Healthcare organizations are uncovering more cybersecurity weaknesses across their supply chains but struggling to correct them, according to Fortified Health Security’s 2026 Mid-Year Horizon Report.

Cybersecurity supply chain risk management findings are tracking toward a sixfold increase in 2026, with 63% rated critical or high risk. Fortified said assessments are exposing gaps in how providers evaluate technology vendors and other third parties before acquisition, monitor them after implementation and remediate identified vulnerabilities.

The findings place added responsibility on healthcare supply chain teams to incorporate cybersecurity into sourcing, contracting, and supplier management. Vendor reviews should address data access, system connectivity, identity controls, incident notification, business continuity, and recovery expectations; not only price, performance, and product availability.

Fortified also reported a 60% increase in critical and high-risk findings across healthcare organizations, while the overall remediation rate declined from 23.3% to 6.4%. The gap suggests providers are gaining visibility into supply chain and technology risks faster than their teams can address them.

The report recommends building accurate inventories of connected assets and vendors, assessing suppliers before acquisition, and aligning security programs with NIST Cybersecurity Framework 2.0. For supply chain leaders, the broader message is that cybersecurity must become part of routine supplier governance throughout the contract lifecycle rather than a one-time IT review.