Sullivan Wright Technologies co-founder Chris Wright recently shared his expertise with Memphis Medical News, examining the cybersecurity trends that shaped the healthcare industry in 2025 and the lessons organizations can carry into 2026.

As he noted, 2025 was a challenging year in cybersecurity, shaped by the continued fallout from major breaches, evolving ransomware threats, and a growing emphasis on cyber resilience. While the year presented significant risks, it also reinforced important lessons that are helping organizations strengthen their security posture, such as:

Third-party risk remains a major concern.

The lingering effects of the Change Healthcare cyberattack underscored the dangers of relying too heavily on a single vendor or service provider. According to federal data, a growing share of compromised health information originates from third-party vendors, business associates, and software providers rather than health care organizations themselves. As a result, many organizations are reevaluating vendor relationships and exploring ways to distribute risk through multiple providers or enhanced resilience planning.

Ransomware continues to evolve.

Although ransomware incidents declined across some areas, smaller health care organizations experienced an increase in attacks. Modern ransomware operations increasingly resemble extortion schemes, with threat actors using sophisticated tactics designed to maximize operational disruption and financial pressure. These attacks reinforce the importance of layered cybersecurity programs that address prevention, detection, response, and recovery.

Risk management is replacing a compliance-only approach.

Health care organizations are moving beyond simply meeting regulatory requirements to focus on understanding and managing cyber risk. Resources such as the Department of Health and Human Services’ 405(d) Program and Health Industry Cybersecurity Practices (HICP) have helped organizations identify vulnerabilities and strengthen defenses through recognized industry frameworks.

Cybersecurity is now a business-critical issue.

Decision-makers increasingly view cyber risk alongside financial, operational, and reputational risks. The potential impact of a cyber incident on patient care and business continuity has elevated cybersecurity to a strategic priority for health care leadership.

What does Chris say the overarching lesson is? Cybersecurity can no longer be treated as a secondary concern. Healthcare organizations recognize the need for comprehensive planning, resilient operations, and proactive risk management to protect both patient data and continuity of care. This growing commitment to cyber resilience will shape the industry throughout 2026—and beyond.