Navigating the AI Frontier and Private Equity Pressures: Insights for 2027 — Dental Cyber Watch Live Episode 5

 

Securing DSOs and multi-site healthcare systems requires navigating a rapidly shifting landscape marked by emerging generative AI technologies, complex regulatory demands, and tightening operational budgets. In Episode 5 of the Dental Cyber Watch Live podcast, host Bill Neumann (CEO of Group Dentistry Now) and co-host Gary Salman (CEO of Black Talon Security) sit down with the “Guardians” of the ONIX Alliance—a peer-to-peer knowledge-sharing community built specifically for healthcare technology executives.

Joined by ONIX Community Manager Jessica Lamers, alongside technology leaders Matthew Harris (Specialty Dental Brands), Andy Taylor (Children’s Surgery Centers), Noel Bouteller (Allied OMS), Rand Samuels (Specialty1 Partners), and Joshua Hyman (Black Talon Security), the panel examines what lies ahead for healthcare IT in 2027. Together, they dissect the double-edged sword of artificial intelligence, third-party vendor risks, private equity deal slowdowns, and practical strategies for defending cybersecurity budgets.

Cyber Watch — Live — Episode 5

• Breaking the Healthcare IT Silo: Why multi-site tech executives need a trusted, vendor-free peer collective to share real-world intelligence.
• The 2027 AI Dilemma: Balancing operational efficiency against rogue shadow AI, unchecked code generation, and patient privacy risks.
• Private Equity & Economic Headwinds: Navigating EBITDA margin pressures, delayed transactions, and the risk of short-sighted security budget cuts.
• The Department of “We Can If”: Conducting pre-close M&A cyber audits and translating cyber risk into executive business language.

The AI Paradox: Efficiency Gains vs. Rogue Tools in Healthcare

Looking toward 2027, the panel agreed that artificial intelligence represents both an unprecedented opportunity and an expanding operational vulnerability. On one hand, automation streamlines clinical documentation, aids infrastructure monitoring, and accelerates complex data analysis. On the other hand, the unvetted adoption of generative models creates significant data governance and privacy blind spots.

Noel Bouteller highlighted the urgency of establishing an active inventory of organizational AI use, cautioning teams against feeding sensitive electronic protected health information (ePHI) into unauthorized public engines:

“I basically told them to follow more of a zero trust model and don’t feed anything into AI that does not need to be in AI. Don’t just throw everything at it.” — Noel Bouteller

Gary Salman and Rand Samuels pointed out that “shadow AI” is spreading quickly across non-technical departments, where staff often mistake polite, sycophantic model outputs for objective truth. This creates genuine clinical and administrative hazards—such as copying and pasting unverified AI summaries directly into patient charts or replacing critical thinking with automated queries. Matthew Harris emphasized that healthcare organizations must embed strict verification frameworks rather than operating on blind confidence:

“AI itself is definitely streamlining lots of our processes… making it a lot faster carving through data. We just need to make sure we’ve taken into effect validation—not just taking it as is as the truth itself… trust, but verify.” — Matthew Harris

Code, Vendors, and Shadow Technology: The Expanding Attack Surface

The discussion shifted to the hidden cybersecurity risks introduced by rapid AI-driven development (“vibe coding”) and third-party vendor sprawl. Joshua Hyman noted that while AI can write thousands of lines of functional code in seconds, that speed often comes at the direct expense of standard software development lifecycle (SDLC) security testing, Quality Assurance (QA), and User Acceptance Testing (UAT).

When internal teams or external vendors ship unvetted, AI-generated code directly into production environments, they introduce critical vulnerabilities that sophisticated threat actors are already equipped to exploit.

Rand Samuels and Noel Bouteller emphasized that third-party vendor risk management (TPRM) is becoming increasingly volatile. Healthcare vendors routinely deploy new generative AI features on short notice without updating their risk assessments or notifying clients:

“You do your security risk assessments, which is great, but you don’t really get a full window into their environment and what their practices are… A lot of vendors are now utilizing AI, and that opens up a new avenue into your environment. That’s what keeps me up at night.” — Rand Samuels

Hyman also shared real-world examples of clinicians attempting to deploy homegrown, unapproved AI applications on DSO networks to analyze radiographs, stressing that without automated network monitoring to block unauthorized software, organizations routinely risk exposing sensitive patient records to external cloud environments.

Economic Headwinds, Private Equity, and Defending the Security Budget

With the healthcare sector operating in an environment of sustained high interest rates and extended transaction cycles, DSO leaders face mounting pressure to reduce overhead. Andy Taylor pointed to industry observations from legal leaders like Brian Colao at Dykema, who noted that dozens of pending DSO transactions may stall indefinitely under current market conditions.

In response, private equity sponsors focused strictly on EBITDA evaluations are often tempted to cut technology and cybersecurity spending. Taylor warned that treating cybersecurity as an optional expense creates massive downstream liabilities:

“You are going to see PE leadership cutting corners, and one of the areas where they do cut corners is cybersecurity… Those that invest in the compliance aspect are going to be ahead as the economy turns around, as interest rates drop, and as some of these deals start to move through.” — Andy Taylor

To protect IT budgets during annual planning, the panelists agreed that security leaders must speak the language of executive leadership. Joshua Hyman underscored that boards respond to business impact and opportunity cost rather than technical jargon. Framing cybersecurity as revenue protection rather than a cost center enables IT leaders to demonstrate how downtime prevention preserves patient volume, billing continuity, and enterprise valuation.

M&A Due Diligence, Compliance, and the ‘Department of We Can If’

As consolidation continues across the dental and specialty surgical markets, technical due diligence during mergers and acquisitions cannot be an afterthought. Andy Taylor urged organizations to mandate pre-close security audits on acquisition targets to uncover past breaches, unpatched infrastructure, or compliance deficiencies before closing.

Taylor reminded listeners of the severe regulatory stakes of an unaddressed incident: mandatory notifications to state regulators, the SEC, and the Department of Health and Human Services (HHS), followed by extensive post-incident investigations. In cases of gross negligence, clinical providers face the potential suspension or loss of their professional licenses.

To counter the perception that security teams serve as operational roadblocks, both Harris and Taylor advocated for repositioning cybersecurity leadership within the business:

“We are not the department of no. We are the department of ‘we can if.’ From a technology perspective, we must go out and tell people ‘we can if’ and work with the business units rather than against them.” — Andy Taylor

The Path to Collective Cyber Resilience

Cyber threat actors operate as highly coordinated, well-communicated networks. For healthcare and DSO executives, defending multi-site organizations requires moving away from isolated decision-making toward continuous collaboration, peer validation, and proactive risk management. 

Building cyber resilience demands ongoing evaluation of internal networks, stringent vetting of software vendors, and establishing board-level visibility into compliance and exposure. Organizations seeking an objective evaluation of their digital vulnerabilities and defensive posture can schedule a cyber risk review.

Inside the ONIX Alliance: Join the Community

Healthcare technology and security officers frequently operate on an island, managing complex HIPAA compliance, infrastructure scale, and data security without an objective peer sounding board.

The ONIX Alliance provides an exclusive, peer-to-peer virtual community designed to eliminate this isolation. Operating strictly without commercial vendor solicitations or sales pitches, ONIX allows verified technology executives—from single-specialty practices to large multi-site DSOs—to share real-world intelligence, evaluate emerging technologies, review operational workflows, and brainstorm solutions in an open, confidential environment. Healthcare technology and security leaders can apply to join the community by visiting onixalliance.org.

Thank You to Our Guest Panelists

Jessica Lamers, Community Manager, ONIX Alliance

Jessica Lamers oversees community operations, member vetting, and program development for the ONIX Alliance. She focuses on creating structured, vendor-free peer environments where healthcare technology executives can collaborate on governance, compliance, and infrastructure strategy.

Matthew Harris, Director of Security, Specialty Dental Brands 

Matthew Harris leads enterprise cybersecurity and data protection for Specialty Dental Brands, a nationwide dental support organization. With extensive experience across multi-site healthcare operations, he focuses on risk identification, frictionless business enablement, and scalable security architecture.

Andy Taylor, Chief Information Officer, Children’s Surgery Centers

Andy Taylor serves as CIO for Children’s Surgery Centers, operating specialized pediatric surgical facilities focused predominantly on the Medicaid population. A seasoned technology executive and software developer, Taylor provides strategic oversight on clinical technology integration, M&A due diligence, and healthcare regulatory compliance.

Noel Bouteller, Senior Vice President of IT, Allied OMS

Noel Bouteller directs information technology, data strategy, and enterprise infrastructure for Allied OMS, a specialized management services organization supporting over 40 oral surgery clinics nationwide. He specializes in workflow automation, process documentation, and zero-trust data governance.

Rand Samuels, Vice President of IT, Specialty1 Partners

Rand Samuels oversees IT infrastructure, enterprise systems, and operational monitoring across more than 220 surgical and dental practices nationwide at Specialty1 Partners. His focus centers on third-party vendor risk assessment, infrastructure resilience, and clinical data protection.

Joshua Hyman, Chief Information Security Officer, Black Talon Security

Joshua Hyman brings extensive cybersecurity engineering and technical leadership experience within the healthcare and dental sectors. As a founding leader of the ONIX Alliance Guardians, he advises healthcare leadership teams on threat hunting, software development security, incident containment, and enterprise risk communication.

---

🚨 Recent notable healthcare cyber incidents:

Hawaii Dental Group, Inc DBA Hawaii Family Dental was listed in an HHS Office for Civil Rights breach portal report. The report classifies the incident as a Hacking/IT Incident involving email, affecting 45,853 individuals. According to a press release issued by Hawaii Family Dental, the organization discovered that an unauthorized person had accessed an email account containing patient information. Separately, the ransomware group Qilin claimed responsibility for an attack on Hawaii Family Dental in a leak-site posting dated eleven days after the company’s stated discovery date.

---

7 to 7 Dental & Orthodontics, a dental group based in San Antonio, Texas, disclosed a data breach affecting thousands of individuals. The breach was reported to the Texas Attorney General on Sept. 17, 2026, with 3,526 Texas residents identified as affected. The regulatory filing with the Texas Attorney General provides limited details about the specific circumstances of the incident, including how the breach occurred, when it was discovered and when it took place.

---

O2 Dental Group, a six-location family dentistry practice in North Carolina, may have suffered a data breach. An October 5, 2026 post on dark web monitoring site Ransomware.live states hacker group Interlock was behind the suspected attack, which was estimated to have occurred the same day. According to the group’s claims, the alleged incident compromised patient health records, billing and insurance documents, and authorization forms. Breachsense, another cyber monitoring site, similarly reported that Interlock claimed to be responsible for an attack on O2 Dental Group that supposedly involved 20 gigabytes of data.

---

Dental Cyber Watch is sponsored by Black Talon Security, the recognized cybersecurity leader in the dental/DSO industry and a proud partner of Group Dentistry Now. With deep roots within the dental and dental specialty segments, Black Talon understands the unique needs that DSOs and dental groups have when it comes to securing patient and other sensitive data from hackers. Black Talon’s mission is to protect all businesses from the devastating effects caused by cyberattacks—and that begins with a robust cyber risk mitigation strategy. To evaluate your group’s current security posture visit www.blacktalonsecurity.com.