In partnership with
|
Your Time to Respond Just Got Shorter Attackers, regulators and AI partners are all moving faster than a validated IT shop was built for. Life Sciences CIO Weekly • Coverage: October 12 to October 18, 2026 Last week AI moved into the lab. This week the bigger story was the clock. Health-ISAC warned that AI now lets attackers find and use flaws in days, while many life sciences companies still change critical systems on a schedule measured in weeks. A Cisco email security flaw was under attack before most teams could act. The UK regulator said it will watch safety data in near real time. And more R&D moved onto partners’ platforms, as AstraZeneca, Zealand, Agilent and IQVIA each changed who holds sponsor data. Each of these shortens the time IT has to see a problem and answer for it. 🔍 The Quick Read
Reading something a colleague should see? Forward the whole edition or copy the section that fits their world. If this reached you from someone else, subscribe free here to get every edition, plus access to the back archive. 🤖 AI & DataTwo AI discovery deals put the partner’s platform at the center ↗In both, the AI partner does discovery on its own systems, and the sponsor takes over later. On October 15, AstraZeneca licensed insitro’s Virtual Human AI platform to find drug targets in MASH, a serious liver disease, and in heart muscle disease. insitro gets $40 million upfront and up to about $1.46 billion in milestones (AstraZeneca). A day earlier, Zealand Pharma signed a similar deal with Generate:Biomedicines for AI-designed obesity proteins, with $30 million upfront and close to $1.2 billion in milestones (Fierce Biotech). In both deals the partner runs discovery and design, then hands a candidate to the sponsor for clinical work. Most of the money rides on milestones, so it rides on that handoff going well. 💬 Joe’s Take: This is technology transfer, and the discipline hasn’t changed. Moving an analytical method from development into QC, a process from the pilot plant into manufacturing, or work from one company to another, the final report was never enough. You have to be able to reconstruct how the conclusions were reached and trace back every source of information behind the result. Ask your AI partners for the complete package that sits behind the deliverable. What to watch: What the contract says you get back at the handoff: the data, model versions and design reasoning, in formats your systems can keep for a regulatory filing. Agilent buys Proscia, the pathology software most big pharmas use ↗A tools company now owns the software that connects scanners, lab systems and AI in tissue analysis. On October 13, Agilent agreed to buy Proscia for up to $270 million: $240 million at closing and up to $30 million more in milestones (Agilent). Proscia’s software links slide scanners, lab systems, image-analysis tools and AI from many vendors, and it serves 16 of the 20 largest pharma companies. The deal is expected to close early in Agilent’s 2027 fiscal year. What to watch: The change-of-control terms in your Proscia contract, and whether the platform stays open to other vendors’ scanners and AI tools. Danaher and NVIDIA move AI into the instrument itself ↗A follow-on to last week’s autonomous lab news, this time about where the computing runs. On October 14, Danaher announced a collaboration with NVIDIA to build AI computing into its lab instruments, starting with a small set of priority products (Danaher). Danaher said customers will keep their choice of models and technology providers. No instruments, dates or financial terms were given. What to watch: Which model version produced an instrument’s result, and how on-instrument AI fits your validation and lab security plans. Iambic’s IPO opens strong, and its CEO sets a simple test ↗Investors are judging AI drug companies by what reaches the clinic. Iambic Therapeutics priced its IPO on October 14 at $16 a share, raising $150 million, and began trading on Nasdaq the next day. By Friday the shares were up more than 50% (BioPharma Dive). CEO Tom Miller said AI drug companies should be asked one question: “Are you converting it to medicines?” What to watch: The same question inside your company: which AI programs have moved a real candidate forward, faster or cheaper. ⚖️ Regulatory & PolicyUK regulator plans to watch safety data in near real time ↗The regulator may spot a safety signal in the data before the company does. On October 14, the Medicines and Healthcare products Regulatory Agency (MHRA) published its strategy to 2030 (GOV.UK). It promises “continuous, real-time safety assurance” using AI on real-world data, including data on drugs still in trials. It also plans an AI tool that checks clinical trial protocols before submission, a new Centre for AI and Digital Health, and a plan for AI in medicines development in 2027. This builds on last week’s news that the UK accepted all 44 recommendations of its AI commission. What to watch: Whether your drug safety systems can find and explain a signal as fast as a regulator watching the same data. EMA readies its first guidance paper on AI in clinical trials ↗It will be the first EU text on AI in trial design, patient selection and endpoint analysis. On October 14, the European Medicines Agency (EMA) published notes from an October 5 meeting with industry on AI (EMA). A concept paper on AI in clinical development is being finished for public comment. EMA also set up a group to coordinate AI guidance across the medicines lifecycle and is drafting general machine-learning principles. Nothing in the notes is binding yet. What to watch: The comment window. Map the AI tools your trial teams and CROs already use before it opens. FDA finds a contract lab recorded only some of its results ↗Sponsors own the integrity of the testing they outsource. FDA’s October 6 warning letter, posted October 13, covers Eurofins SF Analytical Laboratories’ contract testing lab in Horsham, Pennsylvania (FDA). Analysts left out “too numerous to count” results, logged cracked and dried-out plates as within limits, and had no second check on plates recorded as zero. One of those plates had a visible colony. The lab said the selective recording went back to February 2025, and FDA faulted it for not checking whether customers’ certified results were affected. The same batch of letters cited sterile makers in China and Korea and a research lab under GLP rules (RAPS). 💬 Joe’s Take: The CIO’s first move is to go to Quality leadership and offer to help make sure the company fully meets its obligations on every result this lab reported to it. That may mean joining Quality on an audit of the lab, because IT will ask a different set of questions. The review should go past the final reported results to the full set of captured, reduced and reported data. What comes out is a complete picture to take to the CEO and the rest of senior leadership. What to watch: Which of your products were tested there, and whether your quality agreements give you the right to review a lab’s raw data. Amgen-led study: shared cloud review could speed manufacturing changes ↗The payoff here is supply continuity. On October 13, RAPS reported on a study led by Amgen’s Nina Cauchon (RAPS). It argues that when regulators review a manufacturing change together on a shared cloud platform, approvals that now take years across all markets could move much faster. Today one country may approve a change while another delays it, which forces companies to keep different versions of the same product. In a survey of 391 industry professionals, nearly half named regulation as the main barrier to new technology. What to watch: Whether your regulatory systems could produce one structured global manufacturing dossier, the entry ticket for these pilots. FDA launches a rare disease framework ↗On October 14, FDA said it will build evidence standards for rare disease drugs condition by condition, with a public meeting on October 28 (BioPharma Dive). Expect more weight on registries and natural history data. What to watch: Whether your data and statistics teams are following the October 28 meeting. 🔒 Cybersecurity & RiskHealth-ISAC: AI-speed attacks make weeks-long fixes too slow ↗Attackers can now move faster than most validated systems are allowed to change. On October 15, Health-ISAC, the health sector’s threat-sharing group, published “Frontier AI Impacts,” based on tests of what today’s most advanced AI models can attack (Health-ISAC). Its headline: one in 18 models can complete a full attack chain. Its June white paper says health organizations must move from fixing flaws in weeks to responding in hours or days. About 80% of members are already raising budgets for AI security tools (white paper). In life sciences, many validated systems, lab instruments and plant systems can only change on a set schedule. 💬 Joe’s Take: The biggest lever here is IT and Quality leaders sitting down together to weigh two risks side by side: a cyberattack that takes down systems the company depends on, and a change made too fast to a validated system. Start with how your systems are classified. A risk-based look at quality SOPs and system classifications lets you keep full rigor where product quality is at stake and patch much faster where the risk is low. FDA’s Computer Software Assurance guidance, final since September 2025, already supports this kind of risk-based approach. This is a hard conversation, and it won’t be settled in a meeting or two that IT schedules for its own needs. It takes two leaders deciding together what’s best for the company. What to watch: An agreed fast path with Quality for urgent security fixes, and remediation deadlines in your key vendor contracts. Attackers hit a Cisco email security flaw before most teams could actThis week’s example of the speed problem. On October 14, Cisco disclosed that attackers were already exploiting a flaw in its Secure Email Gateway that can give them full control of the device (BleepingComputer). The Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of exploited flaws the same day, along with flaws in firewall management and backup software (CISA). Cisco told affected cloud customers to change their credentials. What to watch: Patch status on email gateways, firewall management and backup consoles, the kind of edge and recovery systems behind Boston Scientific’s August outage. Flaws found in Thermo Fisher sequencing software and an imaging archive ↗Lab servers often sit outside central IT’s patch process. On October 15, CISA issued two medical advisories. One covers Thermo Fisher’s Torrent Suite sequencing software, version 5.18 and earlier, where a signed-in user could read any file on the server. The fix is version 5.22 (CISA). The other covers six flaws in dcm4chee, an open-source imaging archive used in imaging trials and built into some devices. Version 5.35.2 fixes them (CISA). What to watch: Named owners for lab and research servers in your vulnerability program. Microsoft and Health-ISAC shut down three phishing services ↗Sector threat sharing made it possible. On October 14, Microsoft and Health-ISAC said they had seized the web domains behind three Chinese-language services that sold phishing kits and fake accounts (Microsoft). Since January, the services enabled more than a billion malicious messages aimed at more than 75,000 organizations, using templates that impersonated healthcare companies among others (Cybersecurity Dive). What to watch: Phishing-resistant sign-in for admin accounts. Takedowns like this rarely last. Ransomware groups list three medtech and pharma makers in one weekNone are confirmed, but manufacturers are a rising target. Between October 13 and 16, ransomware groups claimed Laerdal Medical and Topcon Healthcare (MedDevice Cyber) and Taiwan Otsuka Pharmaceutical, which two different groups listed (Ransomware.live). None of the companies has confirmed an attack. Comparitech counted 51 ransomware attacks on health sector manufacturers in the third quarter, up 28% (Comparitech). What to watch: Whether your threat monitoring covers claims against your subsidiaries, contract manufacturers and key suppliers. A fake Boston biotech conference was bait for ransomware ↗A website for “BioTold 2026,” billed for November in Boston, listed real speakers and sponsors who had nothing to do with it (Boston Business Journal). Proofpoint says the real goal was email invitations to speak or sponsor that led to malware. Law firm Foley Hoag advised warning scientists, executives and business development staff (Foley Hoag). What to watch: Speaker and sponsor invitations in your phishing training. 🎯 Leadership & Operating ModelMcKinsey: AI’s real cost includes the human review ↗Business cases that leave out review and validation will overstate returns. On October 14, McKinsey published “The AI value curve,” which counts the full cost of doing work with AI, including human review, validation and rework (McKinsey). It puts the annual global opportunity at $2.52 trillion. The best returns often come from helping skilled, higher-paid people do more. A 30% rise in AI costs would cut that value by 34%. McKinsey also found many companies track adoption, such as users and copilots, instead of value. 💬 Joe’s Take: CIOs are under real pressure from CEOs and competitors to move fast on AI, while still staffed and budgeted for the old job of keeping today’s systems running. Getting people trained is a sensible first step under those limits, but training counts and admin time saved are surface measures of progress. Define value up front with the system owners, the departments involved and the CFO’s team, using real measures like throughput across the pipeline and opportunity cost. And resist automating today’s processes with yesterday’s mindset. At this inflection point, moving faster is the smaller question. The bigger one is what we can now do that we couldn’t do before, and that’s where the value may be hiding. What to watch: Business cases tested against a 30% rise in AI costs before they reach the CFO. GSK ties up to 1,217 Belgian job cuts to digital and automation tools ↗When savings depend on automation, IT’s plan is part of the business case. On October 14, GSK confirmed plans to cut up to 1,217 roles at its three Belgian vaccine sites (Fierce Biotech). Reuters reported the company will streamline research, manufacturing and support “in part by using digital and automation tools” (BioSpace). The cuts are part of a three-year program targeting about $2.5 billion in annual savings by 2029, with nearly half expected from procurement. What to watch: Automation milestones and owners written down before the headcount goes. IQVIA standardizes its trials on Veeva’s software ↗On October 13, IQVIA, the largest contract research organization (CRO), said it will use Veeva’s apps for clinical trial management, trial master files, study startup and site connections as its standard across studies (Fierce Biotech). The two were longtime rivals until they settled a dispute in August 2025. What to watch: In your next CRO contract, who owns the trial records, how they transfer at study close, and who gets the AI features when the CRO holds the system. Gartner: CEOs are redesigning the operating model, including IT leadership ↗On October 16, Gartner updated its 2026 CEO survey analysis. It says CEOs are redesigning how their companies are organized to get value from AI, including “even technology leadership itself” (Gartner). Gartner’s IT Symposium runs this week in Orlando. What to watch: Your own proposal for how IT, data and digital should be organized, before 2027 plans lock. 💬 The Bottom Line — Joe’s TakeWhen response time becomes the constraint, look outside IT at organizations where minutes decide life or death. The battlefield and the ER run on triage. Most IT organizations are set up by function or role, and we ask the same people to react fast and to deliver long-term projects. That has always been inefficient, and few of us have ever had the staff to separate the two. In my CIO community we’ve been talking about reimagining how IT is organized, and this week’s news presses hard on exactly that. My challenge: step away from day-to-day operations with your leaders and principals, study how other disciplines organize for rapid response, and open your minds to a new way of working. Ready to move beyond the digest? The LS CIO Community is where these conversations continue. How this is made: each edition is researched two ways in parallel, once with Perplexity and once with Claude, then reconciled into a single verified brief before Joe adds his take. This digest is an interpretive summary of publicly available information and does not constitute legal, regulatory, cybersecurity, or investment advice. Until next week, Founder, Leadership Inklings |
AI research, explained in one morning email
Most of what shapes AI next year is sitting in a research paper today. Keeping up with them is a full-time job, and the abstracts don't help.
TLDR AI is the newsletter that does the translating. Each morning you get the handful of papers worth knowing about, curated by Anthropic and ex-Google engineers, with a plain-English summary of what they found and why it matters.
You come away smarter about AI research in the time it takes to finish your coffee.
Free, and delivered to 1.1M+ inboxes every morning.