Illustrative sample report. Fictitious company. Every name, number, and finding is invented to show what a Castile Security assessment produces. It is not a real client report.
Summit Medical Group
2847 Peakview Drive, Suite 400 · Denver, CO 80202 · Dr. Rachel Torres, Chief Executive Physician
3D DeepDive™ Security Assessment Assessment Period: March 10 – March 24, 2026
Score Date: March 28, 2026
Prepared by Castile Security · SAMPLE REPORT, FICTITIOUS DATA
25
OUT OF 100
Critical
Confidence: 85%
25 · Critical
Healthcare SMB Industry Avg~44
Cyber Insurance Threshold70
90-Day Target67 (Developing)
Priority Findings
Critical · KEV Penalty
Network perimeter device running 3 CISA Known Exploited Vulnerabilities
Three federally confirmed exploited flaws on the network gateway drive the Critical designation. These vulnerabilities are actively scanned for worldwide, no targeted attack required.
→ Fix: Firmware update · Half-day · Removes Critical immediately
High · Patient Data Exposure
$8.2M in patient records unencrypted across 14 endpoints
PHI, SSNs, insurance records, and billing data are stored in plain text on workstations. A single ransomware event would expose every patient in the practice.
→ Fix: BitLocker deployment + data governance policy · 2–3 sessions
High · Credential Exposure
24 dark web breach records, billing team accounts critically exposed
billing@summitmedgroup.com has 6 breach records including a healthcare-specific credential list from 2024. Automated attacks against your billing system are ongoing.
→ Fix: Force password resets + confirm MFA on all accounts · 1 hr
High · Email Authentication Gap
No DKIM or DMARC, practice domain can be spoofed to patients
A criminal can send email appearing to come from your physicians to patients today. In healthcare, this is used for insurance fraud, fake bill collection, and prescription scams.
→ Fix: Configure DKIM + DMARC · 2–3 hrs · +5 credit
Financial Exposure Range
$350K–$900K
Layer 1: Ransomware ($180K–$650K)
Layer 2: HIPAA breach + notification ($50K–$250K)
Layer 3: PHI liability (up to $8.2M)
90-Day Score Path
25 → 67 (Developing)
11 actions · ~4 weeks effort total
ROSI Multiple
~45×
Every $1 invested in remediation protects ~$45 in modeled exposure at current risk levels
Security Layer
Castile Security
(915) 995-2495
castilesecurity.com
Ready to execute the 90-day plan.
Castile Security
⚠ SAMPLE REPORT: ALL COMPANY DATA AND FIGURES ARE FICTITIOUS
3D DeepDive™ Security Assessment · March 10 – March 24, 2026
Your SecurityReview & Roadmap
A complete picture of where Summit Medical Group stands today, and a clear, actionable path forward. Written for practice leadership, not IT professionals. No technical background required.
Prepared for
Summit Medical Group
Dr. Rachel Torres, CEO Denver, CO 80202 58 Employees summitmedgroup.com
0
out of 100
CRITICAL
3D DeepDive™ v1.5  ·  85% Confidence
Patient Data at Risk
Unencrypted PHI across endpoints
$8.2M
Dark Web Breaches
8 staff accounts exposed
24
Phishing Attacks Identified
14-day assessment window
112
Devices Needing Upgrade
Windows 10 end-of-life
5
Client Summit Medical Group · Denver, CO
Period March 10 – March 24, 2026
Score 25 / 100 Critical
Version 3D DeepDive™ v1.5
Castile Security
01 · At a Glance
Three things you need to know.
Everything that matters about Summit Medical Group's security posture, in plain English.
I
What's working right now
  • Advanced endpoint protection is running on 91% of managed devices. During the assessment, it automatically blocked 11 threats, including 3 attempted credential-harvesting scripts, with no staff action required.
  • A 14-day email security assessment identified 112 phishing attempts and 1,847 spam messages targeting your team, proving the practice is actively targeted and giving us the data to act.
  • Your team scored 89.4% on phishing simulations, above average for a practice of this size. Six clicks across 7 campaigns is a manageable coaching opportunity, not a systemic failure.
  • We mapped your complete patient data landscape: $8.2 million in sensitive records across your systems. You now know exactly what needs protecting and where it lives.
II
What needs immediate attention
  • Your network gateway is running three CISA Known Exploited Vulnerabilities, the single reason for the Critical score. This is a firmware update, not a replacement project.
  • 14 employee workstations store patient records in plain text with no encryption. A laptop theft or ransomware event exposes every patient file on that machine immediately.
  • The billing team has 24 dark web breach records across 8 accounts. Automated attacks against your billing and scheduling systems are running right now.
  • Your practice domain has no anti-spoofing controls. A criminal can send email appearing to come from your physicians to patients today, no technical skill required.
III
Three actions this week
  • Today: Force password resets and verify MFA on the 8 breached accounts, especially billing@ and scheduling@. This takes under an hour and closes an active attack vector.
  • This week: Schedule the gateway firmware update with your IT team. This single action removes the Critical designation and moves the score out of the bottom band immediately.
  • This month: Enable BitLocker on the 14 unencrypted workstations and configure DKIM and DMARC on your email domain. Both protect patients and reduce practice liability.
👑 Patient Data Risk Assessment · Data Discovery Scan · March 24, 2026
We mapped every patient record
across every device.$8.2 million exposed.
This assessment scanned 312 GB across 63 devices, analyzing 891,240 files. The result is a complete map of Summit Medical Group's most sensitive digital assets, patient charts, insurance records, billing data, SSNs, and clinical notes. The primary server holds 94% of the liability. These files are what a ransomware operator targets first and what a breach notification letter is written about. Now you know exactly where they are.
Primary Server
$7.7M
94% of total exposure
86,400 patient files
Your primary crown jewel
Total Exposure
$8.2M
Across all 63 devices
94,180 sensitive files
712,440 patient records
Data Categories
17
PHI, SSNs, insurance IDs
Billing, Rx, lab results
Credit card data on file
02 · Threat Actor Landscape
Three groups are targeting practices like yours right now.
Healthcare is the most targeted sector in the United States for ransomware and the number-one source of dark web credential data. Your practice holds patient information that criminals can sell, leverage for extortion, and exploit for insurance fraud. Here are the specific groups most likely to act against a 58-person medical practice with your current risk profile.
⚠ Ransomware Operators
Healthcare-Focused Ransomware Operators
Ransomware groups that specialize in healthcare target it because patient data creates exceptional double-extortion leverage. Paying the ransom does not guarantee data deletion, published patient records violate HIPAA and trigger mandatory breach notification. Operators calibrate the demand to what a practice can pay quickly, knowing that operational shutdown costs more per day than the ransom. A single account without MFA has been the entry point in some of the largest healthcare breaches on record, the same gap that exists in your environment today.
Initial AccessVPN exploits, compromised credentials, phishing
Dwell Time~14 days before encryption (Mandiant 2025)
Demand (SMB)$150K–$400K for a 58-person practice
CO 202534 healthcare ransomware victims (IC3 2025)
Your exposure: Three CISA KEVs on the perimeter gateway + flat network + 24 dark web credentials are exactly the entry conditions healthcare ransomware operators scan for. The gateway firmware update eliminates their preferred initial access vector.
💳 Financial Crime
Medical Billing Fraud & BEC Operators
Medical practices are a primary target for billing fraud because provider credentials and patient insurance IDs enable fraudulent claims that take months to detect. BEC operators compromise practice email accounts and impersonate physicians to redirect insurance reimbursements, request wire transfers from administrators, and conduct fake collection scams targeting patients. Colorado saw $14.2M in BEC losses in 2025. With no DMARC on your domain, criminals can impersonate Dr. Torres or your billing team with zero technical barriers.
MethodEmail spoofing, account takeover, invoice fraud
Avg BEC Loss~$71K per incident (Colorado IC3 2025)
CO 2025$14.2M lost · 198 BEC victims reported
Healthcare RiskBilling fraud, patient scams, insurance redirect
Your exposure: No DKIM. No DMARC. @summitmedgroup.com can be spoofed today to patients, insurance payers, and your own staff. The billing team accounts with 6+ breach records are the highest-value targets.
🎯 PHI Brokers
Healthcare Data Theft & Credential Stuffing
Patient health records sell for $250–$1,000 each on criminal forums, ten times the value of a stolen credit card. Automated toolkits continuously test leaked credentials from your 24 breach records against EHR systems, prescription portals, and insurance systems. A successful login to your EHR is the end-point of a credential stuffing chain that started years ago with a data breach at a third-party service your staff used. The billing@ account appeared in a healthcare-specific credential dataset in 2024, it is being tested right now.
PHI Value$250–$1,000 per record on dark web
MethodAutomated credential testing, EHR login attempts
CO Phishing1,847 victims in 2025, highest count (IC3)
After AccessPHI export, insurance fraud, Rx diversion
Your exposure: 24 breach records across 8 accounts. The billing@ account is in an active healthcare credential dataset. One successful login to your billing system or EHR exposes every patient record the account can access.
Why practices your size are preferred targets
  • Large health systems have enterprise security teams. A 58-person practice holds the same PHI with a fraction of the defenses, optimal risk-to-reward for ransomware operators.
  • Medical practices cannot operate during a systems outage. Every hour of downtime means canceled appointments and lost revenue, creating intense pressure to pay ransoms quickly and quietly.
  • Healthcare organizations face mandatory breach notification under HIPAA. The regulatory and reputational stakes of a public breach create additional leverage for extortion beyond the ransom itself.
  • Colorado's growing healthcare market and strong insurance reimbursement environment make Denver-area practices a high-value target for billing fraud specifically.
How the 90-day plan addresses each threat
  • Patching the gateway removes the ransomware operators' preferred initial access vector, the CISA KEVs they specifically scan for, in a single half-day maintenance window.
  • Configuring DMARC at p=quarantine closes the email spoofing door that BEC operators and patient scammers use to impersonate the practice today.
  • Forcing password resets and confirming MFA on all 8 breached accounts neutralizes the active credential stuffing campaigns targeting your billing and scheduling systems within hours.
  • Enabling BitLocker on the 14 unencrypted workstations ensures that even if a device is stolen or compromised, patient records cannot be read without the encryption key.
Sources: Mandiant M-Trends 2025 · Sophos State of Ransomware 2025 (U.S. Healthcare) · FBI IC3 Colorado 2025 Annual Report · Verizon DBIR 2025 (Healthcare) · IBM Cost of a Data Breach 2024 (Healthcare: $9.77M avg) · HHS OCR Breach Portal 2025
03 · Your Security Score
25 out of 100, Critical
Raw base score: 55.0, reduced to 25 by three CISA Known Exploited Vulnerability penalties totaling 30 points. Patch the gateway, and the score rises immediately to the At Risk band.
029496984100
CriticalAt RiskDevelopingStrongExcellent
25 · Critical
Your Score: 25
Industry Avg: 44
Insurance Threshold: 70
Device
62
User
58
Governance
45
Data
55
Backup
48
KEV Penalty Applied: 3 CISA Known Exploited Vulnerabilities confirmed on perimeter device. Penalty: −30 points (3 × −15, capped at maximum). Base score 55.0 − 30 = 25. See Appendix A.
Assessment Confidence
85%
Deductions: −10 EDR coverage at 91% (not 95%+ threshold) · −5 external scan age 32 days (just over 30-day window). Core feeds present: endpoint protection, email security trial, data discovery scan, identity and dark web monitoring, phishing simulation.
Current assessment score as of March 2026. Toggle to "After 90-Day Plan" to see the projected score impact of each remediation action.

Policy floor note: Active EDR and active firewall are confirmed. BDR status is unverified (no documented restore test). Policy floor of 30 does not apply, BDR verification is required for floor eligibility. Raw score stands at 25.
Score Components
Base Score 55.0
KEV Penalty (3 × −15, max −30) −30.0
Credits Earned 0
Final Score 25
05 · Risk Heat Map
Every confirmed risk, plotted by likelihood and business impact.
Hover any item for details. Upper-right quadrant items require immediate action.
← Business Impact →
← Likelihood →
Almost
Certain
Cred Stuffing
Email
Spoofing
Phishing
Inbox
Likely
Mailbox
Rule
EHR
Login
KEV
Exploit
Ransomware
Event
Possible
Accidental
PHI Send
Laptop
Theft PHI
Win 10
EoL
Unlikely
Backup
Failure
Rare
Negligible
Minor
Moderate
Significant
Catastrophic
Critical (immediate)
High (this quarter)
Medium (this period)
Low (monitor)
Top 5 by Combined Score
CRITICAL
KEV Exploit → Ransomware
Gateway + flat network
CRITICAL
Email Spoofing / BEC
No DKIM + no DMARC
CRITICAL
Credential Stuffing Active
24 records, healthcare dataset
HIGH
Unencrypted PHI (14 devices)
$8.2M, no BitLocker
HIGH
No HIPAA Risk Assessment
3+ years overdue, OCR exposure
06 · Your Window to Respond
A healthcare breach moves faster than most practices can react.
This is what a breach at Summit Medical Group looks like, based on observed attack patterns for mid-size healthcare organizations from Mandiant M-Trends 2025 and the specific vulnerabilities found in this assessment. Click any stage for details.
Hour 0
Hours 2–8
Days 1–4
Days 4–10
Days 10–14
Day 14+
🔍
Gateway KEV Automated Exploit

An automated scanner finds Summit's network gateway via Shodan or Censys and identifies the three known CVEs. The exploit is public and takes under a minute to execute. No human attacker is present at this stage, this is fully automated. The attacker now has a session inside the network perimeter.

Hour 0, Automated, no human needed
🗺
Network Recon, Flat Network Exposed

On Summit's flat, unsegmented network, every device is visible from the initial foothold: the primary server, all 58 workstations, medical devices, billing terminals, and the EHR system. The breakout time, time to reach a second device, is approximately 2 hours. With segmentation, this would take days, giving the team time to detect the intrusion.

Hours 2–8, ~2hr breakout time
👤
Credential Harvest + EHR Access

Cached credentials are extracted from the server. Cross-referenced with the 24 dark web breach records, the attacker tests known passwords against the EHR login. Password reuse from the billing@ account, in an active healthcare credential dataset since 2024, yields a successful EHR login. The attacker now has access to patient records for every patient the billing account can reach.

Days 1–4, EHR and billing systems compromised
📤
PHI Exfiltration for Double Extortion

Before encrypting, ransomware operators typically exfiltrate patient records for leverage. The 86,400 patient files on the primary server, PHI, insurance IDs, SSNs, clinical notes, are copied to attacker infrastructure. This data becomes the second lever: pay the ransom, or patient records are published. Under HIPAA, publication triggers mandatory breach notification to every affected patient regardless of payment.

Days 4–10, 86,400 patient files leave the building
🔒
Ransomware Encryption

Encryption is deployed across the flat network. Server, workstations, and any reachable backup targets are locked simultaneously. Clinical operations halt: no access to patient charts, scheduling, billing, or prescriptions. With 14 unencrypted workstations, every patient file on those devices is immediately readable by the attacker, no decryption key required on their end.

Days 10–14, Full clinical shutdown
⚖
Ransom Demand, HIPAA Notification, Recovery

The ransom note references the exfiltrated patient data. HIPAA requires notification to affected patients within 60 days, and to HHS and media if more than 500 patients in a state are affected. Recovery without paying takes 3–6 weeks for a practice this size. Legal, notification, and PR costs frequently exceed the ransom. Average total cost for a mid-size healthcare breach: $2.1M (IBM 2024).

Day 14+, 3–6 weeks to restore clinical operations
~2 hrs
Breakout Time
Why flat networks are so dangerous
Once inside your perimeter, an attacker on Summit's flat network can reach the EHR system, billing server, and every clinical workstation in approximately 2 hours, the same time it takes most practices to notice something is wrong. VLAN segmentation isolates your medical devices and servers into separate zones, extending the breakout time to days and giving your team a realistic window to detect and respond before the damage spreads.
~2 hrs
Est. Breakout Time
Flat network + KEV entry
14
Median Dwell Days
Mandiant M-Trends 2025
$71K
Avg BEC Loss, CO
FBI IC3 Colorado 2025
3–6 wks
Healthcare Recovery
Sophos Ransomware 2025
07 · The Real Cost of Inaction
Three financial scenarios, ranked by likelihood for a healthcare practice.
Healthcare consistently ranks as the most expensive sector for data breaches, $9.77M average in 2024 (IBM). Here is what Summit Medical Group's specific risk profile looks like across three distinct scenarios.
Layer 1 · Highest Likelihood
Ransomware: Clinical Shutdown
$180K–$650K
▼ expand for detail

Three CISA KEVs on the gateway, combined with 24 dark web credentials and a flat network, create conditions that ransomware operators who specialize in healthcare specifically target. A ransomware event halts clinical operations, locks every patient record, and triggers mandatory HIPAA breach notification. Cyber insurance may deny the claim entirely if known unpatched vulnerabilities contributed to the breach.

·Ransom demand for 58-person practice: $150K–$400K (Sophos 2025)
·IT recovery, forensics, incident response: $20K–$80K
·Lost revenue during 3–6 week clinical shutdown: $30K–$120K
·HIPAA breach notification, legal, and PR: $15K–$50K
·Insurance denial risk: known KEVs may void coverage for this event
Layer 2 · High Likelihood
HIPAA Breach + OCR Investigation
$50K–$250K+
▼ expand for detail

A breach of more than 500 patient records triggers mandatory HHS OCR notification and often an active investigation. Missing HIPAA risk assessment for 3+ years, unencrypted PHI on 14 devices, and absent email security controls are independent liabilities that exist today. No breach is required to trigger OCR scrutiny.

·OCR settlement for willful neglect: $10K–$50K per violation
·Corrective Action Plan + compliance monitoring: $40K–$100K
·Patient notification for 500+ breach required within 60 days
·Media notification required if 500+ Colorado patients affected
·Missing risk assessment is OCR's first audit question, independent of breach
Layer 3 · Tail Risk
Full PHI Breach: Patient Record Exposure
$2M–$8.2M
▼ expand for detail

The data discovery scan mapped $8.2M in sensitive patient data across Summit's systems. A full breach exposing 86,400 patient files triggers per-record costs, Colorado state privacy requirements, and potential class action exposure. Healthcare records sell for $250–$1,000 each on criminal forums.

·Total PHI liability mapped: $8,200,000 (data discovery scan, March 24, 2026)
·Per-record breach cost: $429 average (IBM Cost of a Data Breach 2024)
·86,400 records × $429 = $37M theoretical max; modeled realistic: $2.1M–$4.8M
·Colorado CCCPA + HIPAA dual exposure for state and federal penalties
·Practice reputation and patient attrition: unquantified but long-lasting
Return on Security Investment: How We Get to 45×
The complete 90-day plan costs ~$10,550 in Year 1. It protects against $565,000 in modeled near-term exposure, a 53× raw return, reported conservatively as 45× after a 15% uncertainty discount.
~45×
ROSI
What the Remediation Plan Costs (Year 1)
Gateway firmware patch (IT time, 4 hrs)~$200
Password resets + MFA verification~$150
DKIM + DMARC configuration (3 hrs)~$300
BitLocker on 14 endpoints~$800
Windows 11 upgrades (5 devices)~$1,500
Email security solution (license + setup)~$1,200
Network segmentation / VLANs~$2,400
Backup restore test + RTO/RPO doc~$400
HIPAA risk assessment documentation~$3,000
Cloud email backup (license)~$600
Total Year 1 Investment~$10,550
What That $10,550 Protects Against
Layer 1: Ransomware (midpoint)$415,000
Layer 2: HIPAA breach (midpoint)$150,000
Near-term combined midpoint$565,000
The math: $565,000 ÷ $10,550 = 53.5× Using only Layers 1+2 (near-term, excluding the $2M–$8.2M tail risk in Layer 3), every $1 invested protects ~$54 in expected loss. The 45× figure used throughout this report applies a 15% discount for implementation uncertainty and partial risk reduction, the more conservative, defensible number.
Highest-value single action: The gateway firmware patch costs ~$200 in IT time and removes the condition that makes ransomware an Almost Certain event, by a wide margin the single highest-leverage action in this plan.
08 · Remediation Simulator
See your score improve in real time.
Check each action as your team completes it. Point values reflect the actual 3D DeepDive™ v1.5 scoring math.
25
PROJECTED
CRITICAL
Baseline: 25   Delta: +0 pts
0 / 42 points to Developing
Emergency, Remove the Critical Flag (30 Days)
✓
Update gateway firmware, remove 3 KEVs
Patches CVE-2023-44221, CVE-2024-40766, CVE-2024-53704. Removes the −30 KEV penalty entirely. Single most impactful action in the plan.
⏱ Half-day  · 🗓 Week 1
+8 pts
✓
Force password resets + confirm MFA on 8 breached accounts
Closes active credential stuffing attacks. Priority: billing@, scheduling@, and rtorres@ accounts with highest breach counts.
⏱ 1–2 hrs  · 🗓 Day 1
+4 pts
✓
Investigate and clear suspicious billing mailbox rule
Audit billing@ for unauthorized forwarding or filtering rules. Preserve evidence, then remove. Force full password reset.
⏱ 1 hr  · 🗓 Day 1
+3 pts
Foundation, Protect the Perimeter (60 Days)
✓
Configure DKIM + DMARC at p=quarantine + earn Credit #4
Closes email spoofing vector entirely. Earns the DKIM/DMARC credit. Protects patients from physician impersonation scams.
⏱ 2–3 hrs  · 🗓 Month 2
+7 pts
✓
Enable BitLocker on 14 unencrypted workstations
Encrypts all locally stored patient records at rest. Eliminates the "stolen laptop = instant PHI breach" scenario. Required for HIPAA compliance.
⏱ 2 sessions  · 🗓 Month 2
+5 pts
✓
Deploy dedicated email security solution
Turn the assessment-period threat data into permanent protection. 112 phishing attempts in 14 days warrants an always-on filter.
⏱ 1–2 sessions  · 🗓 Month 2
+3 pts
✓
Upgrade 5 Windows 10 workstations to Windows 11
EoL devices receive no security patches. Upgrade eliminates an entire class of future vulnerability with no patch path.
⏱ 1 session  · 🗓 Month 2
+2 pts
Maturity, Build Lasting Resilience (90 Days)
✓
Backup restore test + define RTO/RPO + earn Credit #3
Restore one folder, document the time, define what's acceptable. Earns the backup credit and confirms ransomware recovery is possible.
⏱ Half-day  · 🗓 Month 3
+8 pts
✓
Segment network into VLANs + earn Credit #6
Separate medical devices, billing systems, and workstations. Extends breakout time from ~2 hours to days. Earns the segmentation credit.
⏱ 1–2 sessions  · 🗓 Month 3
+7 pts
✓
Complete HIPAA risk assessment + document IR plan
Addresses the 3-year gap. Satisfies OCR's first audit question. Assign a Security Officer role. Define the first three steps if a breach occurs.
⏱ 1 day  · 🗓 Month 3
+3 pts
✓
Deploy dedicated cloud email backup
Protects email, chat, and file storage independently. OneDrive sync is not a backup, a proper solution provides version history and independent recovery.
⏱ ~1 hr  · 🗓 Month 3
+2 pts
09 · What's Protecting You
The foundation is stronger than the score suggests.
The Critical score is driven by a firmware update gap on one network device. These protections are real, active, and working for Summit Medical Group every day.
🊱
Endpoint Protection, Active Threat Defense on 91% of Devices
53 Agents Active11 Threats Blocked
▼ click for detail
EDR is running on 53 of 58 managed devices including the primary clinical server. During the assessment window it automatically blocked 11 threats: 3 credential-harvesting scripts, 2 malicious document macros, 4 suspicious PowerShell executions, and 2 drive-by downloads, with no staff action required. The 5 remaining devices need agent deployment to reach 100% coverage.

What this means: Without endpoint protection running, those 11 blocked threats would have landed undetected. EDR is the single most effective active defense in the environment today, the main reason the score is not lower.
📧
Email Threat Assessment: 112 Attacks Identified in 14 Days
112 Phishing FoundAssessment Period
▼ click for detail
A 14-day email security checkup identified 112 phishing attempts and 1,847 spam messages targeting Summit staff. This is not an active subscription, it is the assessment data that proves the case for a permanent solution. The volume (~8 phishing attempts per day) is consistent with a named healthcare target, not a random victim.

Next step: Deploy a permanent email security solution. Without one, every phishing attempt per period reaches staff inboxes.
🎯
Phishing Awareness: Above Average, One Point From Credit
89.4% Pass Rate6 Clicks / 7 Campaigns
▼ click for detail
Summit's staff completed 7 phishing simulation campaigns across all 58 employees. An 89.4% pass rate is above a national healthcare SMB benchmark of 84%. Six clicks across 7 campaigns is a coaching opportunity, not a systemic failure. One point separates Summit from the 90% threshold that earns Credit #5 (+5 pts).

Key clickers: billing@, mreyes@, jwhitfield@, s.park@, and scheduling@. Targeted coaching for these 5 employees in the next 30 days would push the rate past the credit threshold.
👑
Data Visibility: Crown Jewels Mapped, Zero-Trust Path Clear
$8.2M MappedZero-Trust Ready
▼ click for detail
The data discovery scan covered 312 GB across 63 devices, identifying 891,240 files and $8.2M in patient data liability. You cannot protect what you cannot see, and now you can see everything. 94% of the exposure lives on a single server, making a targeted protection strategy achievable without a full infrastructure rebuild.

What this enables: Server-level MFA gating, least-privilege access controls, and file activity monitoring scoped precisely to SMGSRV-CLINICAL01.
💻
Managed Endpoints: Modern Fleet, Mostly Current
53/58 Windows 11Server 2022 Supported
▼ click for detail
53 of 58 workstations run Windows 11 with current patches. The primary clinical server runs Windows Server 2022, supported through October 2031. Endpoint protection agents on all covered devices run current versions. Five Windows 10 machines need upgrading, a scheduled project, not an emergency.

Why this matters: A modern managed fleet means every remediation action can be deployed remotely through existing tooling. BitLocker, software policies, and EDR can all be pushed at scale.
🔐
Identity Monitoring: 50 of 58 Accounts Safe
50/58 Accounts SafeMFA Active
▼ click for detail
Identity monitoring shows 50 of 58 accounts rated safe with no unauthorized logins detected this period. MFA is active for the majority of the practice, which means the 8 breached accounts have a critical safety net even while credential stuffing attacks run. Exposure without MFA equals access; exposure with MFA means attackers still need the second factor.

The gap: Force password resets on the 8 flagged accounts. MFA plus a new credential means the active stuffing campaigns stop working immediately.
10 · What Needs Attention
The risks, ranked by what matters most to your practice.
Business impact is shown first. Expand any item for the technical detail your team needs to act.
CRITICAL
Network gateway running 3 CISA Known Exploited Vulnerabilities, actively scanned worldwide
This single finding is the engine of the Critical score. Every other finding is a secondary concern until this device is patched.
▼

What was found: The network perimeter device is running firmware with three active CVEs listed on CISA's Known Exploited Vulnerability catalog: CVE-2023-44221 (OS command injection, CVSS 7.2), CVE-2024-40766 (improper access control, CVSS 9.3), and CVE-2024-53704 (authentication bypass, CVSS 9.3). CISA's KEV catalog is reserved for vulnerabilities with confirmed active exploitation in the wild, not theoretical risks.

Business risk: An attacker exploiting CVE-2024-40766 gains access to the internal network without any credentials. From there, Summit's flat network puts the clinical server, EHR system, and all 58 workstations within reach in approximately 2 hours. This is the first entry point ransomware operators scan for, and it is currently open.

Remediation: Update the gateway firmware to the latest stable release addressing all three CVEs. The vendor published patches in Q3–Q4 2024 and Q1 2025. Estimated time: half a day with one scheduled maintenance window. This action alone removes the −30 point penalty and moves the score from Critical to At Risk immediately.

CRITICAL
$8.2M in patient records unencrypted on 14 workstations, no BitLocker deployed
A stolen laptop, ransomware event, or unauthorized access immediately exposes every patient file stored on that device with no technical barrier
▼

What was found: The data discovery scan identified 14 workstations storing patient records, insurance data, SSNs, and clinical notes in plain text with no disk encryption. Total sensitive data on these 14 devices exceeds $800,000 in modeled liability. The primary clinical server holds the largest concentration ($7.7M), but individual workstations carry the highest per-device risk because they are mobile and most likely to be physically lost or stolen.

HIPAA context: The HIPAA Security Rule requires technical safeguards including access controls and encryption for electronic PHI at rest. Unencrypted devices containing PHI require breach notification to patients if lost or stolen, regardless of whether the data was accessed. OCR has issued fines specifically for unencrypted device losses ranging from $150,000 to $4.3 million.

Remediation: Deploy BitLocker full-disk encryption on all 14 affected workstations. For devices running Windows 11 Pro/Enterprise, BitLocker is included and requires only policy deployment through management tooling. Estimated: 2 managed deployment sessions. Recovery keys should be escrowed to a central management system. Do not rely on individual users to retain their keys.

HIGH
24 dark web breach records across 8 accounts, billing team critically exposed
Automated credential attacks against your billing system, EHR, and insurance portals are running continuously. A working password in criminal hands is a near-certainty.
▼

What was found: Dark web monitoring identified 24 credential breach records across 8 Summit staff accounts. Breakdown by account: billing@ (6 records), rtorres@ (5), jwhitfield@ (4), mreyes@ (3), admin@ (3), scheduling@ (2), front@ (1). The most recent, billing@ in a healthcare-specific credential stuffing dataset (November 2024), is the most concerning because it targets healthcare systems specifically.

Business risk: A successful login to your billing system or EHR using a breached credential exposes every patient record that account can access, enables fraudulent insurance claims, and may not trigger any alert depending on logging configuration. The billing@ account's 6 breach records, combined with the suspicious mailbox rule finding, suggest this account may already be compromised.

Remediation: (1) Immediately force password resets on all 8 accounts. (2) Confirm MFA is active on every account, MFA blocks credential stuffing even when passwords are known. (3) Audit billing@ for any unauthorized access or activity in the last 90 days. (4) Maintain ongoing dark web monitoring to detect future exposures in real time.

HIGH
Email domain has no anti-spoofing protection, physicians can be impersonated to patients
A criminal can send email appearing to come from Dr. Torres or your billing team to patients, insurance payers, or your own staff today, requesting payment, sensitive documents, or prescription changes
▼

What was found: No DKIM records configured. No DMARC records found. SPF is passing. Without DKIM and DMARC at enforcement policy, the @summitmedgroup.com domain has no technical controls against email spoofing. Anyone can send email that appears to come from any address at your domain, physicians, billing staff, or administrators.

Healthcare-specific risk: Medical practices are a primary target for patient-facing BEC scams: fake bill collection emails, fraudulent prescription requests, insurance verification scams, and physician impersonation for wire transfers. Colorado BEC losses totaled $14.2M in 2025 (198 victims). A single successful patient scam involving your practice's domain creates legal and reputational exposure beyond the financial loss.

Remediation: Configure DKIM signing keys in your DNS. Add a DMARC record at p=quarantine: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@summitmedgroup.com. This is typically completed in 2–3 hours and earns Credit #4 (+5 pts toward the 3D DeepDive score). Escalate to p=reject after 30 days of monitoring.

HIGH
No HIPAA risk assessment completed in 3+ years
The HIPAA Security Rule requires a documented risk assessment at regular intervals. Absence of one is OCR's first audit question and an independent compliance liability regardless of whether a breach has occurred
▼

What was found: No documentation of a formal HIPAA risk assessment was provided or identified during the intake process. The last confirmed assessment dates to more than 3 years ago, predating the current network configuration, the gateway deployment, and the shift to a cloud email and productivity platform for practice communications.

Regulatory risk: 45 CFR §164.308(a)(1)(ii)(A) requires covered entities to conduct an accurate and thorough assessment of potential risks to ePHI. OCR considers absence of a documented risk assessment as willful neglect if a breach occurs, the highest HIPAA fine tier, up to $50,000 per violation. The assessment gap also means Summit lacks the documentation baseline needed to respond to an OCR audit.

Remediation: Commission a formal HIPAA Security Risk Analysis using HHS-approved methodology. The findings from this 3D DeepDive assessment provide the technical foundation for that analysis. A documented risk assessment can be completed in one day with the right framework and should be repeated annually. Castile Security can provide the risk assessment documentation as part of the remediation plan.

MEDIUM
Suspicious inbox rule on billing@ account, possible unauthorized forwarding
Identity threat monitoring flagged an anomalous inbox rule on the billing account that may be forwarding insurance correspondence to an external address
▼

What was found: Identity threat monitoring flagged 1 detection on the billing@summitmedgroup.com account: a suspicious inbox rule. The rule appears to automatically process emails matching certain subject-line patterns. Given that this account also has 6 dark web breach records, the most of any account in the practice, this finding warrants immediate investigation rather than routine follow-up.

Business risk: Unauthorized inbox rules are a common persistence technique after account compromise. An attacker who gained access via a breached credential may have created a rule to forward insurance correspondence, billing confirmations, or payment notifications to an external address, while keeping messages appearing normal to the legitimate user.

Remediation: (1) Audit the full inbox rule list for billing@ immediately. (2) Export and preserve evidence before any deletion. (3) Force a full password reset and MFA re-enrollment. (4) Review the last 90 days of login history and mail send activity for anomalies. If unauthorized access is confirmed, evaluate whether a HIPAA breach notification is required.

MEDIUM
No documented backup restore test, recovery capability is unverified
A backup that has never been tested is not a backup. In a ransomware event, the difference between a 4-hour recovery and a 4-week recovery depends on whether the restore procedure works when it matters
▼

What was found: A backup solution is in place and running. However, no restore test has been documented, and no formal RTO (Recovery Time Objective) or RPO (Recovery Point Objective) has been defined. The practice does not currently have a documented answer to: "If we are fully encrypted tomorrow, how long will it take to restore clinical operations, and how much data will we lose?"

Business risk: In healthcare ransomware events, practices that have tested backups recover in 2–5 days. Practices that discover backup issues during a live incident take 3–6 weeks, during which no patient records are accessible, no prescriptions can be verified, and clinical operations are reduced or halted.

Remediation: Schedule a backup restore test: select one week of patient records, restore them to an isolated environment, and document the process and time. Define RTO (how long is acceptable) and RPO (how much data loss is acceptable). This half-day project earns Credit #3 (+5 pts toward the score) and produces a documented recovery baseline. Repeat quarterly.

11 · Activity This Period
What happened across your environment March 10–24.
Inbound Email Breakdown (14-Day Assessment Window)
Phishing
112
Malware
8
Spam
1,847
Graymail
934
Clean
4,218
Top Targeted Users
rtorres@ 62 events
billing@ 51 events
jwhitfield@ 28 events
Phishing Detection Breakdown
Financial scam / invoice fraud38
Credential harvesting31
Healthcare / insurance impersonation24
Social engineering19
1 phishing email reached an inbox (Shelly Park, front@). Without a permanent solution, all 112 reach inboxes each period.
12 · Your 90-Day Roadmap
From 25 to Developing, in three months.
Check items off as they're completed. Progress saves automatically in your browser.
30 Days
Emergency Remediation · Remove the Critical Flag
✓
Patch the gateway firmware. Update to the latest stable release addressing CVE-2023-44221, CVE-2024-40766, and CVE-2024-53704. Removes the Critical designation immediately.
✓
Force password resets on 8 breached accounts. Confirm MFA is active. Priority: billing@, rtorres@, jwhitfield@. Takes under an hour.
✓
Audit and clear suspicious billing mailbox rule. Preserve evidence. Force password reset and MFA re-enrollment on billing@.
✓
Deploy endpoint protection to 5 remaining unmanaged devices. Reaches 100% EDR coverage and closes the Confidence gap.
0 of 4 complete
60 Days
Foundation Building · Protect Patients and the Perimeter
✓
Configure DKIM + DMARC at p=quarantine. Closes email spoofing. Earns Credit #4. Protects patients from physician impersonation scams.
✓
Enable BitLocker on 14 unencrypted workstations. Encrypts all local PHI at rest. Required for HIPAA compliance on device loss scenarios.
✓
Deploy permanent email security solution. 112 phishing attempts in 14 days warrants an always-on filter, not periodic assessments.
✓
Upgrade 5 Windows 10 devices to Windows 11. End-of-life machines have no patch path. Schedule with clinical operations to minimize disruption.
✓
Complete formal HIPAA Security Risk Analysis. Addresses the 3-year gap. Satisfies OCR's first audit question. Assign a Security Officer role.
0 of 5 complete
90 Days
Maturity · Build Lasting Clinical Resilience
✓
Complete backup restore test + define RTO/RPO. Restore one week of patient records. Document the time. Define what's acceptable. Earns Credit #3.
✓
Segment network into clinical, admin, and IoT VLANs. Separate medical devices and billing systems. Extends breakout time from 2 hours to days. Earns Credit #6.
✓
Deploy dedicated cloud email backup. Protects patient communication records in email, chat, and file storage independently from the clinical server backup.
✓
Continue phishing simulation through June 2026. Maintain 90%+ pass rate for 90 days to earn Credit #5. Coach the 6 employees who clicked in March.
0 of 4 complete
Score Path, 25 → Developing Band (50+)
ActionScore ImpactEffort
Patch gateway KEVs (removes −30 penalty)+8 ptsHalf-day
Configure DKIM + DMARC + earn Credit #4+7 pts2–3 hrs
Backup restore test + RTO/RPO + earn Credit #3+8 ptsHalf-day
Network segmentation (VLANs) + earn Credit #6+7 pts1–2 sessions
Enable BitLocker on 14 endpoints+5 pts2 sessions
Deploy email security + reset breached accounts+4 pts1–2 sessions
HIPAA risk assessment + IR plan + 100% EDR+3 pts1 day
Total projected at 90 days+42 → ~67 (Developing)~4 weeks effort
Summit Medical Group cares for Denver's patients. Let's make sure those patients' records are equally protected.

This assessment set out to answer a straightforward question: is Summit Medical Group prepared for the threats facing a 58-person healthcare practice in 2026? The honest answer is: not yet. But the gap is specific, the path is clear, and the tools to close it are already in place. The Critical score is driven entirely by a firmware update on one network device. That is not a broken security culture, it is a maintenance window that hasn't been scheduled yet.

The findings that require action are concrete and achievable. Patching the gateway removes the Critical designation in one half-day window. Forcing password resets on eight accounts closes an active attack vector in under an hour. Configuring DMARC protects every patient from physician impersonation scams in a 2–3 hour project. These are not six-month initiatives. They are tasks on a calendar, and the 90-day roadmap in this report sequences them in the order that produces the maximum score recovery and risk reduction in the shortest time.

The financial case for action is clear. Summit's realistic near-term exposure runs from $350,000 to $900,000 across the two most likely scenarios. The tail risk, a full PHI breach of the 86,400 patient files on the primary server, extends to $8.2 million. Against that exposure, the cost of the remediation plan represents approximately a 45-to-1 return on investment. In healthcare, where the average data breach now costs $9.77 million (IBM 2024), that math is compelling at every investment level.

Summit's patients trust this practice with their most personal information: diagnoses, prescriptions, financial records, and insurance details. The $8.2 million in sensitive data mapped across these systems is not a liability to be ashamed of, it is the record of years of patient care. Protecting it is a professional obligation, and it is entirely achievable within this quarter.

Castile Security will re-score Summit Medical Group at the 90-day mark to confirm progress and deliver an updated 3D DeepDive report. The target is a Developing band score of 67, meaningful progress that demonstrates to patients, payers, and partners that Summit takes information security as seriously as clinical care. This is how a practice that starts at Critical becomes one that its patients can trust with confidence.

Security Layer
Castile Security
(915) 995-2495
castilesecurity.com
support@castilesecurity.com
⚠ SAMPLE REPORT: ALL COMPANY DATA, EMPLOYEE NAMES, AND FINANCIAL FIGURES ARE ENTIRELY FICTITIOUS · Prepared for demonstration purposes only · 3D DeepDive™ v1.5 · Castile Security
Appendix
Technical Detail & Evidence Record
Click any section to expand. Sample data, for demonstration purposes only.
A · Score Breakdown (3D DeepDive™ v1.5)
Full pillar formulas, sub-scores, penalty logic, and final derivation
PillarWeightPillar ScoreContributionKey Drivers
Device30%62.018.6EDR 91% coverage; 3 KEVs on perimeter; 5 EoL devices; no segmentation
User24%58.013.9No DMARC/DKIM; MFA partial; 8 breached accounts; no email security
Governance20%45.09.0No IR plan; HIPAA risk assessment 3+ years stale; limited logging
Data14%55.07.7PHI mapped ($8.2M); no encryption at rest; 3 files sent outside org
Backup12%48.05.8Backup running but untested; no RTO/RPO defined; no M365 backup
Base Score55.0
KEV Penalty (3 × −15, max −30)−30.0CVE-2023-44221, CVE-2024-40766, CVE-2024-53704, all reachable
Credits Earned0No credit thresholds met this period
Final Score25 · Critical

Policy floor: Active EDR (91% coverage) and active perimeter firewall confirmed. BDR unverified (no restore test). Policy floor of 30 does not apply, all three controls (active EDR, active firewall with licensed services, active BDR) must be confirmed for floor eligibility. Score stands at 25.

Confidence: 85%, Deductions: −10 EDR coverage below 95% threshold · −5 external scan age 32 days (2 days over window). All core feeds present: endpoint protection, email security trial, data discovery scan, identity and dark web monitoring, phishing simulation platform.

B · Endpoint Inventory (Endpoint Protection)
53 managed agents · 5 pending deployment · As of March 24, 2026
DeviceUserOSStatusAgent VerLast Scan
SMGSRV-CLINICAL01SupportWindows Server 2022 (20348)Online25.1.2.100Mar 24, 2026
SMGSRV-BACKUP01SupportWindows Server 2019 (17763)Online25.1.2.100Mar 24, 2026
SMGWS-BILLING01billingWindows 11 Pro (26100)Online25.1.2.100Mar 24, 2026
SMGWS-DR-TORRESrtorresWindows 11 Pro (26100)Online25.1.2.100Mar 24, 2026
SMGWS-JWHITFIELjwhitfieldWindows 11 Pro (26100)Online25.1.2.100Mar 23, 2026
SMGWS-FRONT01s.parkWindows 10 Pro (19045) ⚠ EoLOffline24.2.3.471Mar 22, 2026
SMGWS-FRONT02schedulingWindows 10 Pro (19045) ⚠ EoLOnline24.2.3.471Mar 24, 2026
... 46 additional devices in full inventory. 5 unmanaged devices pending EDR deployment (exam room tablets and 2 reception desktops).
C · Dark Web Breach Detail
24 total records · 8 monitored accounts · Source: Dark web monitoring
EmailBreachesMost RecentNotable Source
billing@summitmedgroup.com6Nov 2024Healthcare Credential Stuffing Dataset 2024
rtorres@summitmedgroup.com5Apr 2025Synthient Credential Stuffing Threat Data
jwhitfield@summitmedgroup.com4Mar 2024National Public Data
mreyes@summitmedgroup.com3Jan 2024Verifications.io
admin@summitmedgroup.com3May 2023LinkedIn Scraped Data
scheduling@summitmedgroup.com2Nov 2022Lead Hunter
front@summitmedgroup.com1Sep 2022You've Been Scraped

All 7 monitored accounts have at least one breach record. The billing@ and rtorres@ accounts are in active credential stuffing datasets targeting healthcare organizations. Immediate password resets and MFA verification are required on all 7 accounts.

D · Patient Data Risk Detail (Data Discovery)
$8.2M total liability · 94,180 sensitive files · 712,440 patient records · March 24, 2026
Data ClassificationFilesRecordsModeled LiabilityRegulation
United States PHI, Clinical Notes18,44062,180$2,180,000HIPAA
United States PHI, Diagnoses & Rx14,32051,440$1,800,400HIPAA
US Personal Legal / PII11,28041,200$1,364,020PII
US Date of Birth22,18098,440$984,400PII
US SSN4,8407,200$180,000PII
US Health Insurance Member Number8,92044,180$883,600HIPAA
Password Detection5,240380,000$1,900,000IT
Credit Card, Various1,8402,280$228,000PCI / FTC
US Bank Account / ACH4803,180$63,600PII / FTC
Total$9,584,020Modeled

Note: This modeled liability represents the estimated regulatory and legal exposure per classification using current HIPAA, PCI, and state privacy law frameworks. Reported figure of $8.2M reflects the conservative (75th percentile) estimate used for 3D DeepDive scoring. Primary server (SMGSRV-CLINICAL01) holds 86,400 files worth $7.7M, the practice's primary data risk asset.