Your vulnerability scanners might show clean reports, your patching schedule could be on track, and your compliance audits may look good. Scanners identify outdated components, but they can’t reveal if password reset, MFA recovery, or help desk procedures can be exploited to enable account takeover.

As penetration testers, we don’t just look for missing patches. We focus on logic errors and process gaps that let us walk right in. After over a decade of testing healthcare systems, we’ve noticed a pattern: most breaches don’t come from unpatched systems. Instead, attackers exploit the hospital’s biggest strength—its culture of helpfulness and urgency.

If you’re unsure how your identity recovery, delegated permissions, or external assets would hold up under adversarial testing, that uncertainty itself is the signal.

Identity, Trust, and Operational Urgency

Hospitals are designed to say “yes” to clinicians so they can save lives. If a surgeon is locked out of their EMR, the priority is to get them back in immediately.

During a recent engagement, a controlled social engineering call to the help desk, using publicly available information to validate our identity and leaning into a ‘broken phone’ excuse, our tester built enough trust for the help desk to send an MFA reset QR code to a personal Gmail account controlled by our team. No technical exploit needed.

The question then becomes: if you need to reset your password or your multi-factor authentication device, what’s the process a user would go through to regain access? If your recovery process relies on human discretion rather than strict technical verification, it’s a high-risk entry point.

Physical Security and “Trust Layers”

Physical security in hospitals is also uniquely challenging because hospitals are open to the public. Anytime you have to let the public in, it’s a huge challenge. Attackers will look to exploit any “trust layer” they can.

To illustrate this, during one assessment, we initially encountered a rock-solid security guard who denied us access to a restricted elevator because we didn’t have a badge. However, we noticed a floor with heavy construction that would give us access to the restricted area. We took advantage of it and, with confidence, walked through the construction space to the other side, then took an unguarded elevator up from there. At the final access point, the guard buzzed us in without looking up from their phone, assuming we must have been cleared by the second layer of security.

This highlights a common vulnerability: Attackers look for temporary gaps in the physical perimeter, whether it’s a construction zone, a service hallway, or a temporary work site. This raises the question: If someone bypassed a checkpoint using one of these non-standard routes, would your controls prevent it, or would they rely on trust and urgency?

Conduct a Structured Active Directory Permission Review

Just as we bypass physical checkpoints via temporary routes to test the ‘trust’ of your staff, we bypass digital perimeters to test the ‘trust’ of your internal network logic. While perimeter controls receive a lot of attention, the internal network often becomes a “rat’s nest” of legacy permissions. Over years of use, AD permissions can become layered with inherited rights, creating unintended privilege paths.

In one hospital, we found that the “Everyone” group had been granted “Generic All” permissions across the entire domain. Because every user was in that group, it effectively meant every account in the building was a Domain Admin. This was a huge risk that had been there for 10 years because it doesn’t show up in a vulnerability scanner.

To identify these privilege escalation paths, we perform a structured analysis of AD permissions:

  • Chained Permission Analysis: We evaluate AdminCount attributes, delegated rights, and inherited permissions to determine whether low-privilege accounts can modify, reset, or control privileged identities.
  • Graph-Based Path Mapping: Using AD Recon, we model the shortest privilege escalation paths available to an attacker, including indirect or inherited access routes.
  • Disabled Account Exposure: We assess whether inactive or disabled service accounts retain privileged rights and whether standard users have the ability to re-enable or manipulate those accounts.

Validating Security Without Disrupting Clinical Operations

In a medical environment, you can’t just start hacking. It requires a methodical approach, because launching a tool at it could have a negative impact. In healthcare, speed is not the objective. Safety and fidelity are.

We often start by asking a simple question: “If someone performed a DCSync attack inside your network right now, would you detect it?”

In over a decade of testing hospital environments, we’ve only seen one hospital detect this internal attack behavior in real time. Most organizations are so focused on outbound malware beacons that they miss the “loud” behavior of a targeted attacker on the inside. We work together to figure out how you will alert on that, tuning your tools to get high-confidence triggers.

The diagram below shows how we suggest conducting penetration tests. We’re leveraging infrastructure the same way a remote attacker would. This is important because it allows you to fully flesh out your defenses. An attacker’s going to leverage malware and, once they establish internal access, use command-and-control (C2) to communicate with a management server that controls the endpoint.

That’s why we suggest a hybrid approach for hospitals to include penetration testing and purple team integration. In the last few days of the test, we’ll go through and emulate stealthy attacker techniques and map them back to the MITRE ATT&CK framework with timestamps. We then work alongside your team to identify exactly which activities were detected and which went unnoticed.

Four Things You Can Do Today

To reduce exposure before a full engagement, we recommend starting with these areas.

Establish a Verified External Asset Inventory

One of the bigger risks, generally speaking, is that when we conduct a hospital pentest, they don’t know what they have on the internet. We’ve seen printers, medical IoT devices, and a medical app used for messaging doctors and nurses online, just to name a few. Because you’re getting attacked and scanned 24-7, 365 days a year, it’s critical to understand your footprint. That’s the first challenge.

Perform a Structured AD Review

If your Active Directory has never undergone a privilege path analysis, there’s likely accumulated risk embedded in delegated rights and inherited permissions. Conduct a review of “delegated administrative rights” and “privilege escalation chains”. The goal is to determine if a “low-privilege user can directly or indirectly modify, reset, or control higher-privilege accounts”.

Test Identity Recovery and Account Management Processes

Walk through your processes objectively to test whether your help desk relies on a “name and confidence” approach to bypass technical controls. If identity recovery depends heavily on “discretion or urgency,” it deserves a redesign.

Audit Public-Area Network Ports

Hospitals are open environments. That’s the reality. Walk through your waiting rooms, conference areas, and even construction zones. Are there switch ports accessible, and are they locked down? Without locking down those ports in public areas, an attacker can plug into the wall, circumvent all the external controls, and land on the internal network. It doesn’t require a sophisticated exploit. Just access.

The Bottom Line

A well-executed penetration test isn’t a surprise inspection. It is a controlled validation of how your environment performs under realistic adversarial conditions.

Vulnerability management identifies known weaknesses. Adversary simulation evaluates how identity, logic, and process can be chained together to create access.

Protecting patient data and life-supporting systems requires more than patch discipline. It requires testing how your environment behaves when someone is actively trying to misuse it.

If you’d like to see a technical walkthrough of these scenarios, watch our full session with Health-ISAC here.

If you want a clear view of what your organization exposes externally without disruption, contact us for a complimentary external attack surface snapshot based solely on passive reconnaissance.

Frequently Asked Questions

What is the most common way attackers gain access to hospital systems?

In our testing, attackers most frequently exploit identity recovery processes rather than technical vulnerabilities. Help desk procedures that rely on human discretion, such as resetting MFA based on a phone call, create high-risk entry points that don’t require any technical exploit to abuse.

What is a DCSync attack and why does it matter for hospitals?

A DCSync attack allows an attacker with sufficient Active Directory privileges to extract password hashes for any account in the domain, including Domain Admins. In over a decade of testing hospital environments, we have seen only one hospital detect this behavior in real time. Most organizations miss it entirely.

What is privilege escalation in Active Directory?

Privilege escalation in Active Directory occurs when a low-privilege account can directly or indirectly modify, reset, or control higher-privilege accounts through inherited permissions, delegated rights, or misconfigured group memberships. These paths often go undetected for years because they don’t show up in vulnerability scanners.

How do attackers exploit physical security in hospitals?

Hospitals are open to the public by design, creating layers of trust that attackers exploit. Common entry points include construction zones, service hallways, and temporary work sites that bypass standard checkpoints. In one assessment, our team accessed a restricted area through a construction floor and was buzzed through a final checkpoint without verification.

What should hospitals do first to reduce their security exposure?

Start with four areas: establish a verified external asset inventory so you know what is exposed on the internet, perform a structured Active Directory privilege path analysis, test your identity recovery and help desk processes against social engineering scenarios, and audit network ports in public-facing areas like waiting rooms and conference spaces.