EY Survey: Cyber Capability Enablement a Top Priority

As data breaches become more sophisticated, 81% of healthcare organizations believe that integrating cybersecurity into the core business strategy — beyond a defensive posture — is effective in improving operational efficiencies to deliver better outcomes.

• Most health organizations (72%) experienced a moderate to severe financial impact from cyber incidents in the past two years.
• Respondents reported operational disruptions (60%) and faced clinical consequences (59%), including delayed treatments and compromised patient trust.
• Health organizations experienced an average of five different types of cyber threats that impacted their organizations in the past year. Phishing, third-party breaches and malware were identified as the top threats.

Ernst & Young LLP (EY US) and KLAS Research (KLAS) today announced the release of its US Healthcare Cyber Resilience Survey, which gathered insights from 100 healthcare executives responsible for cybersecurity decisions within their organization. The findings, including perspectives garnered in person in collaboration with KLAS, shed light on the urgent need for healthcare systems to elevate cyber resilience to a strategic priority to deliver better outcomes, create value and protect patients. 

The survey underscores the threat of cyber vulnerabilities to business operations and patient care delivery in both large and small systems. Over 70% of health organizations reported significant financial, operational or clinical disruptions due to cyber threats (with an average of five different types) in the past year.

“Cybersecurity is more than a compliance checkbox — it drives safe care, patient trust and long-term success. Treating cyber resilience as a strategic priority empowers healthcare systems to thrive amid rising threats,” said Nana Ahwoi, EY Americas Consumer and Health Cybersecurity Industry Leader.

The report outlines six ways health executives can create cyber strategies to accelerate their success:

1. Cyber is a strategic imperative for the entire business: Align cybersecurity with strategic goals to reduce risk and improve outcomes.
2. New digital identity challenges call for a new playbook: Address the rise of artificial intelligence (AI)-driven threats and nonhuman identities.
3. Cyber as an innovation enabler: Support AI, automation and care delivery outside traditional settings.
4. Future-ready talent and workforce evolution: Tackle talent shortages and upskilling across the organization.
5. Beyond the cyber compliance checkbox: Shift from a regulatory burden to strategic risk management.
6. Why third-party risk needs disruption: Strengthen vendor oversight and ecosystem-wide visibility.

As cybercriminal sophistication evolves, health organizations are looking to adapt their strategies for monitoring and enforcing access controls. Sixty-eight percent of survey respondents said identity and access management would be the top priority for increasing investments in the coming fiscal year, and 81% said prioritizing cybersecurity in their business strategy is effective in overcoming challenges. Additionally, just over half of the respondents (52%) said training and upskilling personnel is another effective tool to combat cyber challenges.

Key findings from the report include:

• Strategic business priority: Healthcare leaders must shift from viewing cybersecurity as a compliance or IT issue to recognizing it as a core enabler of business strategy, patient safety and operational resilience.
• Widespread impact: Over 70% of surveyed organizations experienced significant financial, operational or clinical disruptions due to cyber threats — highlighting the urgent need for proactive investment and leadership alignment.
• Securing healthcare access: With the rise of AI-driven threats and complex vendor ecosystems, healthcare organizations are prioritizing identity controls and vendor oversight to protect sensitive data and ensure continuity of care.
• Innovation and trust: Robust cybersecurity supports the safe adoption of AI, automation and remote care models — allowing healthcare systems to modernize confidently while preserving patient trust and data integrity.

“Healthcare leaders must prioritize workforce cyber training and readiness to unlock the full value of cybersecurity investments — ensuring safe patient care and strengthening system resilience,” concluded Ahwoi.

Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!