Critical Condition — Healthcare Sector Cyber Exposure & Supply Chain Intelligence
Based on ThingsRecon scans of 5 healthcare organisations
Why healthcare attack surfaces demand urgent attention
Healthcare organisations face a unique convergence of risk: they hold the most sensitive personal data in any sector — patient health records, medication histories, diagnostic imaging — and they operate critical infrastructure where disruption directly threatens patient safety. Ransomware groups know this. Healthcare has been the most targeted sector for ransomware globally for five consecutive years, precisely because the operational consequences of downtime create maximum leverage.
Yet most healthcare security programmes focus inward — on clinical systems, network segmentation, and endpoint protection. The external attack surface — the patient portals, supplier integrations, clinical web applications, and third-party scripts that are visible to any attacker with an internet connection — is rarely mapped with the same rigour. ThingsRecon changes that. This report draws on agentless scans of five healthcare organisations across the Netherlands, Belgium, and the United Kingdom. Everything was discovered from public data only: DNS, TLS certificates, cloud metadata, internet-wide scanning, and API ecosystem mapping. No agents. No internal access. No questionnaires.
All organisations in this report are anonymised. Technology suppliers and infrastructure providers are named as they appear on the external attack surface.
How do healthcare organisations compare?
ThingsRecon scanned five healthcare organisations — hospitals, NHS trusts, and health technology vendors — simultaneously. The most striking finding is not the overall scores: it is that every hospital scanned received a D rating for software risk, indicating actively exploitable vulnerable components across their patient-facing digital estates.
Structural vulnerabilities across the healthcare digital estate
The patterns below appear consistently across all scanned healthcare organisations — regardless of size, country, or whether they are a provider or a vendor. These are not random security gaps: they reflect how healthcare technology has been built, procured, and maintained over decades.
Hospitals and healthcare providers are classified as essential entities under NIS2 Annex I. This triggers mandatory obligations under Article 21: risk analysis, security of network and information systems, supply chain security (Article 21.2.d), vulnerability handling, and incident reporting within 24 hours (Article 23). Health technology vendors supplying to essential entities may also fall within scope as important entities. ThingsRecon provides the continuous outside-in visibility that Article 21 compliance requires.
Discovery. Prioritisation. Monitoring.
Healthcare IT teams manage estates shaped by decades of procurement, mergers, and system integrations — with patient safety as the overriding operational priority. Security visibility cannot compete with clinical operations for resources. ThingsRecon provides the continuous, agentless outside-in view that fills the gap.
Continuous Discovery
Hospital digital estates include patient portals, appointment booking systems, clinical information portals, PACS viewer interfaces, supplier VPN endpoints, and legacy web applications — many unknown to the central security team. ThingsRecon discovers the full external surface continuously from a single seed domain, including assets from historical mergers and acquisitions.
Clinical Risk Prioritisation
With 75 Fix Now items across five organisations, healthcare security teams cannot act on everything at once. ThingsRecon scores every finding by exploitability and proximity to sensitive assets — enabling teams to prioritise vulnerabilities that directly threaten patient data or clinical operations over lower-risk infrastructure findings.
Supply Chain Monitoring
EHR vendors, medical device suppliers, clinical SaaS platforms, and NHS shared services create a complex and constantly changing supplier ecosystem. ThingsRecon detects changes to third-party connections — new certificate authorities, changes in CDN routing, new script suppliers — the moment they appear on the external surface, before they become incidents.
The suppliers inside every healthcare digital estate
Healthcare supply chain risk is not just about medical device vendors and EHR suppliers. ThingsRecon maps the technical supply chain — every third-party component detected on the external attack surface via scripts, certificates, DNS, ASN routing, and HTTP headers. These are the suppliers that standard TPRM questionnaires never reach, because they were never deliberately onboarded: they arrived embedded in platforms, website themes, and inherited integrations.
Microsoft is the single most embedded technology supplier in the healthcare sector. In practice, this means Azure Active Directory is the identity provider for every clinical application, Microsoft 365 handles all staff communications (including patient-related correspondence), Teams is used for clinical consultation and handover, and Azure hosts EHR data and clinical workloads. A digital proximity of 70% means Microsoft infrastructure is deeply woven into the most sensitive external-facing estate. The risk is not that Microsoft will be breached — it is that misconfigured Azure AD application registrations, overpermissive OAuth scopes, or undeclared Azure-hosted services create invisible attack paths that no perimeter tool maps. Under NIS2 Article 21(2)(d), healthcare essential entities must specifically assess supply chain security covering ICT service providers — Microsoft, as the dominant ICT supplier, is the first priority. ThingsRecon identifies every Microsoft-connected asset on your external surface, scores its proximity to sensitive clinical data, and monitors for changes continuously.
Aggregated risk signals across all scanned organisations
The following findings reflect patterns observed across all scanned healthcare organisations. Individual organisation-level findings with full asset detail are available through a full ThingsRecon engagement.
- Fix NowD-rated software risk across all three hospitals — the sector's most critical finding. Known-vulnerable JavaScript libraries and server-side framework components with public CVEs are present on external patient portals and clinical web applications in every hospital scanned. This is the primary initial access vector used in healthcare ransomware campaigns globally. 44 of the 75 Fix Now items sector-wide are software-related.
- Fix NowSSL/TLS service misconfigurations generating Fix Now findings in two hospitals. Weak cipher configurations and certificate issues on externally accessible clinical services expose patient authentication sessions to interception — directly triggering GDPR Article 32 obligations around appropriate technical security measures for special-category health data.
- Fix NowApplication-level security failures on patient-facing web applications. Fix Now application findings across multiple organisations indicate authentication gaps and insecure configurations on services that handle patient login, appointment data, and health record access.
- Fix SoonHTTP security headers absent on clinical web applications. All four scanned organisations have C or D-rated header hygiene. Missing Content-Security-Policy on patient portals that load third-party scripts creates a direct cross-site scripting vector — particularly acute where clinical portals integrate with Google Analytics, Microsoft Clarity, or other tracking tools.
- Fix SoonCertificate hygiene gaps across healthcare estates. Three organisations show C-rated certificate risk with Fix Soon items on externally accessible services. Certificate mismanagement in healthcare is particularly significant given the volume of sensitive data transmitted — and the GDPR obligation to protect special-category health data with appropriate encryption.
- MonitorSupply chain changes in third-party clinical platform suppliers not tracked. Across 684 mapped supplier connections, certificate rotations, DNS record migrations, and new script introductions occur continuously. Without external monitoring, a supply chain compromise in a clinical SaaS provider, EHR integration, or shared NHS service goes undetected — until it becomes a reportable incident under NIS2 Article 23.
Your organisation's exposure — mapped in 48 hours
This sector report shows the patterns. A ThingsRecon scan of your organisation shows exactly which assets, suppliers, and attack paths apply to you — with the NIS2 and GDPR mapping your compliance team needs.