“Our IT company takes care of that.”
If that is your answer when someone asks who protects your practice from cyberattacks, take a closer look. Keeping technology running and defending it require different expertise. Security also requires independent review of the systems your IT company configures and maintains.
One missed patch, misconfigured firewall, or compromised account can lead to stolen patient records, canceled appointments, and recovery costs that threaten your practice’s survival. One mistake can put years of work at risk.
Black Talon’s recommendation is straightforward: keep your IT provider focused on technology operations and put a separate cybersecurity firm in charge of security oversight. The two should work together, with specialists independently checking configurations and verifying that weaknesses are corrected. Having the same company build the environment, maintain it and judge its own security leaves the practice without an independent check. A second set of qualified eyes can catch the mistake everyone else assumes was handled.
In nearly 95% of the dental practice incidents our team at Black Talon Security has investigated, we identified a critical IT configuration or maintenance mistake that contributed to the compromise. That experience suggests that independent oversight is essential.
Consider your firewall. It can appear to work normally while containing a flaw an attacker can exploit. Verizon’s 2026 Data Breach Investigations Report attributed 31% of breaches to vulnerability exploitation. AI is helping attackers exploit weaknesses faster, leaving less time to fix them.
Now consider an email from a referring dentist. The address is correct and the message looks reasonable because a criminal has compromised the sender’s account. A link leads to a supposed document viewer. Your employee clicks the link, giving the attacker control of their computer through legitimate screen-sharing software.Your anti-virus software probably won’t detect this attack.
Depending on permissions and protections, that access may extend to other systems or a cloud practice management account already open in the browser. Cloud storage still depends on secure computers and accounts.
A stolen mailbox can expose patient communications, enable payment fraud, and allow criminals to impersonate your practice. Depending on the damage, an email takeover can be more costly than ransomware. Restoring a backup cannot retrieve information already stolen.
Tools such as SentinelOne and CrowdStrike need proper configuration, continuous monitoring and professionals authorized to respond. Sophos’ 2026 research found that 88% of ransomware deployments in its investigated cases occurred outside business hours. Serious alerts need attention within minutes, including nights and weekends.
Here are six recommended safeguards; ask your IT and cybersecurity providers for recent reports and evidence of consistent work over the past 12 months:
1. Firewall checks. Daily checks for exposed ports, vulnerability scans at least monthly, configuration reviews and prompt action on newly disclosed critical flaws.
2. Internal vulnerability checks. Authenticated vulnerability assessments of every workstation and server every four hours, with reports identifying Known Exploited Vulnerabilities (KEVs) and unresolved high-risk issues.
3. Human-led penetration testing twice a year. Request written findings and verification that significant weaknesses were corrected.
4. Around-the-clock threat response. AI-based endpoint protection backed by 24/7 managed detection and response. Ask who investigates serious alerts, how quickly, and what actions they take. Is this managed internally or outsourced?
5. Verified patching. Daily checks for missing security updates, prompt installation based on risk, and reports showing successful updates, failures and remaining vulnerabilities. Ask for patching reports.
6. Email and account protection. AI-based email security, phishing-resistant multifactor authentication, and monitoring for suspicious account activity.
Keep your IT provider accountable to a separate cybersecurity team. Ask who independently checks the work and who will respond at 11 p.m. on a Saturday. One overlooked mistake can put the practice you built at risk.
