Seeing Risk Clearly: The Top Vulnerabilities Hackers Are Exploiting in Healthcare

Cyberattacks against healthcare are no longer isolated events — they’re a daily reality. Hospitals, physician practices, and digital health companies all face a relentless wave of attempts to steal, disrupt, or exploit sensitive data. And while the tactics of cybercriminals continue to evolve, one fact remains consistent: attackers look for the easiest way in.

Recent risk analyses across hundreds of healthcare organizations reveal the same uncomfortable truth. The most common vulnerabilities being exploited today aren’t cutting-edge zero-days or obscure technical flaws. They are long-known, preventable weaknesses — issues organizations often fail to remediate because of competing priorities, resource strain, or simple oversight.

The Big Picture: Where the Threat Lives

Healthcare’s complexity is part of the problem. Hospitals juggle legacy infrastructure alongside cloud platforms, third-party integrations, and medical devices. Physician groups run lean IT operations, often without dedicated security staff. Digital health startups build fast, layering new apps and services to meet market demand.

This mix creates an uneven attack surface, but the target is always the same: data. Adversaries know that patient information is valuable, and they consistently zero in on the systems where it lives and moves.

Analyses show that more than two-thirds of high-risk vulnerabilities across healthcare are concentrated in three areas:

🔹 Applications and SaaS platforms
🔹 Endpoint devices (laptops, tablets, mobile devices)
🔹 Identity and access management systems

In digital health companies, the concentration is even higher, with 80% of high-risk findings tied to SaaS and cloud application environments

The Top Vulnerabilities in Play

Five vulnerabilities stand out across every segment of healthcare:

1. Weak or missing multifactor authentication (MFA). Shared credentials and unmonitored login activity continue to provide easy entry points.
2. Dormant accounts. Orphaned or inactive accounts often go unnoticed, offering attackers stealthy backdoors.
3. Excessive permissions. Over-privileged users increase the blast radius of any compromise.
4. Untrained staff. Phishing and social engineering remain highly effective where training is inconsistent.
5. Network configuration gaps. Flat networks, open ports, and misconfigured VPNs or firewalls allow lateral movement once an attacker is inside

These aren’t new problems — but the persistence of these issues, year after year, underscores how difficult it can be for organizations to translate awareness into action.

Sector-Specific Weaknesses

While these vulnerabilities cut across healthcare broadly, different sectors face unique challenges.

Hospitals.
Large systems struggle with sprawling infrastructure and user bases. Outdated authentication practices and overextended permissions are compounded by contractual gaps, such as unclear vendor security requirements. Two-thirds of hospital risk stems from endpoints, SaaS, and application systems

Physician Groups.
Smaller practices are soft targets. Limited IT resources mean firewall rules, patching, and remote access configurations often go unreviewed. As a result, authentication gaps and misconfigured networks are among their top risks. Roughly 65% of risk stems from endpoints, SaaS, and applications

Digital Health.
Startups and SaaS providers typically have sophisticated cloud stacks but often lack disciplined identity management and secure DevOps pipelines. Dormant test accounts, misconfigured APIs, and inadequate monitoring are common. Here, 80% of high-risk components are applications, SaaS, or platform-as-a-service environments

When Risk Becomes Reality

The vulnerabilities above aren’t theoretical. They are being exploited in real incidents across the sector:

• A large health system experienced a ransomware attack after an outdated user account — never deactivated following an employee’s departure — was used to gain unauthorized access.
• A digital health platform suffered a PHI exposure when overly permissive access controls allowed external developers to download sensitive data. The exposure went undetected for months.
• A physician group fell victim to a business email compromise when a phishing attack tricked an untrained employee, leading to fraudulent payments and data loss

Each of these examples illustrates a common thread: the breach did not begin with an exotic, advanced exploit. It started with a basic, preventable gap that had been overlooked.

Why These Risks Persist

The persistence of these vulnerabilities highlights several systemic issues in healthcare:

• Resource constraints. Many organizations are underfunded and understaffed, with IT teams stretched too thin to focus on continuous risk management.
• Compliance-first mindset. Risk assessments are often conducted to “check the box” rather than to inform operational decision-making.
• Complexity and sprawl. As health systems expand their digital footprint, visibility into every account, device, and integration becomes increasingly difficult.

Since 2022, there has been nearly a 200% increase in identified high and critical vulnerabilities in healthcare risk analyses. This growth speaks not only to the rising sophistication of threats but also to the fact that basic issues remain unresolved.

What Healthcare Leaders Should Do Now

The path forward does not require radical new approaches. It requires discipline in addressing the fundamentals:

🔹 Inventory assets and dependencies. Know what systems exist, who owns them, and how they connect to sensitive data.
🔹 Conduct risk analyses at the component level. Go beyond high-level surveys and examine where vulnerabilities truly reside.
🔹 Remediate foundational issues. Strong MFA, timely deactivation of accounts, and least-privilege access must be non-negotiable.
🔹 Invest in workforce awareness. Train staff regularly and test their resilience against phishing and social engineering.
🔹 Hold vendors accountable. Demand risk transparency and clear contractual obligations around security practices

A Call to Action

Healthcare leaders face no shortage of competing demands, from patient care to financial pressures. But the evidence is clear: the most damaging cyber incidents in recent years have stemmed not from unknown vulnerabilities, but from well-known ones left unaddressed.

Seeing risk clearly — and acting on it decisively — is the most important step healthcare organizations can take to protect patients, comply with regulations, and ensure resilience in the face of ongoing threats.