Security

Targeting Trust: Lessons From the Stryker Cyberattack for Healthcare

Health systems should re-evaluate their security strategies when trust infrastructure becomes a target.

Mike Nelson is the global vice president and field CTO at DigiCert.

The cyberattack on medical technology company Stryker in March reveals how cyber conflict is evolving. Endpoints, malware and data breaches dominate threat coverage. But this incident points to a deeper shift: Attackers are increasingly targeting the systems that establish and manage trust itself.

This incident shows a broader shift we’re seeing across the threat universe: Identity and the systems that manage it have become the new attack surface. In cases like this, attackers aren’t just targeting individual endpoints; they’re going after the management planes that establish trust across devices and systems. When those are compromised, enterprise devices themselves can be weaponized at scale.

In the past, cybersecurity strategies have simply relied on defending the perimeter or protecting individual assets. But modern enterprise environments, especially in sectors such as healthcare, are no longer defined by clear boundaries. The interconnected systems — devices, applications and users — are all tied together by layers of digital trust. Certificates, identity systems and endpoint management platforms are the connective tissue that allows these environments to function securely and efficiently.

Click the banner below for a cyber resilience strategy that supports success.

x_security_q325_animated_click_desktop_03

x_security_q325_animated_click_mobile_03

When attackers gain access to these trust layers, the implications are far-reaching. Instead of compromising a single device, they can manipulate entire fleets. Instead of stealing data, they can disrupt entire operations. Instead of simply breaching a system, they can undermine the very mechanisms that organizations rely on to determine what (and whom) to trust.

This is especially concerning in healthcare, where operational continuity is critical for everyday patient care. Medical devices, diagnostic systems and clinical workflows are increasingly digitized and interconnected. A disruption to the systems that manage identity and device trust is not just an IT issue — it has real-world, life-or-death consequences.

The Far-Reaching Consequences of Cyberthreats to Healthcare

The Stryker incident also is an example of a much larger change in geopolitics. Attackers are increasingly using cyberattacks as instruments of statecraft, showing their capabilities as well as causing disruption. As a result, targeting trust infrastructure sends a powerful message: No system, regardless of geography, is beyond reach.

For healthcare organizations, this raises an urgent question: Are we protecting the right things?

LEARN MORE: How to ensure healthcare business continuity when IT fails.

Too often, identity systems, certificate management and endpoint control platforms are treated as background infrastructure. They’re important but not prioritized as much as other critical systems. That approach is no longer sufficient.

This is a wake-up call for healthcare organizations. Systems that manage identities, certificates and endpoints should be recognized and managed as core infrastructure, with the same level of protection as any mission-critical environment. Securing those trust layers is essential not only to prevent disruption but also to ensure the integrity and reliability of the entire system.

What does that mean in practice? It starts with visibility. Organizations need a clear understanding of where identities exist, how they are managed and how trust is established across systems. This includes not just human users but also the rapidly growing population of machine identities: devices, applications and services that operate autonomously.

It also requires stronger controls for how trust is issued, managed and validated. This includes enforcing least privilege, implementing robust authentication mechanisms and ensuring that credentials and certificates are continuously monitored and updated. Automation plays a critical role here, as manual processes simply cannot keep pace with the scale and speed of modern environments.

DIVE DEEPER: Healthcare can learn from NIST's AI Risk Management Framework.

Looking Beyond a Single Cybersecurity Incident

Finally, organizations must recognize that trust is not static. It is dynamic, and it must be continuously verified. The systems that establish trust must themselves be treated as high-value assets, and they must be monitored, protected and resilient by design.

The Stryker attack is not an isolated event. It is part of a broader pattern that is reshaping how we think about cybersecurity. As attackers shift their focus to the foundations of trust, defenders must do the same.

In today’s world, securing your systems is only the beginning. The harder question is whether the systems you rely on to establish trust can themselves be trusted.

Hispanolistic/Getty Images