By August 2026, four European countries, Poland, the UK, France and Germany, had entered the critical tier of a healthcare cyber risk index covering 30 nations. France was still rebuilding more than 1,000 workstations and roughly 200 applications, five months after an October 2025 attack hit eight sites. Germany’s Unimed incident had disrupted care for more than 135,000 people across connected institutions. Every one of these countries has invested heavily in hospital cyber security. None of that investment, on its own, has been enough.
The Diagnosis Is Cultural, Not Technical
Research published by King’s College London in March 2026 offers a specific explanation for why. Reviewing NHS Trust cyber resilience, the researchers concluded that ransomware remains the most acute threat facing hospitals not primarily because of a technology gap, but because of inconsistent governance maturity and, more pointedly, a cultural rather than technical or financial constraint. Trusts with comparable budgets and comparable tooling still show wildly different resilience outcomes, which points toward leadership and accountability structures as the actual variable rather than the size of the security budget.
A Framework Built Around Ownership, Not Just Controls
The KCL research proposes what it calls a Cyber Leadership Framework, built on board-level ownership of cyber risk, an empowered CIO or CISO with real authority rather than a title, and a deliberate effort to connect technical controls to what actually happens in a ward or a clinic rather than treating cyber security as a parallel IT concern. Its most structurally significant recommendation is greater centralisation of core cyber capabilities and shared services across otherwise fragmented Trusts, replacing dozens of individually under-resourced security functions with fewer, better-resourced shared ones.
The Same Fragmentation Problem Shows Up Across Borders
That fragmentation is not a uniquely British problem. The Black Book Europe-30 Healthcare Cyber Risk Pressure Index, measuring attack pressure, clinical digital dependence, supplier concentration and recovery friction across 30 countries, found 13 of them sitting in the two highest risk bands, with Poland, the UK, France and Germany specifically flagged as critical. Each of these health systems is organised differently, some more centralised than the NHS, some more fragmented, and all four still ended up in the same risk category. Centralisation on its own is not a guaranteed fix. What the KCL research adds is the missing piece, shared capability paired with genuine board-level accountability, rather than shared capability alone.
What This Means for Healthcare Programme Governance
A healthcare PMO reviewing cyber resilience investment should treat the KCL framework as a diagnostic tool rather than an NHS-specific recommendation. The practical test is straightforward: can a board member currently name who owns cyber risk for their organisation, describe what shared capability actually exists beyond their own site, and point to when that capability was last tested under real pressure rather than reviewed on paper. France’s five-month rebuild and Germany’s 135,000-person incident both suggest that answering those questions honestly, before an attack rather than after one, is the entire point of the exercise.