If you’ve ever caught yourself saying, “We’re too small to be hacked,” or “That’s why we have cyber insurance,” you might want to keep reading. This episode shines a spotlight on five cybersecurity assumptions that seem perfectly reasonable – right up until they cost you time, money, or your sanity. From misplaced confidence in vendors to the myth that restoring your systems means the crisis is over, this conversation serves up practical reality checks with just enough humor to make the hard truths a little easier to swallow.
In this episode:
5 Costly Cybersecurity Assumptions – Ep 568
Today’s Episode is brought to you by:
Kardon
and
HIPAA for MSPs with Security First IT
Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity.
Great idea! Share Help Me With HIPAA with one person this week!
Learn more about Kardon Club and HIPAA for MSPs!
Thanks to our donors. We appreciate your support!
If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com
Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA
Episode Roadmap
[00:43] Five Costly Cybersecurity Assumptions Healthcare Leaders Make [02:01] “We Have Cyber Insurance, So We’re Fine”—Why That’s Not Enough [07:11] What Your Insurance Really Does (and Doesn’t) Cover in a Cyber Incident [11:16] Recovery Isn’t Over When the Systems Come Back On [14:11] Why Restoring From Backups Isn’t a Magic Fix [16:05] Cloud Data Backup Misconceptions and Hidden Gaps [23:08] Size Doesn’t Protect You—Small and Large Practices at Risk [30:41] The Myth of Vendor Security: Outsourcing Responsibilities Backfires [39:54] Cybersecurity Is Everyone’s Job, Not Just IT’s Problem [46:16] The Real Recovery Checklist: Business Impact, Leadership, and Patient Trust5 Costly Cybersecurity Assumptions
Today we’re talking about five cybersecurity assumptions. They’re assumptions many organizations have made. None of these sound unreasonable…until you’re living through a cyber incident. The problem is, when they’re wrong, they can become very expensive.
Do any of these sound familiar to you?
- We have cyber insurance, so we’ll be okay.
- Once the systems are restored, the incident is over.
- Our size protects us.
- Our vendors have security covered.
- Cybersecurity is an IT problem.
Let’s get into how they can be costly assumptions.
#1 We Have Cyber Insurance, So We’ll Be Okay
This one used to be the answer more often than today for having any cybersecurity protections at all. Now, it still lives but the good/bad news is the assumption that minimum protections and insurance is enough.
- Insurance is a financial tool, not a cybersecurity strategy.
- It doesn’t prevent attacks.
- It doesn’t keep your business operating.
- Policies often require organizations to maintain security controls.
- Coverage may have exclusions or limits.
- Insurance can’t restore customer trust, employee confidence, or lost productivity.
Insurance helps pay for recovery.
It is not your recovery plan.
Even with great insurance, organizations often discover the real challenge starts after the attack.
#2 Once Our Systems Are Restored, The Incident Is Over
Expectation:
- Flip the switch.
- Restore the servers.
- Get everyone back to work.
Reality:
Recovery is a process, not an event.
After systems are restored, organizations may still need to:
- Confirm attackers are completely removed.
- Rebuild systems instead of simply restoring them.
- Validate restored data.
- Reset passwords and privileged accounts.
- Restore interfaces and connected systems.
- Test medical devices and business applications.
- Continue forensic investigations.
- Determine what data was accessed or stolen.
- Meet breach notification requirements.
- Work through insurance claims.
- Respond to legal questions.
- Prepare for possible regulatory investigations.
- Rebuild employee confidence.
- Rebuild customer and patient trust.
- Catch up on weeks or months of delayed work.
In emergency management there’s a saying: the response phase is measured in days. The recovery phase is measured in months. Unfortunately, in some cases it can take years or, even worse, doors are closed permanently.
After hearing all of that, you might be thinking, ‘Thankfully we’re too small for anyone to bother with.’ Or maybe, ‘We’re a large organization with plenty of resources. Well, about that….
#3 Our Size Protects Us
Common assumption: “We’re too small to be a target.”
Reality:
- Automated attacks don’t care about organization size.
- Smaller organizations often have fewer security resources.
- Every organization has something attackers want.
- Smaller organizations are frequently viewed as easier targets.
Large Organizations
Common assumption: “We’re large. We have dedicated security teams.”
Reality:
- Larger organizations have larger attack surfaces.
- More employees create more opportunities for phishing and credential theft.
- More systems create more complexity.
- More vendors create more entry points.
- Larger organizations often represent bigger payouts for attackers.
Being small doesn’t make you invisible. Being large doesn’t make you invincible.
A burglar may target the mansion because there’s more to steal. They may target the smaller home because it appears easier to break into. The opportunity matters more than the size.
So if your size doesn’t protect you, maybe your vendors do… Ummm….
#4 Our Vendors Have Security Covered
- Vendors are essential partners.
- Responsibility cannot be outsourced.
- Contracts and Business Associate Agreements don’t eliminate accountability.
- Vendor due diligence should be ongoing.
- Third-party incidents often become your incident.
You can outsource the work. You can’t outsource the responsibility.
So if insurance isn’t enough, recovery takes months or years, your size doesn’t protect you, and vendors can’t own your security…whose responsibility is it?
#5 Cybersecurity Is An IT Problem
Cybersecurity is a business resilience issue.
Leadership sets priorities.
HR influences onboarding and security awareness.
Finance helps prevent fraud.
Operations maintain continuity.
Legal and compliance support response and reporting.
Every employee has a role.
Every cyber incident eventually becomes:
- An operations problem.
- A financial problem.
- A customer service problem.
- A legal problem.
- A leadership problem.
- In healthcare, a patient care problem.
The biggest cybersecurity challenge isn’t technology. It’s making sure your organization can continue operating when technology fails.
Quick Recap
- Insurance isn’t your recovery plan.
- Recovery doesn’t end when systems come back online.
- Your size doesn’t determine your risk.
- Vendors don’t eliminate your responsibility.
- Cybersecurity belongs to the entire organization.
Technology will continue to evolve. Attackers will continue to evolve. But these assumptions have been around for years, and they continue to cost organizations time, money, and trust. Challenge the assumptions before an attacker does.
Cybersecurity isn’t about living in fear – it’s about replacing risky assumptions with smart decisions. The five assumptions covered in this episode might sound harmless, but they’re exactly the kind of thinking that can turn a minor problem into a full-blown business crisis. A little planning, a healthy dose of skepticism, and the willingness to ask a few extra questions today can save you a mountain of headaches tomorrow. Stay curious, stay prepared, and remember: hope is not a cybersecurity strategy.
Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!
HIPAA is not about compliance,
it’s about patient care.TM
Special thanks to our sponsors Security First IT and Kardon.
