White Papers

Reporting Period: January 1 to March 31, 2026 This report by ReliaQuest provides insights into Ransomware and Data-Leak Sites, Vulnerability Exploitation, Attacker Target Insights, Top Techniques, Data Risk Protection, and…

Managing Human and Agentic Risk in a Blended Workforce The Attack Surface Has Changed Cyber risk is no longer confined to systems, networks, and data. It now lives in decisions. Employees decide what they click, what they…

A Guide to Preventing Next-Generation Supply Chain Attacks Health Industry Impact: The Numbers In the Shai-Hulud 2.0 attack data set we explored, 13 health and life sciences organizations were compromised, exposing 1,082 t…

Executive Summary OAuth tokens are now central to enterprise workflows, enabling seamless and secure integrations across platforms like Salesforce, Google Workspace, and marketing automation systems. However, this convenien…

Considerations for creating an Al governance and safeguards framework Throughout 2025 and early 2026, a team of AI-focused security professionals in the Health-ISAC Artificial Intelligence Working Group came together to cre…

This After-Action Report (AAR) summarizes the objectives, content, and key observations of the 2025 Health-ISAC Resilience Exercise Series. This report provides actionable insights for the health sector, encouraging organiz…

Information sharing about cybersecurity threats and vulnerabilities produces enormous benefits — enabling entities to quickly learn about and protect against new and evolving attack vectors. Abstract Effective information…

  Cybersecurity Trends and Threats in the Health Sector Summary Health-ISAC’s 2025 Fourth Quarter (Q4) Health Sector Heartbeat provides observations of ransomware, cybercrime trends, and malicious actor forum posting…

Cybersecurity is entering a turning point. For years, security programs have focused on building stronger technical controls, increasing awareness, and meeting compliance requirements. While these efforts improved baseline…

The era of simple Denial-of-Service (DDoS) attacks is over. Abstract As information systems become more sophisticated, so do the methods used by the attackers. Criminal and nation state actors have long recognized the valu…