Resilience, a provider of cyber risk management and insurance services, reports that the healthcare sector is currently facing a highly costly cyber threat landscape, with some organisations potentially misallocating their security spending.
In its report, US Healthcare and Cyber Risk: Threats, Trends and Strategies, the company analyses claims data from its healthcare clients to identify which security practices are most effective at reducing real financial losses.
The findings indicate that social engineering is responsible for 88% of significant financial losses across Resilience’s healthcare portfolio, underscoring the importance of human factors in cybersecurity risk.
In 2025, the average cost per claim exceeded $2 million, while individual extortion demands reached up to $4 million. The report also highlights that a limited number of practical security measures are consistently associated with reduced financial exposure, and that higher cost does not necessarily correlate with greater effectiveness.
“Healthcare is one of the most targeted sectors in the country, and the financial stakes have never been higher,” commented Vishaal “V8” Hariprasad, CEO of Resilience.
“What makes this research meaningful is that it goes beyond cataloguing the threat — it tells us what’s actually working. When we translate cyber risk into financial terms and look at real claims outcomes, the picture becomes much clearer for the leaders who have to make hard decisions about where to invest.”
“The healthcare organisations building genuine resilience aren’t necessarily the ones with the biggest security budgets,” added Jud Dressler, Head of the Risk Operations Center at Resilience.
“They’re the ones that have aligned their investments to the risks that carry the highest financial consequences. Controls like dual authorisation for wire transfers or continuous anti-fraud training aren’t expensive — but they’re delivering outsized protection. That’s the insight we want every healthcare security and risk leader to take away from this research.”
