What Is Crown Jewel Analysis? Protecting What Matters Most
Crown jewel analysis is the practice of identifying the few data sets and systems most critical to an organization's mission, then concentrating protection on them. It starts from an admission: no organization can defend everything equally. Chad Raduege, a retired U.S. Air Force brigadier general, used the approach on a network of roughly 750,000 endpoints and says it applies directly to life sciences. The questions are simple. What data matters most, where does it reside, who has access to it, and what could someone do with it if they got in?
Raduege spent 29 years in communications, IT and cyber operations, including leading the group that oversaw the Air Force Information Network, and is now President of Cyber, Data & Communications at Elara Nova. He explained the method on Open Door Salon.
Where does the term crown jewels come from?
It is military vocabulary for the assets a mission cannot do without. Raduege used it when describing the first question a CEO should ask about company data:
In the military, we would call it the crown jewels.
The same idea is formalized outside the military. MITRE describes its Crown Jewels Analysis as a process for identifying the cyber assets most critical to accomplishing an organization's mission.
Why can't a company protect everything?
Because the math favors the attacker. Raduege described the problem he faced with hundreds of thousands of endpoints:
Defense has to be right all of the time. The offense or the hacker just has to be right once and then they're in.
A small biotech has far fewer endpoints, but also far fewer people to defend them. The asymmetry is the same. Spreading a limited security effort evenly across every laptop, cloud account and vendor connection leaves the most important data no better protected than anything else.
How did the Air Force put crown jewel analysis into practice?
By building teams around specific critical assets. Raduege described the initiative:
We had a whole initiative that we called Mission Defense Teams, where we identified a number of crown jewel opportunities around the Air Force and we built teams of cybersecurity professionals that would put direct focus on those areas.
His example was the data coming off a particular aircraft, critical to intelligence and to understanding both the adversary and the Air Force's own defenses. Protecting that specific data made it possible to assign people, resources and technology where they mattered. His summary:
Really it was an acknowledgement that trying to protect everything is a losing battle. But can you protect this one thing or these couple of things? Yeah, you can do a better job with that.
What counts as a crown jewel in a life sciences company?
Raduege begins any assessment with the data itself:
What type of data is available here? What type of information is being used and how does it all come together?
From there he asks where it is, who is interfacing with it, who has access, and why an adversary would be interested. His list of what adversaries want from the sector suggests the candidates: biological and research data built over years, clinical trial results, manufacturing processes, emerging technology and the knowledge of key scientists. For a given company, the exercise is to decide which of those would do the most damage if stolen or disrupted. Near the end of the conversation he put three questions to any leadership team:
What are the crown jewels of our organization? How do we protect those? And if those were compromised, what would that mean?
Answering them usually requires knowing which partners hold which data, a question we cover in who is responsible for cybersecurity in a biotech. Investors face the same exercise with their own files, as Raduege explains in what hackers can do with a VC's due diligence data.
When should a startup start protecting its crown jewels?
From the beginning. Raduege warned that the race to be first to market pushes founders to take shortcuts, and that shortcuts in security can leave intruders already in place when a product launches:
So you really need to build cybersecurity in from the beginning. We talk about building it in and not strapping it on.
How can companies learn from each other's breaches?
Through information sharing. Raduege pointed to the information sharing and analysis centers that exist for critical infrastructure sectors, where members share what happened so others can prepare. He described their logic:
You were hacked today, we're probably gonna be hacked tomorrow. What can we learn from the one that was hacked yesterday that can make us better today?
Knowing your crown jewels makes that sharing useful, because it tells you which lessons apply to the assets you care about. It also puts this summer's incidents in context; in our look at the 2026 pharma cyberattacks, Raduege describes adversaries mapping the industry for weak points.
Companies that want to reach the leaders who follow this conversation can learn about sponsoring Open Door Salon.
This post is drawn from the recorded, on-the-record conversation between Lori Ellis and Chad Raduege on Open Door Salon. MITRE's description of Crown Jewels Analysis is linked above.