Change Healthcare took down a third of US claims processing. Ascension spent weeks on the papers. OCR settlements keep citing “risk analysis failure,” and HITRUST r2 assessors are asking harder questions about what actually got tested versus what got scanned.<\/p>\n\n\n\n
The math on pentesting shifted in the middle of all that.<\/p>\n\n\n\n
In 2024, 1 in 40 findings was Critical. In 2025, it’s 1 in 10. The same scans, testers, and reporting formats, yet a 300%<\/a> jump in the share of findings that need immediate intervention rather than waiting until the end of the quarter.<\/p>\n\n\n\n That ratio comes out of Astra’s latest State of Pentesting report<\/a>, built on 6.8 million findings across 8,000+ engagements in 70 countries. For a healthcare compliance team walking into a 2026 HITRUST cycle or a HIPAA risk analysis refresh, it’s the stat that should reshape the year. As you already know, PHI environments don’t get graded on total findings closed. They get graded on whether the Critical ones were identified, patched, and evidenced before an assessor or an attacker gets there first.<\/p>\n\n\n\n Here’s why it matters, in the language of numbers your auditor already speaks.<\/p>\n\n\n\n Critical vulnerabilities grew 14.6x faster than the other severity buckets last year. If your program still tracks “total vulnerabilities closed” as its health metric, you’re watching the wrong dial. The total might look flat or even improve. The Critical share underneath it is what the OCR letter will eventually ask about. A compliance dashboard that averages severity away is doing a very good job of hiding the thing you needed to see.<\/p>\n\n\n\n The metric change is a one-line rule away. The practical change is simple: make severity-weighted risk visible in the same place you already track controls, evidence, and remediation.<\/p>\n\n\n\n Cloud findings in 2024 were 60,000 and in 2025 jumped up to 2.6 million. Cloud testing coverage in the same period grew 1.23x. The findings grew 43x.<\/p>\n\n\n\n Cloud pentests surface 2.4x more findings per engagement than web pentests. Most healthcare workloads that used to live in a hospital data center now sit in AWS, Azure, or a specialty EHR host. If the scope you signed off on last audit still treats cloud as the paragraph after the web app section, the gap between what’s tested and what’s exposed has widened without anyone updating a control.<\/p>\n\n\n\n This is the part most compliance calendars quietly get wrong. Patient-facing web portals get the deep pentest slot because that’s where the checklist points. The cloud environment holding the actual PHI gets a scanner and a screenshot.<\/p>\n\n\n\n IDOR (insecure direct object references) showed up across all six attack surfaces analyzed: web, API, cloud, iOS, Android, and network. In healthcare, IDOR is the bug that lets patient A pull patient B’s chart by changing a number in the URL. A scanner can technically flag it and rarely catches it in context, because “user 42 can see user 43’s record” only makes sense to someone who understands what a record means in your product.<\/p>\n\n\n\n Frameworks can’t prescribe this. That’s the entire reason the pentest requirement exists inside HIPAA’s Security Rule risk analysis, HITRUST, and SOC 2. The framework knows there’s a category of risk that only a person poking at your product will find. The stats just confirmed the framework was right.<\/p>\n\n\n\n Compliance and pentesting get easier to run together when the numbers agree on what “important” means. A few concrete moves the data supports:<\/p>\n\n\n\n 1 in 40 became 1 in 10.<\/em><\/p>\n\n\n\n If nothing else from the report lands, that ratio should. It’s the reason a healthcare compliance program that felt tight in 2024, right through the Change Healthcare fallout, can quietly drift out of shape in 2026 without a single control failing. The controls are fine. The threat mix underneath them moved.<\/p>\n\n\n\n The full State of Pentesting report<\/a> has the rest of the numbers, including remediation timelines by severity, framework patterns, and how AI features are changing what testers find. <\/p>\n","protected":false},"excerpt":{"rendered":" Change Healthcare took down a third of US claims processing. Ascension spent weeks on the papers. OCR settlements keep citing “risk analysis failure,” and HITRUST r2 assessors are asking harder questions about what actually got tested versus what got scanned. The math on pentesting shifted in the middle of all that. In 2024, 1 in … Read more<\/a><\/p>\n","protected":false},"author":139,"featured_media":49289,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[340],"tags":[],"class_list":["post-49281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-audit"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/139"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49281"}],"version-history":[{"count":1,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49281\/revisions"}],"predecessor-version":[{"id":49282,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49281\/revisions\/49282"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49289"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Critical findings are outpacing everything else.<\/strong><\/h3>\n\n\n\n
Cloud went from a side scope to the main quest.<\/strong><\/h3>\n\n\n\n
Business logic is still where humans beat tools.<\/strong><\/h3>\n\n\n\n
What this means for a 2026 healthcare compliance calendar<\/strong><\/h3>\n\n\n\n
\n
<\/li>\n<\/ul>\n\n\n\nBack to that one stat<\/strong><\/h3>\n\n\n\n