Change Health care took down a third of US declares processing. Ascension spent weeks on the documents. Optical character recognition negotiations keep mentioning “threat analysis failing,” and HITRUST r 2 assessors are asking more challenging concerns regarding what in fact obtained examined versus what obtained scanned.
The mathematics on pentesting moved in the center of all that.
In 2024, 1 in 40 searchings for was Vital. In 2025, it’s 1 in 10 The exact same scans, testers, and reporting styles, yet a 300 % enter the share of findings that need prompt treatment instead of waiting up until completion of the quarter.
That proportion appears of Astra’s newest State of Pentesting report , built on 6 8 million searchings for across 8, 000 + engagements in 70 countries. For a health care conformity group walking into a 2026 HITRUST cycle or a HIPAA threat evaluation refresh, it’s the stat that should reshape the year. As you already understand, PHI atmospheres do not get graded on complete findings shut. They obtain rated on whether the Critical ones were identified, covered, and shown prior to an assessor or an assailant arrives first.
Right here’s why it matters, in the language of numbers your auditor currently talks.
Essential findings are surpassing everything else.
Important susceptabilities grew 14 6 x faster than the various other severity containers in 2014. If your program still tracks “overall vulnerabilities shut” as its health statistics, you’re seeing the incorrect dial. The total might look level or perhaps boost. The Crucial share below it is what the OCR letter will at some point inquire about. A conformity dashboard that averages severity away is doing a great job of concealing the thing you needed to see.
The metric change is a one-line regulation away. The useful modification is simple: make severity-weighted danger visible in the exact same location you currently track controls, proof, and removal.
Cloud went from a side range to the major mission.
Cloud findings in 2024 were 60, 000 and in 2025 jumped up to 2 6 million. Cloud testing protection in the exact same duration grew 1 23 x. The searchings for expanded 43 x.
Cloud pentests surface area 2 4 x extra findings per involvement than web pentests. A lot of medical care workloads that used to stay in a hospital data center now being in AWS, Azure, or a specialized EHR host. If the extent you validated last audit still treats cloud as the paragraph after the internet application area, the space in between what’s checked and what’s exposed has expanded without anyone upgrading a control.
This is the component most conformity calendars silently get wrong. Patient-facing web portals get the deep pentest slot because that’s where the list factors. The cloud setting holding the actual PHI obtains a scanner and a screenshot.
Service logic is still where humans defeat tools.
IDOR (troubled straight things referrals) showed up across all 6 attack surface areas analyzed: web, API, cloud, iphone, Android, and network. In healthcare, IDOR is the pest that lets client A pull individual B’s chart by changing a number in the URL. A scanner can practically flag it and hardly ever catches it in context, since “user 42 can see individual 43’s document” only makes sense to a person that comprehends what a record suggests in your product.
Structures can’t recommend this. That’s the whole factor the pentest requirement exists inside HIPAA’s Safety Policy threat evaluation, HITRUST, and SOC 2 The framework understands there’s a category of danger that only a person jabbing at your item will discover. The statistics simply validated the structure was right.
What this indicates for a 2026 health care conformity calendar
Compliance and pentesting obtain much easier to run together when the numbers settle on what “important” methods. A couple of concrete actions the information sustains:
- Re-scope cloud prior to the following pentest cycle. Beginning with any place PHI actually rests currently, not where it rested at the last audit.
- Adjustment the metric from “open searchings for” to “Essential open searchings for, aged.” A lot of compliance and protection systems can sustain this view. The bigger inquiry is whether groups are utilizing it.
- Schedule retest windows right into the HITRUST or SOC 2 schedule the same way you reserve assessor fieldwork. A pentest without a retest is a photograph, not a program, and OCR has actually stopped approving pictures.
- Book hands-on pentest hours for the surface areas where humans still beat devices: service logic, access control on patient documents, chained API misuse in between EHR and third-party applications. Allow scanners deal with the surface area layer.
Back to that one stat
1 in 40 came to be 1 in 10
If absolutely nothing else from the record lands, that proportion should. It’s the reason a medical care compliance program that really felt limited in 2024, throughout the Change Medical care results, can quietly wander out of shape in 2026 without a solitary control stopping working. The controls are great. The hazard mix below them moved.
The complete State of Pentesting report has the remainder of the numbers, including remediation timelines by intensity, framework patterns, and exactly how AI features are changing what testers locate.
