Pharmaceuticals & Life Sciences
A medicine’s value lives in data that must stay secret for decades and records that must stay trustworthy for regulators. We test the labs, plants, clinical platforms and AI behind it — without breaking a validated system.
Book a ConsultationSecrecy and integrity, from the lab to the batch record
Discovery runs on lab instruments, research data platforms and AI; production runs on process control, batch records and quality systems; trials run on vendor-hosted clinical platforms that hold patient data. All of it is connected — to partners, CROs, CDMOs and the cloud — and much of it is validated, which makes it slow to change.
Regulators’ guidance now names security testing explicitly. ICH’s revised guideline for good clinical practice, in effect in the EU since July 2025, says security controls for clinical computer systems — penetration testing among them — should be considered. The EU’s draft revision of its GMP rules for computerised systems adds a full security section, including regular penetration testing of critical internet-facing systems. And NIS2 lists pharmaceutical manufacturing and medicinal-product research under health, one of its sectors of high criticality.
Formulas, trial data and manufacturing know-how stay valuable for decades — exactly the profile harvest-now, decrypt-later attacks target. And the same data now trains AI models, which makes its integrity as important as its secrecy.
Three services, tuned to GxP
Artificial Intelligence Security (AI-BOM)
Drug-discovery and trial-analytics models, the data they train on, and agents with access to lab, notebook or clinical systems. We test for data and model poisoning, leakage between partners’ datasets, and what an agent can be steered into changing.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across research data platforms, partner and CRO connections, clinical systems, electronic signatures on batch and quality records, and backups — ranked by how long the IP and trial data must stay confidential.
Learn more →Product Penetration Testing
Manufacturing OT and batch systems under our safety-gated Industrial / OT method; lab instruments and their controlling PCs, LIMS and electronic lab notebooks; clinical platforms — data capture, patient-reported outcomes, randomisation and trial apps — on test instances; and the cloud and partner connections behind them.
Learn more →Built for validated environments, not adapted from IT
Validation-aware
A security fix to a validated system goes through change control. We plan testing with QA and validation, use test and validation instances first, and sort every fix by whether it needs revalidation.
Integrity, not just secrecy
Audit trails, electronic signatures and access controls are tested as security controls — because an attacker who can quietly alter a batch record or a trial dataset does damage that confidentiality controls never see.
Legacy instruments, handled honestly
Many lab instruments run on controllers that only their vendor can update. We deliver segmentation and compensating controls you can apply, not findings nobody on site can fix.
Patient data minimised
Clinical systems are tested through test instances and synthetic data. Any patient or trial data we encounter is left in place and never extracted.
Where the rules stand, market by market
Pharma security is shaped by GxP data-integrity rules as much as by cybersecurity law — and both are changing. Current as of October 2026.
| Market | Instrument | What it means for you |
|---|---|---|
| European Union | NIS2 — Directive (EU) 2022/2555 | Research and development of medicinal products, and manufacturing of basic pharmaceutical products and preparations, are listed under health, a sector of high criticality. Chemical producers, and makers of electronic and optical equipment — where most lab-instrument makers sit — fall under its other critical sectors. Size thresholds apply. Binding through each Member State’s transposing law, which was due by 17 October 2024; amendments the Commission has proposed are not yet adopted. |
| European Union (draft) | EU GMP — revised Annex 11, Chapter 4 and new Annex 22 | Consulted on in 2025. Draft Annex 11 adds a security section — patching, segmentation, encrypted remote access, and penetration testing at regular intervals for critical internet-facing systems. Draft Annex 22 limits AI in critical GMP uses to static, deterministic models and excludes generative AI and large language models. None of the three is final; the January 2011 Annex 11 and Chapter 4 still apply. |
| Clinical trials | ICH E6(R3) — good clinical practice EMA computerised systems guideline (2023) | In effect in the EU since 23 July 2025: security controls for computerised systems — user authentication, patching, monitoring and penetration testing among them — should be considered, and security, backup and recovery measures periodically tested. Annex 2 takes effect in the EU on 15 January 2027. In the US, FDA issued the principles and Annex 1 as final guidance in September 2025. EMA’s 2023 guideline on computerised systems in clinical trials goes further and calls for penetration testing of internet-facing systems. |
| United States | 21 CFR Part 11 FDA data integrity guidance (2018) | Electronic records need validated systems, access limited to authorised individuals, and secure, time-stamped audit trails. FDA’s enforcement discretion on Part 11 does not extend to its access controls, which it still enforces. There is no sector-specific federal cybersecurity rule for drug makers today. |
| United States (proposed) | CIRCIA incident reporting | The 2024 proposal would require manufacturers of essential medicines to report substantial cyber incidents within 72 hours and ransom payments within 24. The final rule has not been published. |
| United States | Executive Order 14412 (June 2026) | Directs sector agencies and CISA to help critical infrastructure — healthcare and public health included — plan post-quantum migration, and CISA and NIST to publish minimum elements for a cryptographic bill of materials by March 2027. |
| European Union | Cyber Resilience Act — Reg (EU) 2024/2847 | Research-use-only and general laboratory instruments with digital elements are not in-vitro diagnostic devices, so the CRA applies to them: since 11 September 2026 their manufacturers have had to report actively exploited vulnerabilities and severe incidents, and the main obligations apply from 11 December 2027. CE-marked diagnostic instruments fall under the IVDR instead. |
| AI | EU AI Act Art 2(6) EMA reflection paper (2024) FDA–EMA AI principles (2026) | AI developed and put into service solely for scientific research and development is outside the AI Act — a commercial platform sold to others is not. EMA’s 2024 reflection paper and the joint FDA–EMA principles for AI in drug development (January 2026) set non-binding expectations; FDA’s guidance on AI in drug submissions is still a draft (January 2025). |
| United Kingdom | MHRA GxP data integrity guidance | Applies to GxP records across manufacturing, labs and trials. Pharma is not covered by the UK NIS Regulations, whose health sector covers only NHS and Health and Social Care bodies. |
| International | PIC/S PI 041-1 (2021) | Good practices for data management and integrity in GMP and GDP environments, shared across the participating inspectorates. |
| Post-quantum | No pharma-specific requirement | No pharma regulator has issued post-quantum guidance, and draft Annex 11 calls for encryption without naming algorithms. The general timelines on our PQC page are the reference points — and IP lifetimes bring the real deadline earlier. |
What you get
- Findings with GxP impact — each rated on patient safety, product quality, data integrity and IP exposure, with reproduction steps and fixes
- Remediation by change-control route — configuration, validated change, revalidation, or next system upgrade, so QA can plan it
- IP and data exposure map — where formulas, trial data and research datasets can leave, and to whom
- Cryptographic and AI bills of materials — research, clinical and manufacturing cryptography, and the AI in your pipeline, in CycloneDX format
- Two briefings — one for QA, validation and operations, one for security and leadership
Protect the data your pipeline is worth.
A pharma and life sciences engagement starts with your sites, your validated systems, and the regulators you answer to.
Get in Touch