Loading story…
Healthcare and pharmaceutical organizations recorded 74% prevention effectiveness in the Picus Blue Report 2026, a nine-percentage-point decline from the sector’s 83% result in the prior year, when it ranked as the highest-performing industry. The decline indicates that a larger share of tested attack techniques bypassed existing defensive controls.
The assessment drew on more than 338 million simulated attack actions executed in live production environments by Picus customers between January and June 2026. Healthcare and pharmaceutical security leaders should validate detection and prevention coverage against current attack techniques, prioritize control gaps exposed by continuous testing, and account for clinical and operational constraints when remediating weaknesses.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Picus customers ran more than 338 million simulated attack actions against their own security controls in live production environments between January and June 2026. Picus Labs aggregated anonymized results from those simulations.
Healthcare and Pharmaceuticals recorded 74% prevention effectiveness in the Picus Blue Report 2026, a nine-percentage-point decline from the sector's prior 83% result, which had made it the highest-performing industry.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcepicussecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Picus Security’s Blue Report 2025 found that organizations detect only 1 out of 7 simulated attacks, exposing a significant gap between perceived and actual security effectiveness. The report highlights that configuration drift, integration gaps, and evolving threats cause security controls to silently fail, with 50% of detection failures due to log collection issues. Continuous validation through Adversarial Exposure Validation (AEV) and Continuous Threat Exposure Management (CTEM) is recommended to ensure controls are effective against real-world attacks.
Jun 29, 2026
A recent security posture report on the biotech sector has revealed that attackers can access sensitive health data with minimal effort, often requiring less than two hours per company to uncover critical vulnerabilities. Researchers found that APIs were the most prevalent weakness, accounting for 34% of identified issues, with many endpoints exposing personal information such as patient IDs, genetic reports, and partner data without authentication. Publicly accessible developer documentation, including Swagger and GraphQL introspection, allowed for comprehensive mapping of API surfaces, further increasing the risk of unauthorized access. More than half of the companies examined leaked internal system details through verbose error messages, exposed configuration files, or non-minified JavaScript, which included sensitive information like usernames, user IDs, file paths, and backend framework details. In some instances, hardcoded secrets such as API keys and private tokens were visible in frontend code, and verbose errors revealed stack traces and server internals, making it easier for attackers to identify exploitable weaknesses. Additionally, around 36% of companies had corporate credentials discoverable through public sources, often due to prior third-party breaches and stealer logs, highlighting the widespread issue of credential reuse. These exposed credentials, sometimes numbering 15 or more per company, could facilitate credential stuffing or account takeover attempts. The broader healthcare sector continues to face significant challenges, with breaches costing organizations an average of $398 per exposed record and $7.42 million per incident, the highest across all industries. The number of healthcare providers reporting losses over $200,000 quadrupled between 2024 and 2025, and 12% of providers suffered losses exceeding $500,000, double the average across all industries. The largest contributors to breach costs include detection and escalation, lost business, and post-breach responses, with many organizations raising prices to offset these expenses. Financial gain remains the primary motive for attackers in 90% of healthcare breaches, but espionage is increasingly significant, accounting for 16% of cases, partly due to geopolitical tensions such as the Russia-Ukraine war. Nearly half of healthcare organizations have experienced at least one cybersecurity incident in the past year, underscoring the sector's vulnerability. In 2024 alone, there were 1,710 reported data breach incidents in healthcare, with 1,542 confirmed cases compromising data integrity, confidentiality, or availability. The combination of technical weaknesses in biotech platforms and the high value of healthcare data continues to make the sector a prime target for cybercriminals. The findings highlight the urgent need for improved security fundamentals, including better API protection, credential management, and internal system hardening. Without significant improvements, healthcare and biotech organizations will remain at high risk for data breaches and associated financial and reputational damage. The report serves as a call to action for the industry to address these persistent vulnerabilities and adopt more robust cybersecurity practices. Proactive measures are essential to protect sensitive patient data and maintain trust in healthcare and biotech services. The ongoing trend of increasing breach frequency and cost demonstrates that current security measures are insufficient to counter evolving threats. Organizations must prioritize security at every level, from application development to employee credential management, to mitigate the risk of future incidents.
Jun 29, 2026
Recent reporting highlights a shift in enterprise cyber risk toward **external dependencies and identity abuse**. Coverage of the EU’s **NIS2** directive emphasizes that organizations are expected to treat **supply-chain security** as a core governance and architecture issue, reflecting the reality that third parties (e.g., cloud providers, software suppliers, maintenance access, and outsourced services) are frequent intrusion paths rather than risks contained “inside the firewall.” Separately, findings cited from Eye Security’s *State of Incident Response Report 2026* indicate attackers are increasingly **exploiting existing access** rather than “hacking in,” with **identity-based attacks** dominating and **passwords** implicated in the vast majority of such incidents; common initial compromise paths still include phishing, exposed/misconfigured internet-facing systems, social engineering, and software supply-chain attacks. In healthcare, a Trellix threat intelligence report based on **54.7 million detections** from 2025 healthcare environments warns cyber incidents are escalating from IT disruption into a **patient safety** issue due to highly interconnected systems and “cascading” outages. The report identifies **email** as the leading threat vector and the **U.S.** as the primary target, and describes ransomware and extortion activity intensifying, including groups such as **Qilin** (noted for targeting EHR databases), **INC Ransom**, and newer actors like **Sinobi** focusing on biotech; it also reports a sharp rise in **extortion-only** tactics with per-patient ransom demands intended to sidestep corporate insurance dynamics. Across these sources, **phishing** remains a dominant initial access method, with lures increasingly tailored to privileged IT roles (e.g., “AI Transformation” themes).
Jul 12, 2026