When attackers gain access to these trust layers, the implications are far-reaching. Instead of compromising a single device, they can manipulate entire fleets. Instead of stealing data, they can disrupt entire operations. Instead of simply breaching a system, they can undermine the very mechanisms that organizations rely on to determine what (and whom) to trust.
This is especially concerning in healthcare, where operational continuity is critical for everyday patient care. Medical devices, diagnostic systems and clinical workflows are increasingly digitized and interconnected. A disruption to the systems that manage identity and device trust is not just an IT issue — it has real-world, life-or-death consequences.
The Far-Reaching Consequences of Cyberthreats to Healthcare
The Stryker incident also is an example of a much larger change in geopolitics. Attackers are increasingly using cyberattacks as instruments of statecraft, showing their capabilities as well as causing disruption. As a result, targeting trust infrastructure sends a powerful message: No system, regardless of geography, is beyond reach.
For healthcare organizations, this raises an urgent question: Are we protecting the right things?
LEARN MORE: How to ensure healthcare business continuity when IT fails.
Too often, identity systems, certificate management and endpoint control platforms are treated as background infrastructure. They’re important but not prioritized as much as other critical systems. That approach is no longer sufficient.
This is a wake-up call for healthcare organizations. Systems that manage identities, certificates and endpoints should be recognized and managed as core infrastructure, with the same level of protection as any mission-critical environment. Securing those trust layers is essential not only to prevent disruption but also to ensure the integrity and reliability of the entire system.
What does that mean in practice? It starts with visibility. Organizations need a clear understanding of where identities exist, how they are managed and how trust is established across systems. This includes not just human users but also the rapidly growing population of machine identities: devices, applications and services that operate autonomously.
It also requires stronger controls for how trust is issued, managed and validated. This includes enforcing least privilege, implementing robust authentication mechanisms and ensuring that credentials and certificates are continuously monitored and updated. Automation plays a critical role here, as manual processes simply cannot keep pace with the scale and speed of modern environments.
DIVE DEEPER: Healthcare can learn from NIST’s AI Risk Management Framework.
Looking Beyond a Single Cybersecurity Incident
Finally, organizations must recognize that trust is not static. It is dynamic, and it must be continuously verified. The systems that establish trust must themselves be treated as high-value assets, and they must be monitored, protected and resilient by design.
The Stryker attack is not an isolated event. It is part of a broader pattern that is reshaping how we think about cybersecurity. As attackers shift their focus to the foundations of trust, defenders must do the same.
In today’s world, securing your systems is only the beginning. The harder question is whether the systems you rely on to establish trust can themselves be trusted.
