Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Invisible Success of #healthcare #cybersecurity

8 Dec 2025 · 1 min

Watch on YouTube

1:23

In this segment, Matthew Rosenquist explains the paradox of "invisible success" in cybersecurity—effective defenses go unnoticed while breaches are highly visible, creating a blame culture. To better communicate value to executives and boards, he advocates reframing traditional ROI into a risk‑reduction ROI (RROI) and more recently into "resilience on investment" (ROI), emphasizing how security investments protect continuity of care in healthcare. By focusing on risk avoidance and system resilience, leaders can appreciate security as a driver of uninterrupted patient services rather than a hidden cost.

Chapters

And unfortunately in cybersecurity, historically and even today, we live under this invisible success metrics. So when we're successful, everything looks great. You don't see anything. Everything's perfect. You know, when you're successful, it's invisible. And when you're not, it's highly visible because it means like, oh my gosh, how did this happen? What's going on? Why didn't you tell me? Where's it going? There's an instant blame game because none of the success was up in front of people's faces all the time. So you end up with, like I said, this invisible success metric. So the key there is when you're talking to executive leaders, when I'm speaking with the board, when I'm speaking with our executive leadership team, I always want to talk about a different ROI. So sometimes I refer to it as RROI. So instead of return on investment, it's risk reduction on investment. Historically, that's how it's an ROI. When I do this, this is going to reduce these risk factors, and here's our chance of happening. And if this happened, this would be the impact. So this is risk avoidance. But recently I switched that up just a little bit back to just ROI— resilience on investment— because I think that is the criteria we need to start looking at now. Resilience in healthcare is about the continuity of care.