Luke Moran, managing director of life sciences at Actalent, outlines why the medtech industry must now treat cybersecurity as a strategic imperative.
Ask any life sciences executive about their priorities this year and the conversation will reach artificial intelligence (AI) rather quickly. Being able to articulate an AI roadmap is now a baseline expectation for leaders across medical devices, pharma and biotech. And those roadmaps are interrogated by boards and leadership teams along the same lines: How are we using AI? What governance sits around it? How do we adopt it in a way that drives efficiency and, eventually, revenue? And how do we assess the risk?
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
The question about risk is where many of these plans stall. AI delivers efficiency by drawing on large volumes of data and connecting systems that used to operate separately. For a medical device company, much of that data is protected patient information, and many of those systems touch products that patients depend on. An organisation that cannot guarantee the security of that data and those connections cannot put AI to work at scale, however strong its road map looks on paper. Cybersecurity has become the gating factor for AI adoption, and it is now the fastest-growing talent need in medtech – changing what companies expect from the engineers who design, build and maintain their products.
From big data to usable data
I’ve been in the industry for almost two decades, and for much of the last 10 years the dominant theme was big data. Wearables, connected monitors and enterprise systems were generating enormous volumes of information, and nearly every company knew something valuable was buried in it even as they lacked a way to make sense of it at scale, let alone turn it into better products or new revenue streams.
AI provided the key to solve this data puzzle. Models that could take in vast datasets and find patterns gave companies a practical path from raw information to clinical insight. Consider orthopaedic surgical robots that calculate a patient’s range of motion during a procedure and adjust in real time to complete the surgery in the way most likely to support recovery. That capability draws on reams of accumulated medical knowledge, built into the operating logic of a machine. Big data supplied the raw material and AI supplied the means to use it.
What few anticipated was how quickly AI and data would reach every corner of the business. Today the technology touches product design, clinical development, quality systems, manufacturing and commercial operations. For a medical device company, that reach carries unusual weight, because the data involved is some of the most sensitive and heavily protected information that exists.
Cybersecurity has left the IT department
Glucose monitors, insulin pumps, cardiac implants and wearables increasingly connect over Bluetooth to smartphone apps, which feed cloud platforms that clinicians and manufacturers use to track performance and outcomes. Each connection makes a product more useful to patients and more valuable as a source of data. Each one is also a potential point of entry for bad actors.
Most medical device manufacturers were not built to run advanced cybersecurity programmes. Their strengths are engineering, clinical science, quality and regulatory, developed over decades of making mechanical and electrical products. Securing connected products, cloud environments and smart factories all at once is a significant stretch for these organisations and they are experiencing the growing pains.
Five years ago, most people in the industry would have described cybersecurity as an IT infrastructure concern, a matter of firewalls, network monitoring and access controls. That view no longer holds. Security now sits at the intersection of product development, quality, regulatory strategy, digital transformation and manufacturing, and it has to be designed into a device from the earliest stages instead of layered on after launch.
Regulators have reinforced the shift. The US Food and Drug Administration (FDA) now expects manufacturers of connected devices to address cybersecurity in premarket submissions, including a software bill of materials and a plan for monitoring and addressing vulnerabilities once a product is on the market. Compliance has become an engineering deliverable, which changes who needs to be in the room when a product is first conceived.
The compliance strategies that work share a few traits. Security requirements are defined at the design stage alongside clinical and usability requirements, so threat modeling happens before architecture decisions are locked in. Documentation, including the software bill of materials, is maintained as the product evolves, not assembled at the last minute for a submission. Post-market monitoring has clear owners, because a connected device’s risk profile keeps changing long after clearance. Each of these practices depends on people who understand both regulatory expectations and security engineering, so compliance strategy and hiring strategy have become the same conversation.
The real risk surface is the ecosystem
When companies assess their exposure, many start with the device itself, but the larger vulnerability usually lies in everything around it.
Bringing a device to market involves a long chain of partners. Research and development may happen in-house or be outsourced. Once a product reaches the right stage, it moves into clinical trials run by contract research organisations (CROs), which collect and manage substantial amounts of protected patient information across multiple trial phases. From there it moves through regulatory review, manufacturing and distribution, and each step brings in new vendors, systems and people with access to data.
Once a company looks beyond its own walls, that web gets very large, and the further a partner sits from the core manufacturer, the more likely it is to be the point of entry for an attack. CROs in particular hold exactly the kind of data attackers value most. Leaders now have to ask whether their entire ecosystem has a cybersecurity strategy, and not just their own company.
The next wave of risk is already under construction. As manufacturing reshores and companies invest in advanced facilities, those plants are being built with sensors, Bluetooth connectivity, robotics and networked industrial control systems. Each of those capabilities improves efficiency and quality, and each one expands the attack surface.
Many of these facilities are still being built and are not yet fully operational, which gives companies a window to design and build for security from the start. We are already seeing growing demand for industrial control systems security engineers, a specialty that barely registered in life sciences hiring a few years ago.
What’s at stake
Medical device companies are, at their core, healthcare organisations. They want to grow, but most of them exist to solve clinical problems and improve patients’ lives. That mission is also the source of their highest-stakes risk, because some of their products perform functions that keep people alive.
The scenarios organisations are preparing for are sobering. A surgeon operating remotely through a robotic system could lose control of it to an attacker in the middle of a procedure. A pacemaker that communicates with a monitor over Bluetooth could be compromised and stopped. An attack on life-sustaining equipment could take down an entire hospital system, endangering patients and becoming a national security issue. None of this is a reason to slow innovation, but it explains why the industry now treats cybersecurity as a strategic imperative.
Medtech has navigated shifts like this before. The earliest pacemakers were bulky external machines that plugged into the wall, and today they are implanted in the body. The first practical dialysis machine was improvised during World War II by a Dutch physician using sausage casings and a washing machine drum. For most of its history, medical device engineering combined mechanical and electrical work with an understanding of human biology.
As devices became smaller and less invasive, software took on a much larger role. Universities launched biomedical engineering programmes, and companies built dedicated software, hardware and firmware teams. Each wave of technology required a new engineering discipline to emerge and mature. With software, sensors and wireless connectivity now embedded in so many products, cybersecurity is the latest of those disciplines, across medical devices, pharma and biotech alike.
Closing the talent gap
The difficulty is that there is no ready army of professionals with this experience. Few biomedical engineers have a cybersecurity background, and few security specialists understand the product development life cycle, regulatory requirements or clinical realities of medical devices. Every organisation wants a subject matter expert who bridges both worlds, and there aren’t many to go around.
In the short term, most companies will fill gaps with consultants and specialists, often at a premium. That works for urgent needs, but it is not a long-term strategy. Durable capability will come from workforce development, and particularly from upskilling engineers who already know the industry. Tenured professionals in regulatory, product development and remediation have spent years working inside the device life cycle. Those who are willing to learn bring institutional knowledge that is hard to replicate, and pairing that knowledge with security training produces the hybrid talent the market is missing.
At Actalent, we now ask every biomedical engineer we work with whether they have considered cybersecurity and what it would take to build that skill set. Most are aware of the need. Some are deeply focused on a specific therapy area and plan to stay there, while others are avid learners looking for their next step. For that second group, the barrier is usually practical: knowing which coursework matters, how to gain applied experience and how to position themselves for the roles opening up. Connecting them with training partners, and then with assignments where they can put those skills to work, is where much of the progress happens.
For medtech leaders, the lesson is to plan on two timelines. Know how you will fill critical cybersecurity needs this year, and know how you will build that capability within your own engineering workforce over the next several. The companies that manage both will be the ones positioned to deliver on their AI road maps, protect patients and move to the next stage of innovation.
