Healthcare organisations are struggling to address cybersecurity vulnerabilities as the volume and severity of threats continue to increase, according to a mid-year report from Fortified Health Security.
Hospitals and other healthcare providers resolved only 6% of identified risks during the first half of 2026, down sharply from 23% during the same period last year.
The average healthcare organisation also encountered 60% more vulnerabilities rated critical or high severity than in the first half of 2025. Fortified said the findings reflected a widening gap between providers’ ability to detect security weaknesses and their capacity to fix them.
Supply-chain security remains a significant concern. Providers identified six times more third-party and supply-chain risks than a year earlier, with nearly two-thirds classified as critical or high severity.
Healthcare facilities rely on numerous hardware and software suppliers, meaning an attack against a single vendor can disrupt organisations across the sector.
Identity and access management also remains challenging, particularly for smaller providers managing accounts for employees, travelling nurses and contract physicians.
The number of vulnerabilities linked to identity and access controls quadrupled year over year. Fortified found that 92% of healthcare network domains had an administrator account with a password that had not been changed in more than three years.
The report urged providers to isolate legacy medical equipment behind strict firewalls and avoid operating outdated systems through highly privileged administrator accounts.
Fortified also recommended regularly rehearsing incident-response plans to build “operational muscle memory” before an attack occurs.
While the report focuses on the US, its findings may also be relevant to Cayman healthcare providers, which face similar risks from third-party vendors, legacy equipment and weak access controls.
