What We Actually Find in Healthcare Penetration Tests

Across healthcare penetration tests the same findings recur. Not zero-days — ordinary configuration and design issues, each of which turns a single compromised workstation into access to the patient record.

---

1. Flat internal networks

The single most common and most consequential. A clinical workstation can reach the file servers, the imaging archive, the domain controllers and the medical device VLANs. No exploit needed — the network permits it.

Once an attacker has any foothold, everything is reachable. This is what turns a phishing email into an enterprise outage.

Fix: segmentation, starting with the highest-value assets. See microsegmentation in hospitals.

---

2. Legacy authentication left enabled

MFA is deployed, and legacy protocols that bypass it entirely are still available. Testers use them routinely, because they work.

Related and equally common: service accounts excluded from MFA "temporarily", and cached credentials on shared workstations that can be harvested and reused.

Fix: disable legacy authentication tenant-wide; treat service account exclusions as findings with expiry dates. See MFA in clinical workflows.

---

3. Broken object-level authorisation in clinical applications

Change an identifier in a request and receive another patient's record. It appears in patient portals, internal applications and APIs, and it is the finding with the most direct privacy consequence because it needs no sophistication at all.

Scanners rarely find it — it requires understanding what the identifier means.

Fix: authorisation checks on every object access, server-side, tested deliberately per endpoint. See secure development.

---

4. Shared and over-privileged accounts

Shared clinical logins on wards. Service accounts with domain administrator rights because that was easiest at install. Local administrator passwords identical across hundreds of machines, so one compromise yields all of them.

Fix: unique local administrator passwords, scoped service accounts, and individual authentication into clinical applications even where the workstation is shared. See privileged access management.

---

5. Unmanaged vendor remote access

A persistent tunnel installed at commissioning, shared credential, no MFA, no logging, reaching a clinical system. Testers find these by looking at installed software rather than firewall rules, and they are frequently the fastest route in.

Fix: broker it, time-box it, record it. See third-party remote access.

---

How they chain

This is why severity ratings on individual findings mislead. Read the attack narrative in a report rather than sorting the table by CVSS.

---

What usually falls outside scope

Just as informative as the findings is what the test was not allowed to touch. The common exclusions in healthcare:

• Medical device networks, excluded on safety grounds — understandable, but it means the segment holding infusion pumps and imaging modalities is untested. Passive assessment is the compromise worth asking for.
• The EHR vendor's hosted environment, which is contractually theirs. Ask the vendor for their own test results instead.
• Wireless, often dropped for time, despite guest and clinical networks frequently sharing infrastructure.
• Physical access, which in hospitals is unusually productive — unattended workstations in open clinical areas, and badge cloning at service entrances.
• Social engineering, excluded to avoid disrupting clinical staff, so the actual initial access vector goes untested.

An excluded area is not a clean one. Record the exclusions as known unknowns rather than letting a clean report imply coverage it never had.

---

Sequencing the remediation

Working through a report top-down by severity spends the budget on the wrong things. Sequence by how much of the attack path each fix removes:

The two low-effort items at the top remove more of the chain than most of what sits below them, and neither requires procurement.

---

What a good test gives you

Not a scanner output with a cover page. A narrative of how the tester moved through the estate, what they reached, and what would have stopped them — plus a clear statement of what was not in scope.

For scoping one properly, the penetration testing RFP template covers the requirements that make bids comparable.

GuardsArm runs penetration tests in clinical environments, including safe handling of medical device networks. Book a scoping call.