Executive Summary
AI-generated analysis for McKesson
McKesson (mckesson.com) is a major publicly traded healthcare and pharmaceutical distribution company assessed at Risk Tier 2 (High Risk) with 90% confidence. This assessment reflects specific infrastructure and governance gaps identified during independent investigation, not a reflection of the company's overall market standing or business reputation. McKesson presents several meaningful positive signals. The domain has been registered since 1994 and web-archived since 1996, reflecting over 30 years of established online presence. The domain is protected by enterprise-grade registrar controls (CSC Corporate Domains) with full transfer/deletion locks. TLS is current and strong, using TLS 1.3 with a valid GlobalSign certificate expiring August 2026. The CDN infrastructure (Cloudflare/Incapsula) shows a clean abuse score of 0% and a zero threat score on website scanning. Malware detection service returned no malware or phishing flags. The company appears in the ISO 9362 BIC registry confirming entity identity, no sanctions or watchlist matches were found, and no adverse media signals were detected across recent articles. Evidence suggests McKesson operates AI-driven oncology analytics through its Ontada division using OpenAI and Microsoft Azure AI, indicating active AI capability investment. Several gaps elevate the risk tier and require attention before this vendor can be approved for high data access workloads:
Key Findings
- Five high-risk service ports (FTP/21, SMTP/25, MySQL/3306, RDP/3389, Elasticsearch/9200) are exposed on the infrastructure footprint. The IP resolves to Cloudflare/Incapsula CDN edge infrastructure, which may mean these ports are not directly connected to McKesson's backend systems — however, this cannot be confirmed without vendor clarification.
- The marketing website (mckesson.com) received a C+ (60/100) grade from HTTP security header analysis, with missing Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options headers. The application portal (my.mckesson.com) was detected but not separately scanned.
- No public trust center, compliance page, or subprocessor list was found at any standard path. For a company of McKesson's scale, this represents a transparency gap for enterprise buyers conducting due diligence.
- McKesson's AI data usage policy does not clearly specify whether customer data is used for model training, and no data retention period for AI processing is stated. With confirmed use of OpenAI and Microsoft Azure AI for oncology data analysis, this gap is material for buyers with sensitive data.
- SOC 2 compliance is indirectly indicated (via a job posting for a SOC Compliance Senior Analyst) but no formal trust page or report has been published. ISO 27001 certification was not found in independent registry searches. Overall, McKesson is a well-established enterprise vendor with significant institutional credibility, but the combination of exposed high-risk ports, absent compliance transparency, and unclear AI data handling practices creates a documented risk that must be resolved before granting high data access. A conditional approval is warranted pending vendor-provided assurances on the specific items identified herein.
Independence Statement
All evidence in this report was sourced independently from public registries, infrastructure scanning, threat intelligence feeds, and open-source data — McKesson was not contacted and did not participate in or influence this assessment.