Who Owns Cyber Risk at a Biotech? A Retired General Answers
The CEO is responsible for cybersecurity at a biotech, even one too small to hire a chief information security officer. That is the answer Chad Raduege, a retired U.S. Air Force brigadier general, gave when asked who is accountable at a 40-person company whose trial data is held by a contract research organization, whose process data is held by a contract manufacturer, and whose remaining data is held by cloud vendors. Tasks and infrastructure can be spread across partners and staff, he said, but someone has to accept the risk, and in his view that is the chief executive, supported by the leadership team and the board.
Raduege served 29 years in communications, IT and cyber operations, including command of the White House Communications Agency, and is now President of Cyber, Data & Communications at Elara Nova. He answered the question on Open Door Salon.
What should a biotech that cannot hire a CISO do first?
Make security part of how the company works. Raduege did not start with a hire:
I think it goes beyond just hiring the CISO. This really becomes a cultural thing for an organization as a whole.
He was candid about why that is hard. A young company is built around an idea, a technology and a small group of scientists, and security competes with everything else for attention:
Sometimes having the cybersecurity practices in place is the least of your ... it's low on the totem pole, if you will, of your priorities that you're trying to get after as a young founder.
Why doesn't a strong internal network solve the problem?
Because the company's data does not live only on its own network. Raduege described the old assumption, that a well-configured network and a few security professionals could lock everything down, and why it no longer holds:
The security perimeter now extends beyond just your company.
Data is stored with cloud providers and commercial internet service providers. Raduege added the business relationships that come with running a company:
Things like supply chain, things like transactional paths, things like money flows, all of those are things that are now opening the perimeter of your company to a broader application.
Each is an opening, and each belongs to a partner the company does not control. For a small biotech that outsources trials and manufacturing, most of its sensitive data may be held by partners.
Who is accountable when that data is spread across partners?
Lori Ellis pressed the point for a company whose trial data, process data and everything else are held by partners. Raduege drew on military command to answer. A commander can delegate a great deal, but not the acceptance of risk:
You can often distribute the infrastructure. You can often distribute the accountability ... but you have to accept the risk and really the CEO is responsible for pulling that together.
A CEO carries that out through the executives they hire and the board, he said. The same logic appears in U.S. securities regulation for public companies: the SEC's 2023 cybersecurity rules require registrants to describe management's role in cyber risk and the board's oversight of it. Most early biotechs are private and outside that rule, but the principle Raduege describes is the same.
What questions should a biotech CEO be asking?
Where the data is and who can reach it. Raduege was direct about the consequence of skipping that step:
If you're not asking questions about where is that data being stored and who can access that data, then I think you're in trouble.
For a company working with a CRO, a contract manufacturer and several cloud platforms, that means knowing which partner holds which data and what access each one has. He called the most critical of those assets the crown jewels. Identifying them is the work of crown jewel analysis.
Should the CISO be blamed after a breach?
Not by default, in Raduege's view. He said responsibility too often lands on the security or IT chief, and argued for asking what that person actually did:
Did the CISO or the CIO communicate to the board that they had concerns? Did they ask for additional funding?
He also asked whether they advised against a particular cloud provider or asked for a new technology to shore up defenses. His conclusion:
I don't think it's one individual that tends to or should be held accountable for this unless you're talking about the CEO.
Why are small biotechs worth an attacker's time?
Raduege said adversaries look for the easiest way in, and that healthcare is often seen that way. An earlier guest on this show made a complementary argument, that small biotechs draw attention because they hold the newest science. Investors add another route: in what hackers can do with a VC's due diligence data, Raduege explains how an investor's files can reveal which small companies lack security leadership. And in our look at the 2026 pharma cyberattacks, he describes adversaries probing an industry for its weak points.
Companies that want to reach the founders and executives who follow this conversation can learn about sponsoring Open Door Salon.
This post is drawn from the recorded, on-the-record conversation between Lori Ellis and Chad Raduege on Open Door Salon.