Executive Summary
AI-generated analysis for McKesson
McKesson (mckesson.com) is a major publicly traded healthcare company specializing in pharmaceutical distribution, medical supplies, and healthcare technology solutions. Based on independently sourced evidence, the rule engine has assigned a Tier 2 (High Risk) rating with 82% confidence, driven primarily by infrastructure exposure concerns, gaps in supply chain transparency, and ambiguous AI data handling disclosures. McKesson demonstrates several positive signals consistent with an established enterprise vendor:
Key Findings
- The domain has been registered since 1994 and archived since 1996, reflecting over 30 years of sustained online presence.
- SSL/TLS is configured with TLSv1.3 and a valid certificate issued by GlobalSign nv-sa, with no weak protocols or ciphers detected.
- Malware detection service returned a clean result with no malware, phishing, or unwanted software detections.
- No adverse media signals were identified in either the 12-month scan or historical media archives.
- No sanctions matches were confirmed — the two low-confidence results returned scored 0 and are assessed as likely false positives.
- SOC 2 compliance activity was evidenced by a job posting referencing a SOC Compliance Senior Analyst role, suggesting active internal compliance investment (though the SOC 2 report itself remains unverified and should be requested directly).
- McKesson discloses the use of third-party AI providers (OpenAI and Microsoft Azure AI) within its Ontada oncology analytics platform, which represents a positive transparency signal. Several concerns merit attention before onboarding or continued engagement:
- Five potentially risky services — FTP (21), SMTP (25), MySQL (3306), RDP (3389), and Elasticsearch (9200) — were detected as exposed. Critically, the infrastructure scan identified these on a Cloudflare CDN edge IP, which aggregates ports across many hosted customers. This materially reduces — but does not eliminate — the concern, and verification of McKesson's own backend exposure is warranted.
- No public trust center, security page, or subprocessor list was found, limiting the ability to independently assess McKesson's compliance posture and third-party data sharing practices.
- The HTTP security grade of C+ (60/100) on the marketing site reflects missing headers; however, application security for authenticated environments (my.mckesson.com) was not assessed.
- McKesson's AI data usage policy does not clearly commit to a no-training stance on customer data, and no data retention period is specified for AI processing — a meaningful gap given the sensitivity of healthcare data. Overall, McKesson is a large, established healthcare enterprise with strong brand signals and no active adverse findings, but the infrastructure exposure profile, absence of a public trust center, and unclear AI data governance practices are sufficient to warrant conditional engagement pending resolution of the identified gaps.
Independence Statement
All evidence in this report was sourced independently by ThirdProof from external data registries, public DNS records, threat intelligence platforms, web archives, and regulatory databases without vendor participation or input.