When someone begins to read an article about cyber risks for healthcare, their first thoughts tend to lean towards ransomware, loss of data, or other technical risks. Make no mistake - those risks are real and increasing in frequency and although I believe there are selective threats of which healthcare companies should be aware, there are other risks that they need to be tracking.

The top three risks I see for healthcare include two areas that are gaining more attention – vendor risk and insurance. Yet, 2023 will bring a new risk that hasn’t appeared for healthcare yet - and in my opinion this is the biggest risk healthcare faces - which is a change in how cyber risk is managed by healthcare companies and the sector in general. 

The Department of Health and Human Services (HHS) is “beginning to work with partners at hospitals to put in place minimum cybersecurity guidelines and then further work upcoming thereafter on devices and broader health care as well,” according to Anne Neuberger, the Deputy Assistant to the President and Deputy National Advisor for Cyber and Emerging Technology.

Increased guidelines and regulations will force healthcare organizations to scrutinize and possibly increase the cybersecurity investments they make. These regulations could open a new set of items with which healthcare companies need to comply that will put pressure on teams to do more with existing resources. Companies will struggle to balance spending more on cybersecurity while maintaining quality patient care when non-IT related healthcare costs continue to grow.

A second risk facing healthcare companies is the vendors upon whom they rely. Most hospital IT environments rely heavily on Commercial Off-The-Shelf (COTS) products. Breaches can come from a variety of sources including external actors, internal errors, but also from the COTS products themselves. 

A third risk is the increased cost and  ring fencing of cyber insurance. Cyber insurance provides a financial backstop for companies but the challenge they face is the rising cost of insurance (over 48% year-over-year by some measures) while the exclusions in the policies are increasing.

This trifecta of risk – increased oversight and guidance from regulators, vendor supply chain risk, and insurance growth – puts healthcare companies in a unique bind as they are unable to raise their prices as companies in other industries would. For healthcare companies to correctly manage these risks, they’ll have to re-think how they measure and manage cyber risk.

How are CISOs currently measuring and reporting on cyber risk?

So why is the change in guidance and increased regulation a risk to healthcare? After all, identifying the areas where the organization is lacking in security and fixing it is a good thing. Yet these guidelines will most likely conflict with a different reality where 60% of hospital IT teams said they have “other spending priorities”, with less than 11%  identifying cybersecurity as a “high-priority spend”.

This is going to force a sea change in how CISOs of healthcare companies measure and communicate on cyber risk. Although cyber risk is a business risk, many organizations measure and report on cyber risk in technical terms. They might report metrics that include how long it takes to respond to an incident, how many incidents occur per month, or how many vulnerabilities they have, patch, or find in a given timeframe.

These are good metrics to capture and track but they lack business context. For example, are five incidents per quarter good or bad? Would ten incidents have been an acceptable measure or should we aim for two?

The increase in guidance will also come with an increase in compliance requirements. Likely, however, funding will not increase. CISOs for hospitals must become very adept at prioritizing the right cyber investments to make with limited resources. The right thing to do from a security perspective is to ensure the hospital is as secure as it can be within given budget constraints. Reporting the number of incidents, vulnerabilities, or other technical metrics will not enable the organization to effectively meet or manage the guidance

A trend that is growing and will help healthcare CISOs is Cyber Risk Quantification (CRQ). A recent article in TechCrunch called “2023 the year of Cyber Risk Quantification. CRQ enables CISOs to measure and communicate cyber risk in financial terms and to also prioritize where to spend their next cyber dollar based on financial risk reduction vice technical measures.

CRQ is making headwinds in a number of industries which have faced risks similar to the risks faced by the healthcare industry. Using CRQ CISOs are now able to answer questions like, “how much would an attack cost us?” and, “are we spending enough on security?” Applying CRQ for healthcare will not only help CISOs prioritize the right security investments, but it will enable the entire organization to understand and balance cyber risks alongside other risks they face.

How does healthcare cyber risks translate into dollars?

What would it look like for a healthcare organization to translate cyber risk into dollars? First, healthcare organizations must understand what cyber risk actually is. Cyber risk is a combination of a technical risk with a business risk. In other words,, a material financial impact from a cyberattack is the result of an actor who launches an attack on an IT system that has financial value to the actor. 

The two pieces of the cyber risk equation for healthcare companies are their attack surface and their potential losses. A company's attack surface should look both at the external and internal  views of IT. External data includes scans that view how the environment looks from outside the organization. Internal data that is valuable to measure cyber risk includes the security technologies that are in place, how mature those solutions and processes are, and the vulnerabilities that exist in an environment.

Not every company has this data easily available. We see some companies struggle for a number of reasons including a lack of a central repository that captures technical asset data, their latest security assessment is stale, or their scans are out of date. However, companies overcome these hurdles through a combination of using data from similar companies, making assumptions that can be validated, or working with partners to obtain the data.

Potential loss data is typically hard for companies to obtain. After all, if a company has had many material breaches, the odds are that that company is in dire straits. The best solution is to work with a CRQ solution that brings that financial loss data together in pre-built models so that you can quickly and defensibly build and tune scenarios to model risk.

Cyber risk quantification provides a mechanism for pulling these two disparate pieces - attack data and loss data - together. CRQ solutions that combine both pieces, with existing data and models, enables healthcare providers to accurately measure risk and quickly start mitigation.

Starting a  CRQ effort opens up new conversations enabling risk to be viewed differently. Companies begin to create a risk tolerance for cyber which  enables them to define the amount of financial risk they will accept. Companies can then build a transfer plan which brings cyber insurance into the equation. Finally, companies can plan mitigations based on how their security investments buy down risk in financial terms, which are ultimately the solution to the key risks healthcare companies face in 2023.

Most persuasively, a recent report from IBM showed that companies who leverage CRQ techniques had, on average, a $2.1 million lower loss due to cyberattack than companies that do not use CRQ techniques. 

Although 2023 will bring new and challenging risks to the healthcare industry, the industry is well-positioned to incorporate new solutions to help manage and mitigate cyber risk as a business risk.