Despite persistent threats, nearly half of healthcare organisations still do not test their staff’s resilience to attacks. In 2022, more than half (53 %) of the institutions surveyed did not perform any resilience testing. This number improved slightly in 2023, but 47 % of organisations still do not conduct any simulated phishing campaigns or penetration testing. Budget allocation for cybersecurity remains low, with 67 % of organisations spending 0–2 % of their budget in this critical area. This figure is notably worse than the cross-sector average. Healthcare sector 61 % of respondents from the healthcare sector believe that their organisation’s cybersecurity budget is insufficient. Cross-sector average 23 % Do not know 18 % 67 % 62 % 0-2 % 6% 2-5 % 13 % 4% 5% 5-10 % 10-15 % 0% 1% More than 15 % 1% 1% 0% 10 % 20 % 30 % 40 % 50 % 60 % 70 % 80 % Figure 21: Proportion of total budget allocated to cybersecurity, comparison of organisation in the healthcare sector vs. average (% of respondents) 90 % 100 % In a more positive trend, 87 % of respondents reported an improvement in their organisation’s level of cybersecurity compared to 2022 (definitely – 38 %, somewhat – 49 %), which may indicate a gradual sector-wide improvement in cybersecurity. 35