The problem is many healthcare organizations do have terrible IT security. I've seen a nigerian (419) spam from a hospital employee mail account (confirmed by D

The problem is many healthcare organizations do have terrible IT security. I've seen a nigerian (419) spam from a hospital employee mail account (confirmed by DKIM and Received, so not a spoofing - a mail account credentials were compromised) and such spammers don't target healthcare - all they need an easy to hack mail account with good reputation. But what I see organizations doing to 'improve' their security is mostly security theater which make work hard for employees and with security crapware which uses 100% CPU monitoring users and 'scanning for threats'. At best a small fraction of what is done actually improves security.