HealthGuard

Hospital CISOs are being asked to show measurable impact while keeping systems secure and aligned with organizational priorities. Join us for Strategic Planning for CISOs, a learning event that takes you through a practical approach to creating a strategy that leadership understands and supports. You will learn how to align security initiatives with business objectives, define clear priorities, and communicate progress in a way that drives informed decisions. Save your seat: https://lnkd.in/gvPTGvYU

Friends don’t let friends use risk matrices. Want to level up your risk analysis game? Get the FREE Basic Risk Calculator™ for hospitals. Hospital cyber teams should quit relying on broken risk scoring methods that use vague numbers, colors, and labels (high/medium/low). The Basic Risk Calculator provides: - A hands-on way to learn fundamental risk quantification concepts - An easy-to-use and free tool that runs natively in Excel® (no additional plug-ins required) - A fix for common flaws found in traditional risk matrices and risk-scoring methods - A way to communicate risk in business/financial terms The Basic Risk Calculator is ideal for Hospital risk management teams that provide risk estimates, including: - Cybersecurity - Internal audit and compliance - IT (change management, project management, risk management) - ERM Download it here: https://lnkd.in/g244Fmet #RiskManagement #QuantitativeRisk #HealthcareSecurity #FAIR #Cybersecurity

What makes the Hospital Cyber Resilience Movement different from the healthcare cybersecurity initiatives that preceded it: - Most initiatives commit to raising awareness. This one commits to reducing the number. - Most initiatives publish frameworks. This one publishes a measurable target and a methodology for hitting it. - Most initiatives are funded by vendor participation. This one is explicitly non-commercial, with the quantification methodology made freely available. The ambition is simple: give every U.S. hospital the financial clarity to make better cyber risk decisions, and reduce actual ransomware losses in the process. Founding cohort recruitment is now open: https://lnkd.in/enrPyuF8

At SIRAcon 2026 in Boston, HealthGuard Security founded the Hospital Cyber Resilience Movement. The commitment is specific: - Reduce hospital ransomware risk by 20% within 12 months - Reduce hospital ransomware risk by 60-70% within 24 months - Prevent an estimated $1.3 billion in losses across the U.S. hospital ecosystem The methodology is anchored in FAIR, simplified for hospital implementation, and will be made freely available to the industry. Hospital CISOs interested in joining the founding cohort can register their interest here: https://lnkd.in/ew2whnTY

After a cybersecurity incident, the most important question from a hospital board is rarely, “Why didn’t we stop it?” It’s “Were we exercising due diligence?” That question defines the healthcare CISO’s risk environment in 2026. Regulators understand breaches happen. Auditors understand threat actors evolve. What they evaluate is whether leadership maintained disciplined, continuous risk governance. Did the process breathe? Did it generate telemetry? Did it create an independent, time-stamped record of execution? A hospital can experience an incident and still demonstrate strong governance. But a hospital cannot demonstrate strong governance if its risk management process depends on memory, manual tracking, and static documentation. The SolarWinds case crystallized this shift in accountability. In healthcare, that shift now intersects with HIPAA enforcement, CMS participation requirements, and 72-hour reporting mandates. We pulled these threads together in a recent article examining what “operational discipline” actually means in an audit context and why static documentation creates quiet liability for hospital CISOs. In this climate, security maturity matters. But execution evidence is what protects you. https://lnkd.in/egEHJP2w

The SEC did not question whether SolarWinds had a security program. They questioned whether it was being executed and whether leadership could prove it. That distinction is now shaping healthcare governance. In 2026, regulators and internal auditors are not satisfied with policy binders or annual risk assessments. They are asking for evidence of operational discipline: time-stamped records, defined ownership, documented escalations, and proof that risk decisions were reviewed on schedule. For hospital CISOs, this is more than compliance maturity. It is personal defensibility. An Excel risk register demonstrates awareness. A continuously operating system demonstrates execution. Boards are increasingly aware of the difference. The new standard is not “Do you have a process?” It is “Can you prove it was running last quarter and yesterday?” https://lnkd.in/eQqEneAP