Healthcare ransomware gaps persist between EDR and backups

At a glance

What this is: Halcyon argues that healthcare ransomware is now a patient safety problem, with attacks and recovery costs exposing a persistent control gap between EDR and backups.

Why it matters: This matters because healthcare security teams need controls that interrupt ransomware execution fast enough to protect clinical operations, not just recover after systems fail.

By the numbers:

• In 2025, over 290 healthcare providers experienced ransomware attacks.

Context

Ransomware in healthcare is not only an availability problem. It becomes a governance failure when security controls cannot stop malicious execution before clinical systems are taken offline, and the operational impact can extend directly into patient safety.

The article frames a familiar gap in modern security stacks: defenders often have EDR on one side and backups on the other, but ransomware operators exploit the space in between. That gap is especially dangerous in healthcare, where small teams are expected to protect high-consequence environments around the clock.

Key questions

Q: What fails when ransomware can run scripts that EDR misses?

A: The failure is not only in detection but in prevention. If malicious scripts can execute before a defensive control intervenes, ransomware can begin staging encryption, disabling recovery options, or forcing operational shutdown. The practical issue is whether the environment can stop execution early enough to prevent patient-facing disruption, not whether it can alert after the fact.

Q: Why do healthcare ransomware events create more than IT downtime?

A: Because the impact lands on care delivery, not just systems. When clinical applications, scheduling, or records become unavailable, hospitals may delay treatment, divert patients, or slow urgent decisions. That is why ransomware in healthcare is a governance and safety issue, and why recovery planning must account for operational interruption, not only technical restoration.

Q: How do organisations know whether ransomware identity controls are actually working?

A: Look for reduced privilege breadth, shorter-lived elevated sessions, and faster revocation when suspicious activity appears. If a compromised identity can still reach backups, security tooling, or production management systems, the controls are not working. Effective programmes can demonstrate that access is constrained before attackers can convert it into business interruption.

Q: Should organisations prioritise containment or prevention for ransomware?

A: They should do both, but containment deserves priority when exposure is unavoidable. Prevention reduces the chance of compromise, while containment determines whether one successful intrusion becomes a business-ending event. In modern opportunistic ransomware, the second control often decides the real outcome.

Technical breakdown

Why EDR misses the execution stage

Ransomware campaigns often succeed by running scripts, loaders, or living-off-the-land techniques that do not trigger every endpoint control in time. EDR is designed to detect suspicious endpoint behaviour, but it can still miss the exact execution path attackers use to begin encryption or disable recovery options. In healthcare, that delay matters because a few missed executions can be enough to take clinical systems offline before humans can intervene. The practical question is not whether EDR is useful, but whether it covers the execution layer that ransomware increasingly targets. See the [[L1|Ransomware Prevention Guide]]. See the Ransomware Prevention Guide.

Practical implication: validate whether your endpoint stack can stop ransomware execution, not just alert after the process has started.

Why backups alone do not close the ransomware gap

Backups reduce recovery time, but they do not prevent the initial disruption that ransomware creates. If the attacker can encrypt production systems, delete restore points, or force an operational shutdown before recovery begins, the backup strategy becomes a downstream safety net rather than a control. The article’s core point is that healthcare teams cannot treat recovery as equivalent to prevention. They need controls that interrupt the attack before the organisation reaches the restore phase. That is where ransomware governance breaks down in many environments, especially where backup confidence substitutes for active prevention. See the [[L1|Ransomware Prevention Guide]].

Practical implication: test whether backup protection is paired with active prevention controls that can stop encryption and deletion attempts.

How breach and attack simulation exposes ransomware control gaps

Breach and attack simulation is valuable because it tests controls against known ransomware behaviours rather than assuming policy coverage equals runtime protection. In the article, a healthcare security engineer found that a control blocked script execution that EDR had missed. That is important because it measures the real boundary between visibility and prevention. If a simulated attack can execute where it should have been blocked, the environment has a governance and control gap, not just a tuning issue. Simulation turns a theoretical control claim into an observable outcome. See the [[L1|Ransomware Prevention Guide]].

Practical implication: use controlled simulations to identify which ransomware behaviours still pass through your defensive stack.

Threat narrative

Attacker objective: The attacker aims to encrypt or disrupt healthcare systems quickly enough to force operational downtime and recovery pressure.

1. Entry occurs through ransomware tooling that reaches the environment and begins running scripts or loaders on endpoints.
2. Escalation follows when the execution path bypasses or outpaces endpoint controls, allowing the malware to operate inside the network.
3. Impact is the disruption of clinical systems and recovery operations, with offline services affecting patient care and driving high restoration costs.

Breaches seen in the wild

• Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Healthcare ransomware is a patient safety governance problem, not just an endpoint problem. The article is right to frame the issue in operational terms because the consequence of failure is care disruption, not only data loss. Healthcare teams are judged on whether they can prevent clinical interruption, and that requires control coverage that goes beyond detection after execution. The practitioner implication is to treat ransomware prevention as a patient safety control objective, not a narrow SOC metric.

The real weakness is the gap between visibility and prevention. EDR can observe many threats, but the article shows why that is not enough when ransomware operators use scripts and other execution paths that evade detection. That creates a control assumption problem: teams assume the endpoint stack will catch what actually slips through. The practitioner implication is to validate execution-stage coverage explicitly, not infer it from endpoint telemetry.

Execution gap blindness: healthcare environments often discover that the control they rely on for detection is not the control that stops ransomware from running. That failure mode is more specific than generic “defence in depth” language because it describes the exact place where protection breaks down. The practitioner implication is to measure whether prevention controls are intercepting the techniques ransomware actually uses before encryption begins.

Ransomware resilience in healthcare depends on runtime disruption, not backup optimism. Backups matter, but they do not substitute for a control that can interrupt active encryption or destructive behaviour in time. The article’s governance message is that recovery posture should never be allowed to mask prevention weakness. The practitioner implication is to align recovery planning with controls that reduce the chance the restore plan will ever be needed.

The identity intersection is indirect but real when ransomware reaches privileged operational pathways. Although this article is not about NHI governance, the same failure pattern appears whenever ransomware can leverage service credentials, administrative sessions, or trust inherited from weak access boundaries. That is why healthcare security leaders should review privileged access paths alongside endpoint protection. The practitioner implication is to examine how information security policy template and access governance constrain high-risk operational access in the same environment.

From our research library:

• Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.

What this signals

Execution gap resilience: healthcare teams should assume that ransomware will exploit the space between endpoint detection and backup recovery unless they prove otherwise. The operational question is whether malicious code can still run long enough to affect care delivery, which makes prevention testing more valuable than confidence in architecture diagrams.

The article reinforces a broader programme lesson for hospitals and other high-consequence operators: downtime metrics are not enough if they are measured only after the fact. Security leaders need evidence that the controls in front of critical systems can interrupt the attack path before patient impact begins.

For practitioners

• Validate execution-stage ransomware prevention Run controlled tests that include common ransomware script and loader behaviours, then confirm which controls block them before encryption starts.
• Measure the EDR and backup gap Map where detection ends and recovery begins, then identify the point at which malicious execution can still disrupt clinical operations.
• Use breach and attack simulation for ransomware Test the environment with known ransomware techniques so you can see whether scripts, loaders, and payload staging are actually interrupted.
• Prioritise patient-impact scenarios in response planning Base tabletop exercises on clinical downtime, diverted care, and recovery delays rather than on generic data-loss assumptions.
• Reassess privileged access paths around critical systems Check whether administrative sessions, service accounts, or other high-risk pathways could be abused once an endpoint control fails.

Key takeaways

• Healthcare ransomware is a safety issue because it can interrupt care, not just disrupt IT operations.
• The article points to a persistent gap between endpoint detection and backup recovery, where malicious execution can still succeed.
• Healthcare teams need proof that their controls stop ransomware before encryption begins, not merely evidence that they can recover afterward.

Related NHI Mgmt Group resources: Ransomware Prevention Guide · Information Security Policy Template · Security Budget and Investment Planning Guide

Key terms

• Breach and Attack Simulation: Breach and attack simulation is the practice of repeatedly running safe attack-like tests against live environments to see whether controls detect or block them. It measures defensive effectiveness across real paths, not just policy intent, and is most useful when tied to current threats and business-critical assets.
• Clinical Downtime: Clinical Downtime is the period when healthcare systems or applications are unavailable and care is delivered using manual fallback procedures. It can arise from outages, cyber incidents, or maintenance. Teams should maintain paper workflows, verify identity and medication checks, and rehearse recovery so patient safety is not lost.
• Execution-Stage Control: An execution-stage control is a safeguard designed to stop malicious code after it begins running but before it can complete its objective. In ransomware defence, this is the point where detection must become prevention, otherwise the attack can progress into encryption or destructive action.
• Ransomware Recovery: Ransomware recovery is the process of restoring business operations after systems are encrypted, disrupted, or extorted. It includes detection, containment, eradication, backup validation, restoration, communication, and post-incident hardening. Effective recovery aims to restore trust in systems, not just bring files back online.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.