Most major cyberattacks hitting the healthcare sector involve unpatched vulnerabilities dating back many years, a situation cybercriminals are more easily and swiftly able to exploit using artificial intelligence based tools, said Health Information Sharing and Analysis Center president Denise Anderson.
“The attackers are moving so quickly with artificial intelligence,” she said in an interview with Information Security Media Group conducted during the Healthcare Information and Management Systems Society 2025 conference in Las Vegas, Nev.
“They’re actually able to impact an organization within 27 minutes of initial access,” she said. On top of that, “it’s easier for them to not encrypt data with ransomware – 80% of the attacks don’t involve encryption – they just exfiltrate data with the threat of publishing it.”
Increasingly, smaller organizations such as doctor practices, clinics and rural hospitals are falling victim often because they don’t have the staff and other cyber resources needed to address the threats, she said.
“It comes from the top. The CEOs have to be invested in cybersecurity because it’s easier to defend and spend money upfront with investments than have an attack and spend millions trying to fix it.”
In this audio interview with Information Security Media Group (see audio link below photo), Anderson also discussed:
- AI tools in the hands of cyberattackers;
- How the Health ISAC disseminates information and collaborates with the sector during major cyber incidents affecting healthcare stakeholders;
- Transitions and regulatory change occurring in the federal government and how ISACs can help in providing cyber resources to fill in gaps during uncertain times.
Anderson is president of Health-ISAC, one of more than a dozen ISACs whose mission is protecting the nation’s critical infrastructure from attacks through dissemination of trusted and timely information. She also serves as chair of the National Council of ISACs. Anderson is a health sector representative to the National Cybersecurity and Communications Integration Center, a Department of Homeland Security-led coordinated watch and warning center. Prior to Health-ISAC, Anderson served as a vice president of the Financial Services ISAC. She has more than 25 years of management experience in the private sector.