The challenge
The network had grown through acquisition, leaving a patchwork of systems, inconsistent access controls, and no unified view of risk. Patient care systems, email, and administrative platforms all carried different levels of protection — and nobody could say which gaps mattered most.
The approach
We ran a business-focused security posture assessment: instead of a generic checklist, we traced how an attacker could actually move from a phishing email to clinical systems. That attack-path view turned an overwhelming findings list into a short, ranked set of priorities.
The remediation program focused on identity, segmentation between clinical and administrative networks, and rehearsed recovery — because resilience is proven in practice, not on paper.
The outcome
Within two quarters the network closed its most critical exposure paths, established tested backup and recovery procedures for clinical systems, and gave leadership a clear, ongoing view of security posture. The board now reviews a one-page risk picture instead of a hundred-page report.