity the blast-radius limiter, proving recovery, patching, segmenting “crown jewels,” and treating suppliers and embedded AI as operational risks.

“If we do these five things, attacks may still happen, but widespread care disruption becomes much less likely,” she said.

Visibility: Find out what’s out there

One point that several speakers pointed out is the critical role visibility plays in an effective cybersecurity strategy.

“Everyone is confident in the data they can see,” said Tom Cipolla, Global Field CTO, NinjaOne. The problem lies in the thousands of applications and tools that aren’t visible. “Vulnerabilities aren’t going to pop up in the systems you’re managing every day. They pop up in the systems you’re not managing — or those you don’t know about.”

Of course, tech bloat doesn’t happen overnight; it happens over time. Eventually, organizations end up not just with debt, but with systems that don’t communicate with each other and data that reside in silos.

So what can leaders do? Create an inventory that includes not just a list of items, but up-to-date information on usage and performance. “How many people are using the systems? How many endpoints or IOT endpoints aren’t being used? It’s bringing that inventory and tying it to real-world data,” Cipolla noted.

And once leaders have a better handle on what’s there, the next step is to determine whether tools are integrated and can identify vulnerabilities and start to remediate. “Those are the types of probing questions that need to be asked.”

Blocking isn’t it

Interestingly, an area of data security that touches so many — browser security — often doesn’t have a true owner despite heavy use, according to Maher Iskander, VP, Cybersecurity Strategy, Menlo Security. Perhaps for that reason, the instinct when protecting against malware and phishing is often to go heavy on blocking.

Iskander, however, doesn’t recommend it.

“Healthcare is such a critical industry. It can’t be bogged down by blocking a site or file because you may suspect it’s malicious.” Instead, his recommendation is to implement solutions that show users “a safe version of the website versus blocking it,” Iskander added. “You can limit actions but not access.”

He also advised focusing on “highly evasive threats that can become Zero Day, Zero Hour attacks” if left unchecked. “You need a layered cybersecurity stack that does prevention and quarantine and has the ability to assess threats.”

The same logic applies with firewalls, which cannot — and should not — block everything, said Jim Bowie, CISO in Residence at Zscaler. In fact, if CISOs take aim at popular products, they could face a mutiny. “You’re going to have a wall of people coming at you saying that you’re slowing them down.”

The better approach? Bring in leaders from other departments to help analyze the situation and identify the critical tools. “This is more than a cybersecurity problem. This is a business problem,” he said, one that requires careful examination of how AI will be applied. For those that make the cut, leaders must determine who has access, where it exists, and how it ranks in terms of risk.

But “unless you see something dangerous, don’t block it right away. I can’t stress that enough.”

Blackout blueprint

A stark reality facing CISOs, CTOs and other leaders? It’s nearly impossible to anticipate how a breach or outage will affect an organization until it has occurred. When Franciscan Health Alliance experienced a weeks-long outage after a 2021 ransomware attack, they learned a valuable lesson: “without access to computer systems, we were in trouble,” said Chuck Christian, VP of Technology and CTO, Franciscan Health Alliance.

Impressively, his team pieced together a plan to ensure employees were compensated while payroll services were down. But the outage exposed weaknesses that left leaders feeling uneasy. And so, Christian’s team engaged with a consulting firm to create a “Blackout Blueprint.”

Some of the components include standardized downtime procedures across 11 hospitals, regular tabletop exercises, and colocated data centers. Franciscan is also partnering with Rubrik to achieve faster response times and improve threat detection.

His two pieces of advice? Expect the unexpected and don’t go it alone. “When people plan for disaster recovery events, they typically plan for a data center going down,” noted Christian. “But that’s not really what happens.” Instead, it’s the more unpredictable scenario where everything appears to be operational, but staff can’t access data.

That’s why he’s a big proponent of partnerships. “Get some help. Because someone else can come in and see things you don’t see,” he noted, while also taking on some of the burden.

Vendor partnerships

As AI adoption continues to surge, vendor relationships — and particularly, the transparency aspect — are becoming increasingly important, said Bowie. “When you introduce something as complex as AI, you make the posture significantly riskier.”

The scenario he has witnessed is vendors turning on a new widget that’s designed to improve usability but contains an AI component — which may not have been disclosed. “All of a sudden, you have ethical and fidelity problems.”

The best way to avoid it is by establishing strong parameters when signing contracts, asking specific questions as to how the data will be used, both during and after the agreement period. “That’s your first line of defense,” he said, adding that any contracts that haven’t been reviewed in recent years should be updated as soon as possible.

In some cases, new terms may be required, which won’t come cheap, “but it’s well worth it to protect yourself on that front,” Bowie said. And, like all decisions, it should incorporate input from leadership across the organization.

Ryan Patrick, EVP, TPRM Customer Solutions, HITRUST, emphasized the criticality of having transparent conversations, particularly given the challenges in navigating new attack surfaces. “We need to work with our vendors and ask questions like, ‘what access do you really need?’”

Third-party breaches, he noted, have doubled over the past three years and show no signs of subsiding, lending further credence to the importance of collaboration. “We have to set aside time and focus on how to solve problems and not boil the ocean.”

Through participation in organizations like CHIME and Health-ISAC that facilitate information sharing, leaders can more effectively tackle those problems and move closer toward the goal of improving patient safety.

“We have to build communities,” Patrick said.

Kate Gamble is an award-winning healthcare journalist and editor with more than 20 years of experience covering healthcare IT. She has interviewed hundreds of healthcare leaders, and has focused on numerous topics, including digital transformation, patient experience, rural healthcare, physician and nursing leadership, and more. She can be reached at [email protected].