H-ISAC's Weiss Says Healthcare Cybersecurity Always Comes Back to People

In healthcare cybersecurity, the hardest problem isn't knowing what to do — it's having the people to do it. Errol Weiss, Chief Security Officer at Health-ISAC, joins Anthony Guerra to explain why staffing and resources, not tools or frameworks, keep coming up as the real constraint for CISOs, especially at small and rural hospitals. The conversation covers threat intelligence and the KEV catalog, network segmentation and legacy medical device risk, defense-in-depth and user friction in clinical settings, making the budget case with frameworks like HICP and the HPH Cybersecurity Performance Goals (CPG), phishing-resistant multi-factor authentication, third-party risk management beyond static questionnaires, EHR market consolidation and concentration risk, and governing agentic AI as non-human identity. Guest: Errol Weiss, Chief Security Officer, Health-ISAC Chapters: 00:00 Introducing Errol Weiss and Health-ISAC 02:00 Choosing where to focus: threat intelligence and the haves vs. have-nots 06:30 Tidying up the house: network segmentation and legacy device risk 14:00 Making the budget case with HICP and the CPGs 23:00 Where the rub is: people and the rural staffing gap 28:30 Third-party risk, EHR consolidation, and concentration risk 35:30 Governing agentic AI as non-human identity Key Themes and Takeaways: It Comes Back to People Weiss returns repeatedly to staffing as the binding constraint — you can't operate the tools or act on the intelligence without the right team (Weiss, 23:15, 30:30). Threat Intelligence Only Works If You Can Act On It The KEV catalog and threat feeds are strategic and tactical, but Weiss notes the value is lost without people to ingest and respond to them (Weiss, 06:30). Segmentation Limits the Blast Radius Weiss frames network segmentation as a way to turn an enterprise-wide incident into something bounded and recoverable, even against advanced adversaries (Weiss, 08:30). Make the Budget Case With Frameworks Weiss points CISOs to HICP and the HPH Cybersecurity Performance Goals to prioritize minimum controls first and justify spend (Weiss, 14:00). Treat AI Agents Like Employees Weiss argues any non-human identity that can act needs the full identity lifecycle — provisioned, monitored, and retired under least privilege (Weiss, 36:14). “We've Never Had an Incident” Is a Red Flag Weiss's biggest warning sign is a team that claims a clean record but lacks the monitoring to detect a breach in the first place (Weiss, 40:12). Final advice: Weiss urges leaders to prioritize the essentials — multi-factor authentication, tested backups, and staying ahead on patches — before anything else (Weiss, 15:30).