I'm in IT in a healthcare-adjacent sector. Never underestimate the motivation or tenacity of foreign state actors, organized crime and chaotic neutral hacking collectives. You have limited time and budget, and both financial and risk based approval processes to deal with. They have time, ideology¹, and financial incentives.

You can't win in the face of that.

¹ sometimes it's hacking for hackings sake, but more typically it's to disrupt critical services and extort modest capital to go away. Rinse, repeat, make that bank on volume.