Healthcare organizations have made progress in defending against cyber attacks, but more needs to be done to improve cyber resilience. While the number of attacks more than doubled, security teams reduced the rate of successful attacks from 30% to 13%. To further strengthen defenses, organizations should focus on basics like asset protection, employ advanced technologies to automate responses, conduct proactive threat hunting, and ensure the CISO role evolves to address new business demands. With continued investments and transformations, organizations could achieve full cyber resilience within two to three years.

1. GAINING
GROUND
ONTHECYBER
ATTACKER
2018 State of Cyber Resilience
Healthcare Payers

2. Copyright © 2018 Accenture. All rights reserved. 2
SECURITY TEAMS
HAVE MADE PROGRESS
DEFENDING AGAINST
CYBER ATTACKS.
But more needs to be done.

3. As the number of attacks more than doubles, monitoring, detection and prevention
improves cyber resilience and helps organizations perform better under pressure.
IMPROVING CYBER RESILIENCE
IN HEALTHCARE PAYERS
Organizations reduced the rate of successful
attacks from 30% to 13%.
In the past 12 months, how many attempted / successful
breaches have you identified and how many were successful?
Average.
25
174
1
2018
Security breaches
Targeted attacks
106
232
32 30
2017 2018
Targeted attacks Security breaches
Copyright © 2018 Accenture Security. All rights reserved. 3
Healthcare (payer)

4. GAIN GROUND ON THE CYBER ATTACKER
Copyright © 2018 Accenture. All rights reserved. 4
FIVE WAYS TO
BECOME CYBER
RESILIENT.
Healthcare Payers

5. Despite progress, the
basics still need attention
Copyright © 2018 Accenture. All rights reserved. 5
1
say the organization
is not protected by their
cybersecurity program.
42%
Be brilliant at the basics.
Protect valuable assets, from the inside out,
across the value chain.
• Harden your high-value assets
• Protect legacy applications
• Practice your response

6. More damaging security
breaches accelerate the
need for cyber resilience
Copyright © 2018 Accenture. All rights reserved. 6
2
76%
say it is not possible to
appear “strong, prepared
and competent” if
security is breached
Test your resilience,
like an attacker.
Enhance conventional red attack
and blue defense team testing.
• Coached incident simulation
• Threat intelligence
• Experienced player-coaches

7. More need to invest
in critical technologies
against new threats
Copyright © 2018 Accenture. All rights reserved.
3
say new technologies are
essential to securing the
future of the organization.
84%
7
Employ advanced technologies
to automate defenses.
Prepare for attackers who use
advanced technology.
• Automated orchestration capabilities
enable teams to respond in near real-time
• Advanced identity access management
controls user access to data

8. Confidence remains high
but a proactive approach
is needed
Copyright © 2018 Accenture. All rights reserved.
4
say cyber attacks
are still a “bit of a black box;
we do not know how or when they
will affect our organization.”
77%
8
Use intelligence and data to be
proactive with threat hunting.
Find the attackers before they find you.
• Adopt a continuous response model
• Develop strategic and tactical
threat intelligence
• Monitor for anomalous and
suspicious activity

9. Higher CEO and board
engagement place new
demands on the CISO
Copyright © 2018 Accenture. All rights reserved.
5
Who does the CISO
report directly to?
9
The CISO needs to adapt.
Evolve the role of the CISO to be more
integrated with the business.
• Business adept and tech-savvy
• At home in the C-suite and the
security center
• Able to infuse a ‘security first’
culture everywhere
22%
41%
25%
1 2 3
Board CEO CIO

10. Copyright © 2018 Accenture. All rights reserved. 10
SECURITY FROM THE INSIDE OUT
Security teams perform better, despite
more attacks.
Leaders should embrace the good news
Investments are proving to be wise. Organizations
show they can perform better under greater pressure.
But transformation does not end here
Improvements must continue. Organizations could
achieve cyber resilience within two to three years.

11. Copyright © 2018 Accenture. All rights reserved. 11
ABOUT THE RESEARCH
In 2017, Accenture Security surveyed 2,000
executives to understand the extent to
which organizations prioritize security, how
comprehensive their security plans are, what
security capabilities they have, and their level
of spend on security.
Just over a year later, Accenture Security
undertook a similar survey, this time
interviewing 4,600 executives—representing
organizations with annual revenues of $1bn
or more—from 19 industries and 15 countries
across North and South America, Europe and
Asia Pacific.
More than 98 percent of respondents were
sole or key decision-makers in cybersecurity
strategy and spending for their organization.
LEARN MORE
accenture.com/stateofcyber
2018 State of Cyber Resilience

12. Copyright © 2018 Accenture. All rights reserved. 12
About Accenture
Accenture is a leading global professional services company, providing a broad
range of services and solutions in strategy, consulting, digital, technology and
operations. Combining unmatched experience and specialized skills across more
than 40 industries and all business functions—underpinned by the world’s largest
delivery network—Accenture works at the intersection of business and technology
to help clients improve their performance and create sustainable value for their
stakeholders. With approximately 442,000 people serving clients in more than 120
countries, Accenture drives innovation to improve the way the world works and
lives. Visit us at www.accenture.com
About Accenture Security
Accenture Security helps organizations build resilience from the inside out, so they
can confidently focus on innovation and growth. Leveraging its global network of
cybersecurity labs, deep industry understanding across client value chains and
services that span the security lifecycle, Accenture protects organization’s valuable
assets, end-to-end. With services that include strategy and risk management, cyber
defense, digital identity, application security and managed security, Accenture
enables businesses around the world to defend against known sophisticated threats,
and the unknown. Follow us @AccentureSecure on Twitter or visit the Accenture
Security blog.