REPORT
2025 healthcare email security report
Key insights from 180 email-related healthcare breaches and actionable steps to protect your organization.
REPORT
2025 healthcare email security report
Key insights from 180 email-related healthcare breaches and actionable steps to protect your organization.
Top takeaways
The Healthcare Email Security Maturity Index scored 170 U.S. healthcare IT leaders across eight dimensions of email security and mapped each organization to one of four maturity tiers.
170
170 U.S. healthcare IT leaders scored across eight dimensions of email security
58%
58% of healthcare organizations were breached through email in the past 24 months. 23% were breached more than once.
47%
47% of breached organizations named strengthening encryption as their #1 post-breach action, ahead of training (44%) or new tooling (42%).
64%
64% of healthcare organizations have been hit by an AI-generated email attack. Only 38% have AI-based defenses fully deployed and monitored.
Key resources
COMPLETE REPORT
Healthcare email security maturity index 2026
How 170 healthcare IT leaders rate their programs, what their controls actually do, and why breaches keep happening.
EXECUTIVE SUMMARY
Healthcare email security maturity index 2026
Seven of eight email security dimensions scored Proactive or Leading. The eighth, encryption, is doing outsized damage. Here's what the data shows.
INFOGRAPHIC
The encryption gap behind healthcare email breaches
A single-page visual breakdown of the eight maturity dimensions, where they score, and which one keeps showing up in breach data.
EXCERPT
The self-detection paradox
100% of healthcare IT leaders rate their breach detection as Excellent or Good. 58% of them got breached anyway. Both numbers come from the same 170 respondents.
EXCERPT
Portal friction is manufacturing the next breach
48% of healthcare organizations always require recipients to log in to a portal to read encrypted email. More than 1 in 3 report clinical staff bypassing the workflow.
EXCERPT
AI attacks are mainstream. AI defenses are not.
64% of healthcare organizations have been hit by an AI-generated email attack. Only 38% have AI-based defenses fully deployed and actively monitored.
