October 6th, 2026
What Public Dental Companies Tell the SEC About Cybersecurity
Industry Research — DSO, Research
Every dental company that files a Form 10-K has to describe how it manages cybersecurity risk, in writing, once a year, in a document anyone can read.
That means the SEC makes each of them answer, in a signed filing, the question a diligence team asks every target: what does your security program actually look like? Those dental cybersecurity disclosures sit in Item 1C of each annual report, and we could not find anyone in dental publishing them side by side.
So we did, for five dental companies that file with the SEC: Henry Schein, Dentsply Sirona, Align Technology, Envista and Park Dental Partners. Here is how they answered, and what those answers cannot tell a buyer.
I’ve sat on the buy side of $1B+ in dental practice M&A diligence. Read closely, Item 1C works as a diligence template for any target, public or private. Four of these five companies also sell to dental practices and groups, which makes their programs part of your vendor risk.
Patterson Companies used to file these too. It was delisted and filed to deregister in April 2025, so it has no current 10-K and is not included.
Five Dental Companies’ Cybersecurity Disclosures, Side by Side
Each row comes from the company’s most recent 10-K, for fiscal year 2025, filed in early 2026, unless a later filing is named. Quoted words are the filing’s own. Where a cell says an item is not named, it does not appear in Item 1C, which is different from the company lacking it.
| Company | Framework, as worded | Controls named in Item 1C | Incident response testing |
|---|---|---|---|
| Henry Schein | “aligned with” the NIST Cybersecurity Framework. ISO 27001 external audit or certification, “partial scope” | Risk assessments, security policies, annual cybersecurity and anti-phishing training. No technical controls named | Written incident response plan. Exercises not named |
| Dentsply Sirona | “leverage the standards set by” the NIST Cybersecurity Framework | MFA on all critical systems, firewalls, intrusion detection and prevention, vulnerability and penetration testing, identity management, application controls, ransomware defense, monthly phishing tests | Response plan updated annually. Simulated responses to incidents |
| Align Technology | NIST and ISO 27001 used “as a guide,” with a disclaimer that this does not mean it meets any standard | Vulnerability management, antivirus and malware protection, encryption, identity and access management, application security, security monitoring, phishing campaigns, penetration testing | Incident response process that outlines steps from detection to notification. Exercises not named |
| Envista | “leverage the standards set by” the NIST Cybersecurity Framework | Network protection systems (not itemized), annual training, regular phishing tests, plus penetration testing and compliance audits with third-party help | Response plan tested with tabletop exercises run by a third-party consultant |
| Park Dental Partners | Controls listed as “Aligned with the NIST Cybersecurity Framework categories” | MFA on critical systems, encryption, firewalls, intrusion detection and prevention, vulnerability management, periodic penetration testing, continuous monitoring, training and testing | Written response plan. Periodic tabletop exercises and simulated attack scenarios |
| Company | Who leads it | Board oversight | Incidents in the 10-K |
|---|---|---|---|
| Henry Schein | VP, Global CISO, 30+ years, CISSP and CISA, reports to the CTO | Regulatory, Compliance and Cybersecurity Committee at least quarterly. Audit Committee “at least a bi-annual basis” | October 2023 cyber incident that disrupted distribution operations and hurt 2023 results |
| Dentsply Sirona | CISO, 20+ years | Audit and Finance Committee. CISO updates it or the full board quarterly | No specific incident described. No material breach incidents it is aware of in the last three years |
| Align Technology | CISO, 20+ years, CISSP | Audit Committee. Met with the CISO or his team twice in 2025 | No specific incident described. Risk factors say it has experienced incidents, including internal employee exfiltration |
| Envista | Global Head of Information Security and GRC, prior CISO experience, 25+ years, reports to the CIO | Audit Committee. Full board report at least annually | No specific incident described. No attempted attack has had a material adverse impact |
| Park Dental Partners | Senior director of IT, 30+ years in IT leadership including 25 in cybersecurity, reports to the CEO, plus a virtual CISO resource | Audit Committee. Annual update to the full board | January 2024 employee email account incident, claims filed in 2024. Separately, a September 2026 Item 1.05 8-K |
All five 10-Ks also mention insurance that covers cyber losses. None of the five names a security vendor in Item 1C. Only Henry Schein’s states a cyber policy limit, in its discussion of the 2023 incident.
What the SEC Asks Public Companies to Disclose
The rule is SEC Release 33-11216, adopted in July 2023. It added two disclosures.
Item 1C, every year in the 10-K. Starting with fiscal years ending on or after December 15, 2023, a company describes its “processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.” The rule’s list of points to cover includes whether the company uses outside assessors, consultants or auditors, and whether it has processes to oversee risk from third-party service providers. It also asks how the board oversees cyber risk, which management roles are responsible, and “the relevant expertise of such persons or members.”
Item 1.05, when an incident is material. Since December 18, 2023 (June 15, 2024 for smaller reporting companies), a company files an 8-K “within four business days after the registrant determines that it has experienced a material cybersecurity incident.” The clock starts at the materiality determination, and that determination “must be made without unreasonable delay after discovery of the incident.” The filing describes the nature, scope and timing of the incident and its material or reasonably likely material impact. Required details that are not yet known get flagged in the filing and added by amendment within four business days of becoming known.
What Each Filing Says
Henry Schein
Henry Schein’s 10-K for fiscal 2025 is the one filing in the group that puts dollar figures on a past incident. Item 1C says the October 2023 cyber incident “disrupted key business operations, adversely impacted our financial results for the fourth quarter and full year 2023,” and that “The incident had residual impact on our financial results in 2024.” Elsewhere the 10-K reports “a $60 million insurance policy, following a $5 million retention,” direct expenses of $11 million in 2023 and $9 million in 2024, and insurance proceeds of $40 million in 2024 and $20 million in 2025.
Henry Schein told investors about the incident within days, before mandatory Item 1.05 reporting began. Its October 16, 2023 8-K was furnished under Item 7.01, with a press release saying the company determined on Saturday, October 14 that part of its manufacturing and distribution businesses “experienced a cybersecurity incident.” The incident also appears in our list of the biggest dental data breaches.
Dentsply Sirona
Dentsply Sirona’s 10-K for fiscal 2025 gets specific about controls, starting with “multi-factor authentication on all critical systems.” On history, it says: “In the last three years, we are not aware of having experienced any material information security breach incidents.”
Align Technology
Align’s 10-K for fiscal 2025 attaches a disclaimer to its framework sentence. The program “leverages the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) 27001 frameworks,” and the next sentence reads: “This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST and ISO frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.”
Outside firms run penetration testing and independent audits, including an annual SOC type 2 audit “covering the security principle for systems supporting our products.”
The risk factors add this: “We have experienced, and may again experience in the future, cybersecurity incidents, data incidents, and unauthorized internal employee exfiltration of information.” No incident is described in detail, and Item 1C says the company has not identified cyber risks, including from previous incidents, that have materially affected it.
Envista
Envista’s 10-K for fiscal 2025 says it uses the NIST Cybersecurity Framework “to measure our security posture and manage risk.” It is one of two filings in the group that describe tabletop exercises. Envista says of its Global Security Incident Response Plan: “We test our GSIRP with tabletop exercises administered by a third-party security consultant.”
Park Dental Partners
Park is the one dental support organization in the group. It went public in December 2025 and filed its first 10-K, for fiscal 2025, in March 2026.
The 10-K discloses one prior incident: “On January 23, 2024, we became aware of unauthorized activity for a limited number of employee email accounts.” It says certain patients’ personal information “may have been impacted,” and that “Since the 2024 cybersecurity incident, the Company has not experienced any material information security breaches.”
On September 1, 2026, Park filed an 8-K under Item 1.05. It says that on August 28, 2026, the company “identified unauthorized access to its computer network” and engaged external cybersecurity and forensic specialists. It filed two business days later and explained its choice in its own words: the incident “has not materially disrupted the Company’s operations, however, due to the possible access of patient data, we are treating this as a reportable event.” It says the company “has not identified any material impact on its financial condition, results of operations, or business operations.” The September 1 filing does not say how access was gained, which systems were involved, or how many people were affected.
What the Suppliers’ Filings Mean for a Dental Group
Henry Schein’s 10-K says its October 2023 incident “primarily affected the operations of our North American and European dental and medical distribution businesses,” and that “Henry Schein One, our practice management software, revenue cycle management and patient relationship management solutions business was not affected.” For a dental group, that is the kind of vendor event a continuity plan should already cover: which suppliers are critical, and what you do when one goes down.
Two of the filings describe vendor practices a dental group can copy. Dentsply Sirona has built “contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.” Align requires its vendors to report cybersecurity incidents to it, and gives extra review to any vendor that cannot provide a SOC 1 or SOC 2 report.
What a Written Program Can and Cannot Tell You
The first lesson is the plainest one. A 10-K describes a program in the company’s own words, and that is all it can do. Henry Schein and Park both describe specific incidents in their filings, next to their program descriptions. Neither company’s filings say how an intrusion happened or whether any listed control was involved, and I’m not going to guess. A filed description does not prove every control works at every site. An incident does not prove a program was weak.
The second lesson is in the verbs. NIST does not certify companies against its framework, so the wording each company chooses is worth reading closely. Henry Schein’s strategy is “designed so that” its program is “aligned with” it. Dentsply Sirona and Envista “leverage the standards set by” it. Align uses NIST and ISO 27001 “as a guide.” Park lists its controls as “Aligned with” NIST categories.
The third lesson is what Item 1C was never built to show. The rule asks for processes described well enough “for a reasonable investor to understand those processes.” None of these five filings shows which locations run which firewall, whether MFA covers every remote access path, or when the backups were last restored. Those answers turn into remediation costs, and remediation costs belong in the price.
What DSO Buyers Should Take From These Filings
Almost every dental group you will look at as a buyer is private and files nothing with the SEC. Item 1C still makes a good diligence template, because it lists the topics the SEC decided an investor needs covered. Ask a target for the same things, then for the evidence behind each answer. Security tools don’t protect you if they aren’t configured, monitored, and enforced.
- The framework claim, with evidence. A target that says it follows NIST should show you the last assessment against it, who performed it, what it found, and the cost, owner and due date of anything still open.
- The control list, scoped. Two of these filings say MFA covers “critical systems.” Ask which systems those are, and whether email, remote access and the practice management software are on the list at every location. More on MFA requirements for dental practices.
- The last tabletop exercise. Two of the five filings describe tabletop exercises. Ask for the last one’s date, scenario, and what changed afterward.
- The last restore test. Ask when backups were last restored, how long it took, and which systems it covered. Then compare that time with how long each office can afford to be down.
- The full incident history. A 10-K’s incident disclosures may not provide a complete history. Ask for every incident, including the small ones, and how each one was closed out.
- The vendor list. Ask which of the target’s critical vendors have a current SOC 2 report on file, read the exceptions, and check whether contracts require vendors to report incidents. Our post on avoiding IT pitfalls in dental practice acquisitions covers the rest of the technical walk-through.
- Who owns security, and who they report to. In these filings, security sits under a CISO reporting to a CTO at Henry Schein, a global head reporting to a CIO at Envista, and a senior IT director reporting straight to the CEO at Park, with a virtual CISO alongside. Any of those can work. A target where nobody can answer the question has given you a finding.
- The insurance, read closely. Henry Schein’s 10-K shows what a real claim looked like, with insurance proceeds paid out over two years. Ask for the target’s cyber policy, its retention, and what the application said about controls. Our post on cyber liability insurance for dental practices walks through those application questions.
Dental groups with no SEC reporting obligations are outside the SEC’s four-business-day clock. Their obligations after a breach run through HIPAA and state law, on different clocks, which we cover in our guide to dental data breach notification.
I’ve written before that IT diligence is not a checkbox. It is risk pricing. Each of these filings describes a program in careful language. None can tell a buyer what matters most: whether that program holds up at every location on the Monday morning after close.
Read the filing. Then ask for the evidence.
