The SQA2 Blog: General, Healthcare
Health tech companies no longer get to decide whether to patch. The volume of disclosed vulnerabilities is rising, attackers move quickly, and the cost of falling behind lands on patients and on the business.
Start with volume. One count of CVEs published in 2025 reached 48,185, up 20.6% from 39,962 in 2024. The Forum of Incident Response and Security Teams (FIRST) counted 49,972 observed CVEs by the end of 2025, and its forecasting team expects a median of around 59,000 in 2026, with 70,000 to 100,000 entirely possible. The two 2025 totals differ because the counting methods differ, and both point the same direction.
Attackers are not waiting for the calendar. VulnCheck reports that 28.96% of the known exploited vulnerabilities it identified in 2025 were exploited on or before the day their CVE was published, up from 23.6% a year earlier. Verizon’s 2026 Data Breach Investigations Report puts vulnerability exploitation at 31% of initial access, up from 20% and now ahead of stolen credentials. Secondary coverage of the same report says median patch time grew from 32 days to 43 days, and that the share of CISA Known Exploited Vulnerabilities fully remediated fell from 38% to 26%. Verizon also reports that 48% of breaches now involve ransomware.
Health tech sits close to the center of this pressure. The HIPAA Journal reports that 2025 set a new record for large healthcare data breaches, affecting around 138.5 million individuals, and that hacking and other IT incidents accounted for more than 80% of large healthcare data breaches. A company that delays a critical patch leaves the door open to exploits and ransomware, and in healthcare the consequences reach clinical operations and patient care.
Patching at this volume creates its own risk. Every fix is a change to working software, and a change made in a hurry can break something that mattered yesterday. That is the job of QA. SQA² is a QA-only company. We do not find vulnerabilities or write patches. We verify that fixes work, that nothing else broke, and that the evidence exists.
The next five parts cover why every patch is also a change, how to build a patch pipeline with QA in every stage, how regulated environments change the work, how to test the seams where third-party code meets your own, and practical ways SQA² can help.
This is a part of our overall Health Tech Patch Smart series.
Sources: Jerry Gamblin, 2025 CVE Data Review; Computer Weekly on the FIRST 2026 forecast (February 11, 2026); VulnCheck, 2026 State of Exploitation; Verizon 2026 DBIR; Security Boulevard on the 2026 DBIR; The HIPAA Journal, healthcare data breach statistics
