What frontier AI means for healthcare leaders
In emergency medicine, every second counts. The ability to move fast and coordinate with precision changes the quality, cost and trajectory of care. Speed also matters beyond moments of crisis. When timely information determines the best course of action, the earlier patients and clinicians have answers, the faster they can act.
Cybersecurity needs to operate with the same urgency.
Frontier AI models have dramatically accelerated both the discovery and potential exploitation of software vulnerabilities. As healthcare leaders navigate this new security paradigm, they must protect clinical continuity and reduce risk, all while making faster and safer decisions when patient care, data and systems are on the line.
Their focus should be broader than any one model or release. And their response should not be driven by fear or a rush toward the latest tool. However, they face considerable challenges: keeping pace with evolving cyber threats, supporting remediation and doing so without disrupting care.
Many clinical systems cannot simply be taken offline for maintenance, whether because of potentially life-threatening disruption or regulations mandating strict patching requirements for connected medical devices. Further complicating matters, funding constraints have forced trade-offs, increasing tech debt and limiting observability across systems. While modernization can aid greatly in cyber defense, many healthcare organizations will need to mitigate risk with additional approaches.
Simply layering on more tools will not suffice. Cyber defense must shift from fragmented efforts to an operating model that integrates tools and teams and supports the continuous management of vulnerabilities and risks. Beyond asking how fast they can patch, healthcare leaders need to know which exposures pose the greatest risk to care delivery and business services, how to prioritize action to best protect patient safety, who owns each decision and whether the updates have actually reduced risk.
Boards are also setting new expectations for risk-based exposure management and operational resilience — a shift we’re witnessing firsthand as we partner with healthcare leaders worldwide to help them move from monthly patching cycles to significantly more aggressive timelines.
This transformation requires a foundation of strong cyber hygiene and modern cybersecurity strategies, including the adoption of zero trust. By segmenting critical systems, tightening third-party access and limiting lateral movement, healthcare organizations can reduce the blast radius of an attack and protect sensitive systems such as electronic health records while remediation, containment or recovery actions are executed.
Supported by enterprise-wide observability and AI-enhanced defense, the organizations able to operate with speed and control will have the upper hand. But healthcare leaders must determine their paths forward and act now. This flows into the four actions they must take.
01
Protect clinical continuity
For any organization, remediation can restrict services and cause downstream impacts. These impacts are magnified in healthcare, where health outcomes and patient safety are on the line, alongside compliance requirements and financial implications. Healthcare leaders must assess which clinical services are most critical and map dependencies: the assets, systems, integrations and identities that support these services, as well as their risk exposure. Critically, leaders need a clear view of which vendors support each service, the patches they’ve committed to deliver and what the backup plan is if they fall behind.
02
Identify the right action
The next step is determining which patches are safe to execute and which systems require alternative security measures. Healthcare leaders should assume that some exposures will fall under “no-patch” scenarios due to clinical, technical or financial constraints. In these instances, the goal is to implement compensating controls that mitigate risk, such as network segmentation, access restriction and enhanced monitoring. In any case, the goal is to improve protection without disrupting the care environment.
03
Invest for impact
As healthcare organizations pursue funding opportunities to update critical infrastructure, they should identify high-impact investments. At the enterprise level, this includes securing revenue cycle management, which provides financial stability alongside clinical continuity. A cyber event that disrupts billing, claims, coding, eligibility or payment workflows can cause serious operating stress even if clinical systems are functioning. And these systems serve as prime targets for cybercriminals due to the data they hold. Leaders may also consider directing investment toward modernization efforts so they don’t have to patch so often. For example, a centralized integration layer can improve threat visibility, allow for patching without disrupting data flows and reduce the increased risk of failure that comes with point-to-point integrations.
04
Accelerate speed-to-protect
Healthcare organizations ultimately need to move from periodic patching to continuous exposure management. AI-assisted operating models can help by enriching exposure data, accelerating triage, recommending action paths and supporting closed-loop validation. With the right guardrails, human approval and rollback paths in place, automation can reduce manual effort while supporting clinical stability and governance.
For today’s healthcare leaders, security concerns certainly didn’t begin with frontier AI. One analysis of more than two million devices across hundreds of healthcare organizations found that 89% of organizations were running medical systems vulnerable to publicly available exploits and with insecure internet connections. Healthcare organizations also continue to be among the most targeted by attackers because of the valuable data they possess.
Given the global nature of this challenge, it will be important to continue sharing best practices and fostering collaboration. Efforts like Palo Alto’s Frontier AI Defense initiative represent encouraging progress. Threat detection and response depend on timely action and the ability to share information both internally and across companies.
For healthcare systems, greater collaboration will inform and improve their approach to cyber resilience in this fast-evolving environment. The value of trusted partners will extend across each new stage, helping leaders keep up with unprecedented change while safeguarding their operations and the essential care their patients depend on.
Sovereignty debt is the new technical debt
As AI and cloud dependencies grow, enterprises face rising sovereignty debt. Learn how digital sovereignty and IT modernization can improve resilience and control.
SaaSpocalypse not: How AI coding is wiring the tech stack
AI coding won’t end SaaS. It will expand enterprise tech stacks, accelerate software creation and increase integration and governance needs.
The next AI challenge for banks is not intelligence. It is coordination.
Agentic AI is reshaping banking. Learn why coordination, data context and governance are critical to scaling AI across the enterprise.