Clinical Continuity, AI, and the Endpoint Recovery Gap: A Q&A with Jason Mafera

Ahead of IGEL Now & Next® 2027, we’ve brought together recent insights from Jason Mafera, Field CTO, Healthcare at IGEL, on how AI is accelerating cyber risk, why endpoint recovery remains a gap, and what healthcare CIOs and CISOs should consider to maintain continuity of care during a disruption.

Healthcare organizations have made significant investments in cyber resilience, disaster recovery, and business continuity planning. Yet one question often gets overlooked: if clinicians can’t access systems through their endpoints, how resilient is the environment?

Q: How Is AI Changing the Speed and Scale of Cyber Risk in Healthcare?

Mafera: I think things are getting progressively worse now with the introduction of AI. AI can code and build malware effectively. Today, the time from vulnerability discovery to vulnerability exploitation can be weeks or months. That cycle is going to keep getting shorter. I expect it will continue to accelerate until a vulnerability to exploit emerges within minutes.

If we’re trying to defend against things that are discovered now and delivered as malware five minutes from now, there’s no way we can keep up with the speed of that cycle. I think it requires a fundamental rethinking of how we deploy technology, how we secure it, and, most importantly, what we do when something goes wrong and how we recover or fail over it.

Security is a function of risk mitigation. There is no perfect security. It’s not an if it’s going to happen, but when will it happen, and what have you done to prepare to recover from it?

Q: Why Does Endpoint Recovery Remain a Gap in Healthcare Business Continuity Planning?

Mafera: What we find is that the infrastructure is generally well thought out. The applications, the data, the backup, the recovery, the failover, all of those things tend to be planned and tested. That’s where the tabletop exercises focus. That’s where disaster recovery and cyber resiliency scenarios come into play.

The endpoint piece tends to get left out.

The endpoint is the device that sits between the clinician and all the systems they access. You can make a significant investment in recovery and infrastructure, but if the device the clinician uses isn’t accessible, all that investment is somewhat irrelevant.

In healthcare, it’s more comprehensive because you’ve also got clinical care. Clinical care always leads the discussion, and then continuity of care becomes the focus. We’re talking about exam room workflows, nursing station workflows, registration workflows, physician workflows, and all the places where digital access is required to deliver care.

When we talk with healthcare organizations about this and ask what they do for endpoint resilience, they often have to stop and look. When they look at what they are planning, this piece is often missing.

Q: What Have Recent Outages Shown About Clinical Continuity?

Mafera: One of the biggest lessons is that it’s not just ransomware and malware that can cause business-level outages.

The CrowdStrike incident was a good example of that. It wasn’t malware. It wasn’t ransomware. But it still had the same impact. Devices were out of service while organizations worked through recovery.

What that highlights is that update outages need to be part of the conversation, too. We have to think about ransomware, malware, update issues, and even things like floods, fires, hurricanes, or other localized disasters. They all have a different type of driver for the impact, but the same or similar impact: people can’t access the systems they need.

In healthcare, that affects continuity of care. It affects clinical operations. It can affect elective procedures, patient access, billing, coding, and reimbursement. There are many downstream effects from these, and the impact extends beyond the initial outage because many operational processes also depend on endpoint access.

The goal is to plan for continuity from the endpoint to the application and maintain critical workflows while recovery and cleanup are underway.

Q: Why Can Endpoint Recovery Take So Long After an Incident?

Mafera: When we get to clinical organizations that have 5,000, 10,000, 15,000, or 20,000 discrete clinical endpoints, now you have to think about how much time it physically takes to replace devices, get them connected, get them configured, and get users back.

You can’t get back to where you started until you’ve gone through the process of determining what happened, how it happened, and whether you’ve fixed the vector of compromise. Immediate reinfection is the thing you worry about.

There’s a whole process behind that. Analysis, forensic review, and clean certification all take time. It varies by organization, but we’re talking weeks.

At the end of the day, the infrastructure may be available, but people still need a way to access it while that remediation work is occurring.

Q: What Does a More Resilient Endpoint Strategy Look Like?

Mafera: I think it really comes down to a fundamental change in the way we think about security and the security model of endpoint devices.

For the last twenty years, we’ve taken an approach that’s largely been “build the moat and defend the castle.” We know that’s no longer viable. Borders are porous regardless of how well you try to constrain them. Users are more mobile than ever, and they want to consume data across a variety of devices.

Anything that can be made as immutable as possible, anything that reduces the attack surface, and anything that’s recoverable becomes critically important. What it really comes down to is what we do when something goes wrong and how we recover or fail over that technology to mitigate the risk associated with these challenges.

We still see breaches, exposures, and device inaccessibility that shut down health systems. What we’re looking for is a way to help maintain continuity of care even when those events occur.

Q: Where Should Healthcare CIOs and CISOs Start Today?

Mafera: It starts with looking at what you have in place today, what tools you’ve brought to bear, and where you believe you can go moving forward.

Anything that validates its runtime, anything that can be made as immutable as possible, and anything that reduces the attack surface becomes critically important.

Cybersecurity strategies should account for how organizations reduce exposure, contain the impact of compromise, restore affected systems, and maintain access to essential clinical workflows throughout the recovery process. That preparation needs to happen before an incident occurs.

One question exposes the gap pretty quickly:

If every clinical endpoint went down this morning, how long would it take clinicians to chart again?

Closing Thoughts

Healthcare organizations have spent years strengthening infrastructure resilience, disaster recovery, and cybersecurity programs. But as AI accelerates the pace of cyber risk, resilience increasingly comes down to a simpler question: can clinicians still access the systems they need to deliver care?

Healthcare cybersecurity is ultimately a patient care issue as much as it is a technology issue. When access to essential systems is disrupted, the consequences can extend directly into care delivery. Organizations also need a plan for how clinicians will continue working when endpoints are disrupted, compromised, or unavailable.

Continue the Conversation at IGEL Now & Next 2027

Healthcare cybersecurity, endpoint resilience, and continuity of care will be among the key topics industry leaders explore at IGEL Now & Next 2027 in Fort Lauderdale, Florida.

Join healthcare CIOs, CISOs, clinical IT leaders, architects, and security professionals as they examine how organizations can adapt to a rapidly evolving threat landscape while keeping clinicians connected to the systems they depend on.

Learn more and register today.