Banking Information Security Podcast

AI is accelerating cyberattacks faster than organizations can prioritize them, forcing security leaders to rethink how they define and defend against “emerging threats.” Most modern threats aren’t new, just amplified by AI, says Akamai's Brent Maynard.

AI is compressing cyberattack timelines from months to minutes. While segmentation has been a gold standard security practice for years, many organizations are still operating with outdated, static approaches.

Cancer research and treatment innovation - and the tech that powers that - requires a great deal of collaboration and data sharing among multiple parties. But keeping that sensitive information secure and private is crucial - and requires adherence to standards, said Baxter Lee of Clearwater.

An identity-based microsegmentation deployment at Main Line Health in Philadelphia is helping to control how its roughly 60,000 devices communicate across the network in order to protect clinical operations and limit the impact of potential cyberattacks, said Main Line Health CISO Aaron Weismann.

Attorneys can conduct security risks assessments under the color of client privilege, making it less likely to surface in discovery during litigation. But healthcare firms should consider the cons before they take that route, said attorney Adam Greene, partner at the law firm Davis Wright Tremaine.

Real and intense financial pressures on rural and small healthcare clinics mandate making difficult decisions on allocating funds to cybersecurity, said Greg Sieg, CISO at the University of Michigan Regional Health Network. "The funding is just not there."

Medical device cyber challenges are among the most complex for manufacturers and healthcare delivery organizations for a variety of reasons, but there are some promising developments underway that could help ease the pain, said Phil Englert of the Health Information Sharing and Analysis Center.

For the U.S. healthcare ecosystem, the 2024 ransomware attack on Change Healthcare proved to be a supply-chain earthquake in showcasing critical third-party risk that entities now must carefully and urgently consider, said Erik Decker, CISO of Intermountain Health and a federal cyber adviser.

Long-life medical devices - products typically used for a decade or longer - are among the most post-quantum, cryptographically vulnerable technologies in healthcare, said Joern Lubadel, global head of product security at German-based medical device and healthcare products maker B. Braun.

Rural hospitals and clinics continue to struggle with a lack of cyber resources but a federal grant program set to provide $50 billion worth of funding across all 50 states could hopefully help lessen some of the pain, said Jim Roeder, VP of IT at Lakewood Health System in Minnesota.

To help strengthen the health ecosystem's overall incident response preparedness, the Health Sector Coordinating Council in coordination with the Health Information Sharing and Analysis Center will in July host a first-ever nationwide virtual cyber exercise, said Greg Garcia, of the HSCC.

Many healthcare sector organizations are delaying to even begin contemplating - let alone strategizing - how to mitigate post-quantum risk - but procrastination is a major mistake, said Ali Youssef, director of emerging tech security, at Henry Ford Health.

Tools that could help healthcare providers - regardless of size - to prioritize their medical device vulnerability management is where artificial intelligence could make a significant impact, said David Brumley, chief AI and science officer at security firm Bugcrowd.

Healthcare CISOs and their teams often contemplate the benefits of going passwordless in their organizations but face pushback from clinicians concerned that the new tech will slow down their access to critical patient care systems or disrupt their workflow.

What often appears to be turf wars between healthcare technology management, facilities OT staff, IT departments and security teams are often the result of unclear ownership and accountability for device security. And that presents safety risks to patients, says Mohammed Waqas, CTO of Armis.

AI chatbots rank as the number-one health tech hazard in 2026, followed by "digital darkness" and legacy medical device cyber issues, said Rob Schluth and Scott Luney, technology and security experts at patient safety group ECRI Institute, which compiles an annual top 10 list. They explained why.

AI-powered ransomware compresses attacks from weeks to minutes. Michael Villar, director of field security technology at Akamai, says banks need AI-driven segmentation to contain intruders fast, limit lateral movement and protect sensitive data before extortion begins.

Attackers that want to use artificial intelligence tools to build ransomware or help run their cyber operations risk getting much less than they bargained for, said security expert Candid Wuest, in part because they'll still rely on known tactics that can be readily spotted and blocked.

As the compliance deadline quickly approaches for changes to align the federal rules for the confidentiality of substance use disorder records with HIPAA, entities that participate in so-called Part 2 programs still face critical unanswered questions, said attorney Aleksandra Vold of BakerHostetler.

Artificial intelligence use in healthcare is only as safe and accurate as the governance and trust frameworks surrounding it, particularly in clinical environments where errors or hallucinations can directly impact patient care, said Dave Bailey, vice president at consultancy Clearwater.