Notifications
Clear all
Topic starter
10/07/2026 9:17 pm
TL;DR: Healthcare breach costs reached $7.42 million per incident for the 14th consecutive year, while stolen credentials remained the top initial access vector and legacy systems continued to block patching and monitoring, according to IBM, Verizon, and HIMSS. The real control question is no longer prevention alone, but how identity scopes, segmentation, and lifecycle governance limit what an attacker can reach after entry.
NHIMG editorial — based on content published by Elisity: Reducing the Blast Radius: A Cybersecurity Summit Boston Recap
By the numbers:
- Healthcare led every other industry in breach cost for the 14th consecutive year, at an industry average of 7.42 million dollars per incident.
Questions worth separating out
Q: How should healthcare teams reduce blast radius after an identity compromise?
A: Healthcare teams should reduce blast radius by segmenting access around identity, not just around network location.
Q: Why do legacy devices make identity governance harder in hospitals?
A: Legacy devices make identity governance harder because they often cannot support MFA, frequent patching, or modern telemetry, yet they still sit on networks with valuable systems.
Q: What breaks when AI agents are not treated as identities?
A: What breaks is the assumption that only people and traditional service accounts can create meaningful access paths.
Practitioner guidance
- Map identity blast radius for critical clinical systems Identify which human users, service accounts, vendors, and AI-connected workloads can reach each high-value device or application, then remove unnecessary cross-zone paths and shared access patterns.
- Replace broad network trust with identity-scoped allow-lists Use microsegmentation policies that bind access to the minimum identity set needed for a task, especially where legacy devices cannot support modern authentication or patching.
- Force vendor access through controlled privileged gateways Eliminate direct remote administration paths and require all third-party maintenance to pass through monitored jump boxes, MFA-backed gateways, and session logging.
What's in the full article
Elisity's full blog post covers the operational detail this recap intentionally leaves for the source:
- Session-by-session recap of the Boston summit and the speakers' specific examples from healthcare and AI governance
- The detailed segmentation patterns discussed for legacy medical devices, vendor access, and internal administrative pathways
- The panel's discussion of AI agents, third-party identity boundaries, and post-quantum readiness
- The surrounding summit context and how the speakers tied identity to business resilience
👉 Read Elisity's recap of reducing the blast radius at Cybersecurity Summit Boston →
Reducing the blast radius in healthcare networks and AI identity?
Explore further
10/07/2026 9:40 pm
Blast-radius control is becoming the defining healthcare identity pattern. The article shows that perimeter defense is no longer the decisive control point when attackers enter through stolen identities and then seek the least resistant path. In that environment, identity-based microsegmentation becomes the mechanism that limits how much of the enterprise a single compromise can expose. Practitioners should treat containment as an identity problem, not only a network problem.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: Who is accountable when segmentation fails to contain lateral movement?
A: Accountability usually sits with the teams that own identity scope, network policy, and privileged access, because segmentation is only effective when those controls are aligned. In regulated environments, security, infrastructure, and system owners all share responsibility for ensuring that access paths are explicit, monitored, and revocable.
👉 Read our full editorial: Reducing blast radius in healthcare identity and AI agent governance
