The healthcare industry is responsible for safeguarding critical data―from patient records to intellectual property―amid mounting cyber threats. It also faces continuing cost-cutting pressures, even as these organisations recognise the need to invest more in cyber defence.
According to our survey, healthcare leaders believe the top three cyber threats they’re least prepared to confront are cloud-related threats, quantum computing risks, and attacks on connected products. Moreover, only 35% of healthcare organisations have implemented holistic data risk controls across the entire data life cycle, well below the global average of 44% (all sectors).
To stay resilient, the industry should adopt strategies that safeguard sensitive data, comply with evolving regulations, and improve security without sacrificing efficiency or growth.
Drawing on a subset of PwC’s 2026 Global Digital Trust Insights survey findings, this report shows how 381 global leaders in healthcare payer, provider, pharma, and life sciences organisations are confronting these challenges in 2026 and beyond. It explores the issues they face, the threats they feel least prepared to handle, what’s driving security investments, and how emerging technologies are shaping their approach to cybersecurity.
Payers and providers
Healthcare payers and providers are facing costs that keep rising—now at $5 trillion annually and growing nearly 8% per year. That’s driven by higher insurance claims, reduced government funding, more administrative work, and the growing needs of patients with chronic and mental health conditions. Because of these financial pressures, many organisations are being asked to cut cyber budgets and are willingly taking on greater exposure to cybersecurity and data risks to avoid the upfront expense. However, given the potentially severe consequences of a cyber attack (the 2024 Change Healthcare breach is a stark example), this approach could lead to significantly higher costs and risks in the long term.
Many healthcare payers and providers are accelerating their shift into digital channels, which has increased cybersecurity pressures. Fragmented systems and burdensome workflows introduce new opportunities for data breaches, identity fraud, and ransomware attacks. Successfully balancing innovation with security measures will be essential as payers and providers work to control rising costs while safeguarding sensitive patient information and maintaining trust.
The threat landscape
Healthcare payers and providers are facing tougher cyber threats, increasing regulatory complexity, and the persistent challenge of protecting sensitive patient data. These converging factors underscore the need for stronger cyber, regulatory, and data risk management.
- Identity fraud is on the rise: Exploitation of unsecured applications and weaknesses in identity management systems has fuelled an increase in fraud, especially with online healthcare accounts and incentive programs like debit cards for preventative care. Our survey reflects this growing concern with payers and providers ranking data protection and trust, alongside security awareness training, among their top cybersecurity investment priorities for 2026.
- Data governance gaps increase exposure: Attackers frequently extract sensitive PHI and PII from documents residing in desktops and file shares. Secondary and tertiary copies of sensitive data such as extracts, spreadsheets, and historical records are often stored in uncontrolled environments, creating significant risk. According to our survey, only 39% of payers and providers have implemented data minimisation approaches to address data risk across their organisation. Even fewer (37%) have implemented data controls across the entire data life cycle throughout their organisation. These findings underscore a widespread challenge in balancing regulatory retention requirements with the need to reduce potential attack surfaces through better data management.
- Regulators continue to tighten requirements: New and evolving laws are transforming how healthcare organisations protect patient data. In the United States, proposed revisions to the HIPAA security rule would require annual security risk assessments and mandate stronger security measures like encryption and multi-factor authentication. India’s Digital Personal Data Protection Act imposes strict compliance requirements for processing health data and obtaining consent. Similar regulatory tightening is underway in other regions, as well, requiring payers and providers to strengthen compliance and risk management processes.
- Complex ecosystems create vulnerabilities: Fragmented and disaggregated digital ecosystems spanning multiple vendors, platforms, and data repositories create gaps in cyber defence and complicate risk management. This complexity challenges healthcare organisations to secure a broad attack surface where sensitive data moves between disparate systems, raising the stakes on data governance and trust. Our survey shows, for example, that the top challenges providers face in securing operational technology (OT) are lack of network segmentation (50%), gaps in OT skillsets and resources for cyber initiatives (47%), and lack of governance and responsibility for OT cybersecurity (45%).
The road to resilience
Payers and providers plan to boost their cyber budgets this year, with AI taking centre stage as the top investment priority. However, this contrasts with ongoing financial pressures causing some to carefully balance spending with risk tolerance. To get the better return on cyber spend, we suggest a proactive, future-forward strategy.
- Build AI security from the ground up: Embed Responsible AI principles across AI deployments and classify AI systems (including models, agents and their identities, applications and training data) based on sensitivity, criticality and exposure. Secure AI by expanding existing security controls to AI systems and identifying gaps where new capabilities are required.
- Secure identity and access management: Adopt a secure-by-design framework for connected products throughout the operational life cycle. Enforce consistent identity, access, and policy controls across third-party platforms, APIs, and integrations.
- Outsource strategically: Determine if your business should leverage managed services by developing an ROI-based managed services plan that maps technology, skills, and resource needs.
- Prioritise strong data governance: Profile and secure all data, establish restricted access for data that must be retained, and extend security controls beyond primary systems to cover legacy and acquired data to help reduce breach risks and create compliance around PHI and PII.
- Transform cyber defences with AI capabilities: Deploy AI-powered tools that enhance threat detection, automate routine tasks, and provide faster, clearer insights to security teams. Integrate AI-enabled solutions across your security operations, from cloud security and endpoint protection to insider threat detection, allowing your teams to identify risks sooner and respond more effectively without overloading analysts.
- Accelerate IT-OT network separation and modernisation: Create strong perimeters between IT and OT networks to prevent cross-contamination and lateral threat movement. Apply strong Industrial Internet-of-Things (IIoT) and OT governance into your architecture strategy to gain end-to-end visibility and controls across distributed environments.
- Strengthen regulatory compliance programs: Support compliance efforts by mapping cyber threat management to regulatory requirements. Implement structured, proactive compliance programs.
Pharma and life sciences
In managing cyber risks, safeguarding intellectual property is top of mind for pharmaceutical and life sciences (PLS) companies. Proprietary formulas, research data, and clinical trial information are high-value targets for cybercriminals. Cloud vulnerabilities, attacks on connected devices, and the massive web of third-party vendors make the threat landscape multidimensional. Breaches don’t just cause financial loss—they erode patient trust and can delay clinical trials or regulatory approvals. This human dimension compounds the urgency.
According to our survey, PLS companies are addressing these concerns when allocating cyber budgets. The top three cyber investments they’re prioritising over the next 12 months are AI, cloud security, and threat management. The main factors influencing these priorities are data protection and trust (42%), tech modernisation (39%), and optimisation of current tech and investments (37%).
Even so, only 24% of PLS firms are allocating significantly more budget toward proactive cybersecurity measures (e.g., monitoring, testing, training, governance) rather than reactive measures (e.g., response, remediation, recovery, fines). More than half (53%) haven’t started implementing any quantum-resistant security measures, even though quantum computing vulnerabilities rank among the top three threats they’re least prepared to address.
The threat landscape
PLS companies face a perfect storm: slowing growth, geopolitical headwinds, and intensifying cyber threats that target their most valuable asset—intellectual property.
- Complex value chains pose greater cyber risks: Pharma’s vast ecosystem of contract researchers, manufacturers, and vendors creates complex cyber risk challenges. Many companies don’t have full visibility or control over their third-party security, leaving critical gaps for potential attackers. In our survey, 25% of PLS leaders rank third-party breaches one of the top three cyber threats their organisation is least prepared to address.
- New rules are redefining data security: In the US, for example, Executive Order 14117 is tightening how pharma manages bulk data transfers internationally. India’s Digital Personal Data Protection Act imposes strict compliance requirements for processing health data and obtaining consent. Yet, only about half of PLS companies surveyed have fully implemented data classification policies (50%) and data loss prevention across key egress channels (48%), while only 33% have implemented controls across the entire data life cycle. What’s more, only 2% have implemented all eight data risk measures surveyed across the enterprise, making compliance even more challenging.
- Cloud threats remain a weak spot: Cloud and connected devices form the backbone of modern pharma operations, from storing terabytes of trial data to automating production lines. Yet they’re also the sector’s Achilles’ heel. Our survey shows pharma organisations rank attacks in these areas among the top threats they’re least prepared to address, underscoring the urgent need for secure-by-design architectures and continuous monitoring.
- IT/OT systems invite new threats: Outdated IT infrastructures in many pharma companies hamper security scalability and the adoption of modern defences. This leaves critical gaps vulnerable to advanced, AI-orchestrated attacks. Beyond IT, pharma relies heavily on smart manufacturing systems. Attacks on operational technology (OT) can halt production, disrupt supply chains, and compromise drug quality.
- Quantum risks loom large: While our survey revealed that quantum computing threats rank among the top three cyber threats PLS companies feel least prepared to address, only 19% of them are implementing quantum-resistant security measures. What’s more, only 7% are prioritising quantum readiness in their 2026 cyber budgets, often citing talent shortages and more pressing priorities as major barriers.
- Insurance and risk transfer face more hurdles: Cyber insurance is becoming a critical lever for managing cyber risk. But getting and maintaining coverage is becoming increasingly difficult. Insurers are tightening cyber policy requirements, pushing pharma companies to adopt stronger controls as a condition of coverage.
The road to resilience
Facing rising cyber and regulatory challenges, PLS companies need a smart, focused approach in 2026 to safeguard their most valuable assets. Here’s where to start.
- Elevate your cyber maturity: Move beyond broad cybersecurity frameworks and put your resources into control-based, risk-driven strategies that match your organisation’s maturity and threats.
- Prioritise AI for cyber defence: Deploy AI-powered tools that enhance threat detection, automate routine tasks, and provide faster, clearer insights to security teams. Leading pharma companies have integrated AI-driven solutions across their security operations, from cloud security and endpoint protection to insider threat detection, allowing their teams to identify risks sooner and respond more effectively without overloading analysts.
- Invest proactively: Address novel risks by advancing a secure-by-design mindset and use data to measure and show where cyber investments are needed most. Scale AI and other emerging technologies securely, budgeting for and embedding critical proactive security measures. Assess the long-term costs of reacting to security incidents versus investing proactively in cyber defences, managed services, insurance, compliance, etc.
- Start preparing for quantum: Readiness begins with assessing and mapping your exposure. Understand how you are currently using cryptography to secure your data and how quantum computing can impact your security protocols and controls. Determine which systems depend on cryptography and take steps to adopt post-quantum cryptographic (PQC) standards where needed. Evaluate your data and determine what should be quantum-ready now (e.g., high-risk or vulnerable data sets), then work with your data governance teams on implementing quantum-resistant security measures. Create a strategy and roadmap for integrating quantum-resistant technologies with existing infrastructure.
New world, new rules: The 2026 Global Digital Trust Insights
Get the full C-suite playbook and more of the latest findings for 2026.
Global cybersecurity and privacy
We help you reduce risk and increase resilience so you can keep your business moving forward
Contact us
