Aesthetic clinics live on two kinds of records: the before-and-after photographs that market the practice, and the consultation files — photographs of a different kind, plus health questionnaires, payment plans, and sometimes psychological notes — that must never market themselves. Between the two sits a discipline most clinic directors have heard named but rarely measured. DataSecOps, the practice of guarding data that is always changing, in the hands of people who are always changing (labelled by Ben Herzberg of Satori Cyber in 2021), becomes oddly concrete when expressed in figures. The seven numbers below are all drawn from published sources — a worked data-protection review, industry incident reporting, a cost study, and the academic study that founded re-identification risk. Each entry says what the number counts and what a clinic should do in response. Run your own operation against them; the gaps usually surprise people who assumed their clinic was “too small to be a target”.
Number one: 87.5% — the DataSecOps coverage score
In the published worked example, 1,240 sensitive columns were counted across the estate and 1,085 of them sat under some form of protection, an 87.5% coverage rate. That is a good score — and the remaining 12.5% is exactly where an incident would begin, because protection is a chain and clinics are small chains. Translation for an aesthetic practice: count the places consultation data lives (booking system, photo archive, payment portal, messaging app), then count how many have real access rules. Most clinics that run this exercise for the first time find their coverage closer to half. The maturity ladder used in the field treats half of tier-one coverage as the level-two exit, so anything below that is early days, however organised the front desk looks.
Number two: 17.1% — the DataSecOps plain-text share of reads
Of all query activity in the worked example, 17.1% read data in unmasked form. Some of that is necessary — a surgeon opening a chart needs the real values — but much of it is habit: dashboards pulling raw rows, exports built for one report and kept forever. The clinic response is proportionality, not prohibition: decide which roles genuinely need unmasked values, route everything else through masked or tokenised views, and re-check monthly. A falling plain-text share is one of the few data-protection metrics a practice manager can watch improve week by week.
Number three: 22.6% — accounts holding more access than their role needs
The same review examined 940 user accounts and found 212 of them — 22.6% — with more reach than their job required. In clinic terms: the aesthetician who can open billing histories, the reception cover account with photo-archive rights, the vendor login nobody remembers creating. Every one of those is a quiet expansion of the breach surface. The fix is boring and reliable: a quarterly matching of each account against a written role description, with the mismatches removed the same week they are found.
Number four: 16.3% — grants that nobody has used in ninety days
Out of 1,900 tracked grants, 310 had not been used in three months or longer, a dormancy rate of 16.3%. Dormant access is the residue of staff turnover, finished projects and changed software — a cosmetic clinic with seasonal staff and rotating equipment vendors accumulates it fast. The remedy is the access request pattern: every new permission names the purpose and the time limit, and carries an expiry so it dies on schedule instead of waiting for a review to notice. Reviews that only re-confirm existing access miss this entirely; reviews that revoke are the habit that matters.
Number five: USD 4.99 million — the average cost of a breach in 2026
IBM’s 2026 cost study reached USD 4.99 million for the average breach — a record figure. No aesthetic clinic has that budget, which is precisely the point: the number is not a fine you would pay, it is the reason the precautions above pencil out. Even a small incident — a photo archive exposed, a consultation database phished — brings notification duties, lost bookings and reputational damage entirely out of proportion to its technical size. Against that arithmetic, masking, expiry and review cost almost nothing.
Number six: 79.7% — stolen credentials, not exotic attacks
When the extortion campaign tracked as UNC5537 swept Snowflake customers in 2024, 79.7% of hit accounts had previously appeared in infostealer dumps — credentials already stolen from employee devices — and multi-factor authentication was missing, with passwords left unrotated for up to four years. Roughly 165 organisations had no choice but to notify. The platform was not breached; the front doors were. Clinics live on the same failure mode at smaller scale: reused passwords, one shared login for the booking tablet, no second factor anywhere. Multi-factor on everything is a Friday-afternoon task and the single largest risk reducer on this list.
Number seven: 87% — how identifiable “anonymous” data can stay
In the study that established re-identification risk, 87% of Americans proved unique from just three facts: ZIP code, gender and birth date. The lesson for any clinic publishing outcomes, cases or research: removing the name is not anonymity. Aesthetic medicine’s own case studies — a 52-year-old from a specific district with a distinctive procedure history — are triplets waiting to happen. Formal de-identification is a decision about release, with the risk measured first (NIST’s SP 800-188 is the text to follow), and regulators have hardened the line recently: Europe’s court ruled in September 2025 that pseudonymised data remains personal data in the hands of anyone able to re-identify it, and the EU’s data-protection board drafts from 2025 treat pseudonymisation alone as insufficient.
What the seven numbers add up to for DataSecOps
Read together, the numbers sketch a mature operation:
- Coverage high and rising — the 87.5% figure, heading for full coverage of tier-one data.
- Plain-text reads shrinking — 17.1% and falling, as masked views take over dashboards and exports.
- Excess access tracked down quarter by quarter — the 22.6% over-provisioned accounts melting toward zero.
- Grants expiring by design, so dormancy (16.3% in the example) never accumulates again.
- The whole programme costing a rounding error beside USD 4.99 million.
They also sketch the failure mode — unprotected remainder columns, surplus reach, dormant grants, credential reuse, false anonymity — that every documented incident in this article travelled through. The methodology behind the worked figures, including the maturity ladder — its rungs running ad hoc, classified, enforced, evidenced, adaptive — is laid out in xOps School’s Ops Atlas page for DataSecOps, and it is the most useful single page a clinic director can read before the next software renewal.
Patients judge a clinic’s standards long before they judge its outcomes. The questions they ask when choosing a provider — covered in our guide on how to choose the right cosmetic hospital — increasingly extend to how consultation records and photographs are kept. A practice that can answer with the seven numbers above is ahead of nearly every competitor, and the answer fits naturally beside our guidance on preparing for online cosmetic consultations, where digital delivery raises the stakes. Standards, whether clinical or about data, work the way our review of hospital quality and safety standards describes: measured, published, and checked on a schedule. Seven numbers, one habit, no drama — that is what mature looks like.