Cyberattacks and Closed Straits: Defending Pharma on Two Fronts | Clinton West & Mike Walker

Two months into a war that closed the Strait of Hormuz, a former CIA supply-chain officer and a health-and-life-sciences digital strategist worked out what a closed waterway does to a medicine cabinet. Asked first about the conflict, both answered with the same underlying problem rather than the headline one: almost nobody in pharma can see far enough down their own supply chain to know what a closed strait actually reaches.

Clinton West is president of the supply chain security practice at Aardwolf Global Solutions, where he leads intelligence-driven work to secure critical supply chains for national-security, defense, and commercial operations. He spent more than two decades at the Central Intelligence Agency, with earlier service in the US Navy and the National Reconnaissance Office. At the CIA he led the Office of Supply Chain Risk Management, held senior supply-chain and risk roles across Europe, Africa, and the Middle East, and served as Afghanistan Transition Manager, overseeing crisis response and strategic transition in high-risk environments.

Mike Walker is a digital-strategy leader in health and life sciences who advises pharmaceutical companies and biotechs on supply-chain security, cybersecurity, and digital transformation. He served as executive director of global health-and-life-sciences digital strategy at Microsoft, where he led the company’s point of view on how pharma, med-tech, and biopharma organizations modernize using digital ecosystems, digital twins, and AI, and he was previously an analyst at Gartner. He sits on multiple boards and does independent strategic consulting for some of the largest pharma and biotech companies in the world. He was also, on one job, nearly kidnapped in Cairo.

A chokepoint everyone modeled and nobody had seen tested

West watched Iran from inside the agency for more than twenty years, and for all of them the strait was a scenario rather than an event. “Never have we seen an opportunity that the Iranians have taken to close the straits,” he says. “It’s always been on the minds of CIA and certainly the Department of War, but it’s actually happening.”

Public attention went to oil and the price of gasoline. West’s list ran further down: helium for the hospital equipment that depends on it, pharmaceuticals covering “everything from drugs to the gloves that you wear,” and the semiconductors inside medical devices.

Walker put the dependency in order. The health and life sciences supply chain, he says, is dependent “on another key supply chain that fuels all supply chains, which is the energy supply chain.” The US Energy Information Administration measured 2022 flows through that strait at about 21 percent of global petroleum liquids consumption. Energy then sits underneath everything else, from chip manufacturing through to running those chips in the data centers behind modern med-tech.

Companies built for the resilience they could see

The industry did prepare. It prepared for the wrong layer. When large pharma organizations built their supply chains, Walker says, “they built it for resilience,” but that work was “really more around end-to-end visibility of the surface level products and SKUs in the supply chain, not the downstream dependencies, not the 70% of API that comes from India and China.”

West describes the same blind spot from the buyer’s side of the desk. Suppliers “see the first tier, meaning they know who they’re buying from face-to-face.” Below that the picture goes dark. “You don’t know if you’re buying it from the person across the street. You could be. And inevitably, you’re probably buying it from somebody overseas who has even more ripple down effects.” Mapping the tiers below the one in front of you is a discipline of its own, and it is where the exposure actually sits.

He cited a figure he hedged himself, attributing it to recent industry research: “only 3% of all pharmaceutical companies know their supply chain from end to end.” The direction is not in dispute, and it explains why the question of where US drug ingredients originate is still handled as a procurement detail rather than a strategic one.

This is not 2008 and it is not COVID

Both men separated this disruption from the two most recent ones, and the difference is intent. Here, Walker says, “you have adversaries that are looking at your supply chain with precision on where are the breakpoints. Not necessarily supply and demand.” A shock that hunts for the seam behaves nothing like a shock that removes capacity. “It’s a much different game that frankly our supply chains have not been architected for.”

The cyberattacks that landed on healthcare and water systems while the strait was closed were not new in kind, and that is West’s complaint. He walked back through a run of earlier intrusions on a water treatment plant, a pipeline, and a hospital system, and concluded: “that in and of itself should have woke up industry, and it didn’t, unfortunately.” Denying oil, in his read, is one vector among several, and Iran is not the only actor with the resources to work them.

That framing matches what the security side of the industry now reports. A state actor is after the shape of your science rather than a payout, and smaller companies draw that attention because of the newness of what they hold, not because they are easier to breach.

Health supply chains do not collapse, they erode

Walker’s sharpest point was about who absorbs the damage. “The patients are actually the biggest victim here,” he says, because a health supply chain is an act of coordination rather than a single component. Protective equipment, syringes, helium, devices: pull one and the effect cascades, quietly. “HLS supply chain doesn’t collapse. It erodes slowly.”

He pointed to a UK study of the 2008 financial crisis, chosen because enough time has passed to see the trend line. For each percentage point of unemployment the crisis caused, he says, researchers “saw an increase in diabetes, increase in cardiovascular disease as well and suicide.” Lose the job, lose the insurance, lose the access.

West added a correction that lands on a lot of contingency plans. An executive pointing at a full warehouse is not describing resilience. “That’s not supply chain risk. That’s just inventory management.” The inventory effects of a closed strait, he says, will not surface for months.

What Afghanistan and Ukraine taught him about who carries the risk

Asked what was immediate and what was irreversible when those supply chains fell, West took the irreversible half first, and his answer was allies. “In order to have an effective program overseas of any kind and let’s just talk about supply chain risk, you need allies.” In Afghanistan, and later running supply chain across Europe, he “really really leaned on my partners.” What worries him now is that partnership needs an incentive beyond a handshake, and often there is not one.

The lesson that transferred was a change in what he was counting. On deployment the job was throughput: “it was just push, push, push, mission, mission, mission.” Watching Ukraine from Europe inverted it. “I need this pen to get from A to B, but more importantly, I need somebody to carry this pen from A to B. How do I make sure that that person is safe?”

He maps that straight onto pharma. “At the very end of the day, we’re protecting people.” The people running a drug supply chain are not moving ordnance, and to his mind that raises the stakes rather than lowering them: “you’re pushing something more important. You’re pushing material that is making people better.”

The instinct is old. West went to Somalia with the Navy at nineteen, told on a Monday he was flying Thursday, an intelligence analyst off a carrier landing among Marines in Mogadishu. He describes people dying daily for want of a health system. “If anybody described hell on earth what it looked like, that was it.” He came back, he notes, and many did not. “I grew up really fast.”

Getting a boardroom to fund something boring

The obstacle is rarely disagreement. It is that the work reads as overhead. Companies, West says, “see it as insurance. Nobody…wants to pay, and insurance is boring.” His answer at the agency was a strategic plan short enough to be read, built on three pillars: “Enhance the supply chain risk acumen, train, and collaborate.” Roughly eight pages, opening with “pictures of the leadership saying that they supported it.” Everything the team did afterward tied back to one of the three.

Walker reaches the same place from the finance side, “essentially shamelessly stealing from bankers.” He treats each piece of the supply chain as an investment and scores it on risk-adjusted value, which puts the benefit and the exposure into one number a board already knows how to read. Presented as risk alone, he says, “folks’ eyes glaze over, you know, you’re viewed as the no person.” Framed as protection of a named revenue stream, the same request gets a budget.

The tabletop exercise that embarrasses people

West’s preferred teaching tool is a game. “Let’s play a game. Everybody likes to play a game,” he says, and “they learn while they’re playing a game.” Then a commercial client showed him what a game costs outside government. An exercise that surfaces vulnerabilities in a room also surfaces the people who own them. “You’re going to embarrass the person that owns that supply chain or owns that product.”

In the agency, he says, that had never crossed his mind. The adjustment was to open with questions designed to make people comfortable, and to change the posture: “don’t go in the game as like I’m going to hammer you, but I’m going to go in the game to help you.”

Walker described the same job with a different joke. Asked at a dinner party what he does for a living, he says, “I reply family counseling.” Century-old organizations carry politics, culture, and people who hear the same sentence differently. That emotional intelligence is not a layer on top of the technical work. It decides whether the technical work happens at all, because “you don’t want to call someone’s baby ugly.”

Two superpowers and one energy bill

Asked what Russia and China gain from the distraction, West framed Iran as a proxy conflict and pointed at the support that rarely makes the news: the “advice, counsel, and sustainment” flowing to Tehran. Anyone expecting Iran to run out of money is reading it wrong. The larger worry is the valve nobody has turned. If China restricts the precursors and critical minerals it dominates, he says, “that has a huge ripple effect to the health and welfare of our country.” His verdict: “that’s just a ticking time bomb.”

Walker took it to the technology race. “There’s only two superpowers in the AI race. And that’s the US and it’s China,” he says, and he expects it to turn on two inputs: compute and silicon, and energy. He ties the war directly to the second one. The first he locates somewhere else entirely, in a chip bottleneck he places in China, upstream of the data centers everything else runs on. Lost time there is not recovered later, and the gap is already measurable: China’s research funding passed that of the United States in 2025, for the first time.

What resilience means once the attacker automates

Resilience, as most companies practice it, is a reaction time. Traditionally, Walker says, the word has meant a “reactive framework” in which a disruption becomes visible and the response follows. True resilience means the hard decisions are already made: optionality built in, threats assessed proactively, the map drawn before it is needed. As AI matures, he says, “the attacks are going to significantly increase because we have the capability to do that now and in an automated fashion,” and restraint is not evenly distributed, since “there’s areas in the world where there’s not those same restrictions.”

West’s constraint is adoption. Supply chains were built years ago and then “layered and layered and layered,” a glass bridge that holds until conditions change, where the moment calls for a suspension bridge. The objection he actually hears when AI enters the conversation is not strategic. It is “am I still going to be able to go home at 4:00?”

His illustration of the gap came from a room he was pitching. Deep into an explanation of tracking cargo, an experienced hand went up: “What’s an AirTag?” The lesson stuck. “You got to go to the lowest common denominator and go up from there, not the top down.”

Walker scopes the same problem with a two-by-two, plotting what is strategically relevant against what carries the highest value. The quadrant to avoid is the one most pilots land in. “That bottom left-hand corner is the land of irrelevance. Yes, the technology worked, but it’s not helping anybody.” The output is a short list, not a program. “Maybe out of a thousand things that you do, really what you need to do immediately is 20 things right away, right now.”

Which returns to the lesson Walker says shaped his career, handed to him by a CIO after he had been three steps ahead of a room and lost it: “You have to think strategically, but act tactically.”