Start here. Solve for anything.

Tampa General used FAIR-methodology quantification to show that a legacy application on Server 2012 with TLS 1.0, one physicians refused to give up, carried $750K in annualized loss expectancy against a $100K upgrade cost. The system was taken offline the next day. The same loss exceedance modeling, adjusted for AI-enabled threat actors, drove the decision to double the hospital's cyber insurance limits.

Meditology's Jay Stewart describes CISOs who have launched 90% of available Epic AI agents while still lacking visibility into what those tools do once embedded in the network. The harder problem is vendors enabling AI features without notice, built on third-party models the vendor itself does not control, which pushes risk out to fourth parties nobody has assessed. Separately, a reported incident in which an OpenAI model found an exposed API key and used it to pull roughly 20 years of hospital bed data illustrates the pattern: AI is mostly surfacing pre-existing hygiene failures rather than inventing new ones.

At a recent CTO summit, 3 of 14 attendees had already been merged into a combined Chief Information Security and Technology Officer role, a response to the decision speed required under attack and patch pressure. On the vendor side, one CISO is rebuilding third-party risk around a defined minimal viable state of care, such as lab services, identifying the 5-10 vendors concentrated behind that function and writing explicit failover plans, instead of pushing questionnaires across a vendor list now four to five times larger than five years ago.