Report

See what attackers see in your county, your state, and your district, and where to act first. This is Project Meridian: what hackers see when they “drop by” U.S. hospitals and clinics. Hospitals may lock their front doors at night. But healthcare entities’ internet-connected systems stay open around the clock.  Attackers know that a hospital’s internet-facing systems are always open. They scan for outdated software, weak logins, and leaked passwords, then they take the path of least resistance — whether that’s a direct strike or breaking in through a supplier. When hackers lock up a hospital’s systems, ambulances divert, surgeries are delayed, and staff go back to paper medical records. Patients pay the price. What has been missing is a way to see how it all connects: the shared suppliers, shared infrastructure, and shared vulnerabilities that let one failure impact multiple hospitals that prevent many patients from seeking the care they need — especially in rural communities. Project Meridian is SecurityScorecard’s solution. It maps cyber risk by location, using only what any malicious attacker on the internet can see. This allows leaders to determine where risk is concentrated and which fixes reach furthest across systems that depend on one another. This report applies it to 39,319 healthcare records across 2,979 U.S. counties. Key findings: Most graded healthcare entities do well. Of the 7,818 records with a security grade, 62.5% earn an A or B. Many healthcare entities do not do well. About 1 in 6 earns a D or F. Known threats are common. About 1 in 7 records shows a vulnerability that malicious threat actors are already using in real attacks. A good grade isn’t the full story. In our Texas sample, one hospital system earned an A while running some of the most dangerous vulnerabilities on live systems. Shared suppliers spread risk. In Texas, 11 of 12 hospital groups use Microsoft, and the same older web vulnerability appeared at five of them. Rural clinics have less margin for error. They score a D or F more often than urban hospitals, meaning patients often have no nearby alternative. Who this report is for The information in this report can also be applied to your state, your city, or your county’s footprint. Hospital and clinic leaders: See your risk and follow a 30-day action plan. Our team can run the same analysis on your organization’s footprint. State and local officials: Use the state-by-state view and the Texas deep dive to find where risk is concentrated. We can map your state, city, or county. Lawmakers: Review our recommendations on where you can reduce risk the most. We can walk you through what the data shows for your district. SecurityScorecard’s Project Meridian is a geospatial intelligence platform that shows cyber and physical risk across the nation’s 16 critical infrastructure sectors as one connected system. Download the healthcare report now by filling out this form. Set up a demo today to learn where risk is concentrated in your area and what to fix first. Note: Healthcare entities in the report are not named. Observations are made from outside each organization and invite verification; they do not establish a breach or patient harm.

IDC Spotlight, sponsored by SecurityScorecard A 2026 IDC Spotlight shows why point-in-time vendor risk assessments can no longer keep pace – and what continuous, threat-informed TPRM looks like in practice. As noted in the IDC Spotlight, the 2026 Verizon Data Breach Investigations Report (DBIR) puts third-party involvement in breaches at 48%, up 60% year over year — a sharper climb than the prior two years combined. In IDC’s Third-Party Risk Management Software Survey from August 2026 of 1,226 organizations using TPRM software, when asked to characterize their overall assurance method, only 16.2% describe continuous monitoring — security ratings, attack surface monitoring, and breach and vulnerability intelligence feeds — as the model in use. Get the full IDC Spotlight to learn: Why 30.9% of organizations say they are likely to switch TPRM software providers within the next 18 months (IDC’s Third-Party Risk Management Software Survey, August 2026) Why IDC believes continuous, threat-informed TPRM — built on inside-out telemetry, API-based data collection, and risk scoring tied to business context — will keep displacing point-in-time assessment as the baseline operating model over the next several years, and that the endpoint of this shift is a TPRM life cycle that is more than 90% automated, with analysts reviewing machine-generated findings rather than producing them by hand. Get the excerpt

SecurityScorecard researchers used Driftnet’s internet-scale discovery capabilities to analyze the network footprint of a small U.S. municipal utility provider that also operates as the town’s internet service provider (ISP). The investigation identified widespread exposure across internet-facing systems, including vulnerable surveillance equipment, exposed Industrial Control Systems (ICS), weak encryption configurations, and End-of-Life (EoL) Windows devices. The utility provider operates its own Autonomous System (AS), meaning internet connectivity and critical infrastructure services exist within the same broader operational environment. This convergence creates a concentrated point of failure where disruption to one service can affect others across the community. Over a six-month period, Driftnet identified 1,498 services across 692 IP addresses. Of those, 446 IPs (64%) exhibited at least one technical issue that increased exposure risk. SecurityScorecard’s Driftnet engine identifies 150% more internet-facing services than previous scanning methodologies, uncovering exposures traditional approaches miss. Findings included: 30 instances of Dahua and Hikvision surveillance equipment inside the entire footprint of the utilities AS. Banned internet protocol (IP) cameras could enable Man-in-the-Middle (MitM) attacks, Distributed Denial of Service (DDoS) attacks, malware-based campaigns, and more. Exposed ICS, SCADA, and OT-related services directly reachable from the internet. At least three /24 clusters hosting ICS or IOT services and consumer devices on the same broadcast domain. Weak or misconfigured encryption across 382 IP addresses, in addition to cleartext FTP and HTTP and unrecognized Certificate Authorities. EoL Windows hosts reachable via Server Message Block (SMB) and NetBIOS. A relic from the past, rarely ever makes an appearance outside of OT environments. 25 Known Exploited Vulnerabilities (KEVs) identified across internet-facing services. Convergence of a utility and ISP creates a single point of failure. Power delivery and internet reside on the same AS. Incidents on one impacts the other. The research also identified multiple network segments where consumer-grade devices, surveillance systems, and ICS-related technologies operated within the same local network environment. This lack of segmentation increases the likelihood that compromise of a lower-security system could enable lateral movement toward operational infrastructure. To understand the full scope of the findings, download the full report today to see how Driftnet delivers the visibility organizations need to move from reactive security to continuous, threat-informed defense.

Learn more in this resource.

The Marsh McLennan Global Cyber Risk Analytics Center and SecurityScorecard have come together to study how cybersecurity ratings correlate with reduced cyber insurance risk.

Learn more in this resource.