There is a growing sense that organizations can no longer confidently rely on the security of the systems, technologies, and partners they depend on. As supply chains expand and threats evolve, stakeholders struggle to obtain assurance that is relevant and reliable, leaving them to ask:
Who can I trust?
Today's assurance providers have a responsibility to provide trustworthy assurance grounded in real-world threats, independent oversight, and measurable outcomes. The 2026 HITRUST Trust Report explores how HITRUST is tackling the Trust Crisis.
Supply chain attacks are rising. Vendor ecosystems are exploding. Yet most assurance programs still rely on static frameworks and self-attested evidence.
-Munich RE's Global Cyber Risk and Insurance Survey 2024
Traditional assurance is a snapshot of the past. HITRUST is a shield for the future.
HITRUST Third-Party Coverage
Last year, attacks where a third party was involved rose from 15% to 30%. More than half of large organizations identified supply change challenges as their biggest barrier to safeguarding data.
To manage these risks, over 80% of HITRUST certifications, including 100% of r2 certifications, address the threats presented by an organization's service providers.
The healthcare sector has been the costliest sector for a breach for 12 consecutive years. -IBM's Cost of a Data Breach Report 2025
None of the top 50 healthcare breaches reported in the Department of Health & Human Services OCR breach portal occurred in HITRUST-certified environments.
HITRUST is the only assurance program purpose-built for deployed AI systems.
While others define only principles, HITRUST operationalizes them—translating emerging AI risks into prescriptive controls which are ready-made for implementations and continuously reviewed for new threats.
Powered by a Cyber Threat Adaptive model, the HITRUST CSF, including its AI certification, delivers continuous coverage for 100% of MITRE-mitigable attack techniques.
The Modern Assurance Gap
Supply chain attacks are rising. Vendor ecosystems are exploding. Yet most assurance programs still rely on static frameworks and self-attested evidence. Traditional assurance is a snapshot of the past. HITRUST is a shield for the future.
of HITRUST certifications go through independent and centralized HITRUST Quality Review prior to issuance.
Stakeholder Roadmap to Success
The Path Forward is Clear
Modern risk management requires assurance that is validated, adaptive, and defensible. We lay out the steps that organizations ready to strengthen their programs should consider.
Shift from “flexible compliance” to threat-intelligent assurance
Select assurance mechanisms that prescribe requirements aligned to real-world attack techniques.
The HITRUST CSF uses prescriptive requirements providing coverage for 100% of the mitigable cyber attack techniques published by MITRE.
HITRUST is Tackling the Trust Crisis with Next Generation Assurance.
Download the full report to learn more about what HITRUST is doing to provide reliable, relevant assurance.