The end of the consulting firm

3 days into the cease-fire with Iran, it’s Friday and I’m back to dancing Gaga at the Suzanne Dalal Center.

It is a time to rebuild and I’m building what I think will become a new category:

Expert-led, agent-operated services.

The present

I spoke with an Israeli digital health VC recently.

I pointed out that none of their portfolio companies had cleared FDA.

He said:

“We don’t have to. It’s easier to skip the regulatory pathways.”

A few years ago, I would have argued.

About moats.
About clinical evidence.
About randomized trials.
About defensibility.

That was Danny 2.005.

The past

I left the rat race 21 years ago.

My secret sauce is less ambition.

I don't:

• Want to change the world.

• Raise VC

• Build the next unicorn.

• Be featured on any lists.

• Get the highest valuation.

Instead:

• I want to spend my time working on things I love with people I love

• I want to be able to travel wherever I want to, whenever I want to.

• I want to spend way more time with my friends and family.

• I want to spend more time playing music

• I want to stop doing things I don't like doing.

Thinking about what you actually want in life can force different behavior.
Take you down a different path.
A path towards living more intentionally.
Are you copying someone else's life?
Or designing your own?

Six months ago, I designed Danny 2.026.

The future

I’m building a new category:

Expert-led, agent-operated services.

The rule with new categories is simple:

If you can’t explain it to your grandmother, it’s not real.

So here goes.

The Bubbie Version

I studied physics.
I became a good programmer.

Then after working at big companies like Intel, I became an entrepreneur. 5 startups, 4 wins, 1 glorious loss.

Over 20 years, I helped 42 companies get through FDA.

Today, cybersecurity is part of treating patients.

So I built a business that helps companies pass FDA cybersecurity:

Fixed price.
Fixed time.
Fixed outcome.

Not hours.

Results - what people have always wanted.

Why Outcomes?

Why not talk about AI agents?

Because outcomes matter more than buzz.

AI agents are hot today.

FDA cybersecurity is:

• the gate to commercialization

• the difference between getting approved or not

• the difference between surviving post-deployment or not

What’s Changing

The executives I speak with aren’t looking for more cyber consultants.

They’re looking for cost-effectiveness and prioritization for their product and their company - not for a JnJ.

Ransomware and supply-chain attacks now shape procurement of medical devices.

FDA expectations are higher:

• more explicit guidance

• deeper technical review

• stricter documentation

The old model—teams billing hours—is breaking.

What I’m Building

OpenCRO is built on one idea:

One accountable expert where agents handle the execution.

I distilled 20 years into a system:

• Human workflow for judgment

• Agentic engine (“Pattern Factory”) for execution

Agents:

• write reports

• extract patterns and anti-patterns

• reason over causal flows

• generate threat models from user stories

The Shift

Consulting firms sell hours.

Software sells tools.

This model sells outcomes.

If You’re In This World

If you’re a MedTech leader navigating:

• FDA

• reimbursement

• commercialization

you already know how high the stakes are.

Drop me a note
or book time.

For more design patterns subscribe to Clear Thinking

Subscribe now

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Clinical trials are racing to cure cancer, defeat rare diseases, and bring life-saving treatments to patients — yet researchers are still scribbling data on paper diaries. It took 22 years for electronic data capture to become standard.

In this episode, I sit down with Kim Boericke, the new CEO of Veristat, one of the most data-driven CROs in the business. Kim brings 30 years of industry experience — from Quintiles to Icon to Thread Research — and a refreshingly clear-eyed vision for what needs to change.

We cover how Veristat is using AI to compress drug development timelines, why “write the label first” is the smartest protocol strategy nobody uses, and what the FDA’s new cybersecurity-as-quality guidance really means for sponsors.

Plus: the biggest anti-pattern holding the entire industry back — and why your online grocery order has better data infrastructure than most clinical trials.

Listen to the show here

Outcompete online grocery shopping

I can’t fix your clinical data management plan, but I can fix your cyber and privacy if you want to protect patients and your reputation.

I’m doing a free gap analysis with 10 CEOs this quarter.

Read this before our call - OpenCRO risk framework

The 7-step risk analysis loop and prioritized, cost-effective countermeasure plans built for regulated software.

For more strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

My guest this week was Josh Haimson, co-founder and CEO of Inductive Bio.

Josh built a career in AI for drug discovery and biopharma research

• He started at MIT: machine learning for surgical intervention predictions using medical records

• At Flat Iron Health: he built AI/ML teams for oncology data analysis across hundreds of millions of medical records

• After the Roche/Genentech acquisition: he ran the AI group inside the Roche drug discovery organization.

• Left Roche to start Inductive after identifying ADMET optimization opportunities

I asked Josh, “So what is ADMET exactly”?

Josh, “ADMET (Absorption, Distribution, Metabolism, Excretion, Toxicity) is everything a drug needs to do in the body besides cure the disease”.

It’s one of the biggest bottlenecks in pharma — a grueling 4-5 year process of making thousands of molecules, one iteration at a time.

Inductive Bio built virtual chemistry labs where AI scientists explore millions of hypotheses overnight. The result? That 4-5 year timeline collapses to 1-2 years, with higher quality molecules and better odds in the clinic.

Their secret weapon: a pre-competitive data consortium where pharma companies pool ADMET data — not out of altruism, but because it’s the smartest business decision they can make.

The Industry anti-pattern

But here’s Josh’s warning to the industry: stop believing too much in the AI hype. Biology is still deeply incomplete. No AI spits out a perfect molecule. The real wins come from tight feedback loops, good data, and radical honesty about what we don’t yet know.

Listen to the show here

Visit Inductive Bio here

Before FDA and before the attack

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies.
0 rework requests.
Walmart Vision.

Fixed price. Fixed outcome.

Most MedTech teams think cybersecurity is documentation.

It’s not.

It’s whether you clear FDA
and how you survive the day after an attack.

I’ll review your current cyber and privacy position
and show you where FDA and attackers will push.

No charge.

Start here before we talk
Business Threat Modeling Framework (free, CC license)
→ Download

For strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

Photo by Designecologist

Join other smart people who absolutely love my writing today.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Security blankets and security checklists

Intro

I once did a PCI-DSS compliance audit for a provider doing healthcare payments.

The IT Security lead asked me, “Do you have a checklist?”

I said, “No.”

He said, “Previous security company had an Excel.”

I said, “Good for them. I don’t.”

He said, “Yeah, well, that Excel was like 5 years old anyhow. Way out of date for today’s exploits.”

I said, “Exactly. I deliver outcomes you want today, not 5 year old checklists.”

We did the audit in 3 days. Fixed price. Fixed time. Fixed outcomes.

The stakes are higher in hospitals

That was payments. This is patient safety.

In medical devices that go into hospitals, the stakes are patient lives and the checklist has a different name.

They call it a risk model of patient safety.

And here’s what happens to it after FDA submission.

Your consultant worries that sharing vulnerabilities could expose failed controls, unmitigated attack surfaces, or security gaps they couldn’t close.

Transparency may hurt their next sale — or hand ammunition to competitors.

Consultant culture is project-focused.

Get the contract. Deliver the document. Move on.

The best-practice solution to avoiding accountability is to encourage the industry to trash risk analysis after submission — so nobody can see their dirty laundry.

And that includes FDA.

Free gap analysis

I’m an entrepreneur. Writer. Podcast host. Musician. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. Fortune 1 company. 0 rework requests.

If you’re heading into an FDA submission in the next 6–12 months, I’ll review where you stand at no charge.

The OpenCRO risk framework: BusinessThreatModeling.pdf

7-step risk analysis loop. Prioritized, cost-effective countermeasures. Built for regulated software. Fixed price. Fixed outcome.

Book a free gap analysis

For more strategic patterns on defending your operation:

Subscribe now

Photo by cottonbro studio

Join other smart people who absolutely love my writing today.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Introduction

This piece was inspired by a customer I once had.

When a non-technical person leads a project with highly technical people, you get an anti-design pattern: BlindLeadingTheBlind.

Giganet Health exploits BlindLeadingTheBlind in order to close a big deal with their first large account, LA County and buy time to fix security vulnerabilities.

Giganet Health

Iris felt sleepy and was in a bad mood.

Bob and Barry walked into the Venice studio apartment to show her their plan. “Get a corkscrew”, Bob said, and pulled a bottle of wine out of his backpack. “This is a time to celebrate! I know how we can deliver the system on time to LA County. This is the real thing. Let’s drink to it!”

Bob looks over at Barry, Italian gangster look, polo shirt, slacks, tasseled loafers. Barry poured them some wine and raised his glass - “Alla vita, alle ricchezze e al buon vino”. Bob’s face was lit up, “Happiness is inspiration. Let’s drink to it! This is a turning point for Giganet”.

Pesya, their jolly hacker matriarch, slightly overweight, always laughing, always thinking about going to the gym; had discovered vulnerabilities in the Giganet system with $25M in exposure to fines for CCPA privacy violations.

Iris thinks back to their conversation last week:

Pesya, “Iris, You cannot release the system like this to LA County.

In addition to the DDOS vulnerabilities, there are XSS vulnerabilities. Attackers may be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. You will be in violation of CCPA.

CCPA penalties have an upper cap of $7,500 per intentional violation or $2,500 per non-intentional violation. It may seem like a small penalty, but it can eventually grow massive. The penalties can quickly add up because one consumer equals one violation.

Pesya, “How many users will LA County have?” Iris replies, “About 10,000 users”.

Pesya, “You have $25M in exposure”. She deliberately uses the word exposure with Iris so that Iris will understand financial impact.

“We’ll need another 4 weeks for security testing and validation after Lena and Justin finish. Yasmin’s back end module is not affected and the rest of the front-end is fine. You need to allow 12-13 weeks to fix this problem”.

Giganet has a delivery milestone in a week with LA County, their first large account. The revenue and reputation are critical to Giganet survival. They don’t have 12-13 weeks. They need the cash.

Iris, “OK, guys, what’s the plan?”

Barry, “Bob, it’s your idea, so go ahead”.

Bob, “Pesya knows their security consultant. Noah Cheng was one of her hacker apprentices. She’ll talk to him, and that will be enough”.

Iris poured herself some more wine and drank. She had remarkably beautiful hands - slim, white and smooth, fingers delicately pointed.

Iris, “Is this legal?”

Bob, “Totally. Remember how I told you that the best defense is a good offense?

We release the software to the customer on time, get the milestone payment and find a way for the customer to not actually use the software. We’ll do that with their own bureaucracy.

Noah will explain to the customer project manager that even though Giganet is CCPA compliant, they need to set up application firewall rules to limit internal network access for HR”..

Iris, “That doesn’t sound like a lot of work to me, maybe 2-3 days”.

Bob, “You’re right, it’s 3 days work but it will take them 4 months. Watch and weep”.

ISD - Internal Services Department Information Technology Service

Todd Jameson is project manager for rolling out new Web applications in LA County.

Todd works for Dell Technologies Services and is onsite with ISD Information Technology Service. He came up through the ranks as an analyst and project manager at Perot Data Services and after the acquisition and name change, stayed with Dell.

He’s been with LA County for 12 years.

If you were to ask Todd, he would say he is a “technology leader”.

A technology leader that spends his time in meetings and tracking projects.

A technocrat dedicated to budgets and vendor management.

He likes reading Gartner reports to follow broad tech trends. Lately, with the outburst of AI, he’s started talking to vendors. Talking to vendors on the Gartner hype list can turn into a full time job but it’s more interesting than meetings with his change control board.

He has a 9:00 meeting with Noah Cheng, their cybersecurity consultant for web application development.

Todd, “Hey, Noah. I wanted to touch base with you regarding our upcoming deployment of the new Giganet SaaS application. How’s everything going on the security front?”

Noah, “Security is Dope, man. You know their engineering team are ex-Google executives and their CSO is Pesya Eichbaum. She’s number 1 in the world for browser security.

However, as I dive deeper into the Giganet architecture and potential vulnerabilities, I believe that having an application firewall for HR access is a proactive measure to mitigate potential risks to your network. It’ll add an extra layer of protection against any unforeseen threats. You can use your existing F5 firewall”.

Todd, “I don’t understand the technical side but I don’t want to compromise on security. Can you give me a plan?”

Noah, “Of course, Todd. I’ll prepare a comprehensive proposal with time estimates, potential benefits, and a deployment plan. I’ll make sure to highlight the added security and potential risk reduction it brings to the table”.

Todd, “ Great, Noah. Please keep me in the loop as you work on this proposal. We want to make sure we’re making informed decisions about our security measures”.

Noah, “Will do, Todd. I’ll get started on that right away and will keep you updated as I make progress. If you have any immediate questions or concerns, don’t hesitate to reach out.

Todd, “Thanks, Noah. I appreciate your dedication to our project’s security”.

After the meeting Noah calls Pesya.

Pesya, “How did it go?”

Noah, “Nailed it, I just bought you 4 months. It’ll take me a month to prepare the proposal, it’ll take Todd another month to get it past his internal review committee, it’ll take them another 2 months to implement. In the meantime, you’re good to go with HR for the delivery milestone”.

The Blind Leading The Blind Anti-Pattern

This anti-pattern is created when a non-technical person leads a project with technical people.

This anti-pattern is created by a project manager who leads with laundry lists, turf management and organizational politics. She’s often regarded as a nuisance by the technical people. Even though her intentions are good, the results are often negative as the team gets bogged down in details and changes, causing additional problems.

The organization moves slowly, often without a sense of strategic direction that is integrated with business strategy.

Solution

Flip the pyramid.

People who actually understand and develop technology work best in small autonomous teams creating things.

The LA County example works in an inverted way: Todd, the project manager, provides technical requirements to his internal information security team for implementation. His internal infosec team doesn’t have the business context or understanding that the Giganet system can save millions of dollars. They don’t care, and given competing priorities, they may keep the project back.

About Giganet

Giganet Health is a Digital health startup based in Venice, California. The founders are industry veterans that worked at Silicon Valley tech companies.

Giganet uses agentic AI and the Apple Watch to monitor and relieve work-related stress as part of a holistic program that empowers people to own their own good health and reduce doctor visits by up to 83%.

Their customers are large employers in California.

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. Fortune 1 company. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library - a steal at $150.

Subscribe now

It’s not every day my guest is a founder and Olympic athlete.

Simon is a two-time pole-vault Olympian and seven-time founder who came to the US from Australia on an athletic scholarship at the University of New Mexico.

And the rest is history.

What really struck me wasn’t the medals or the exits — it was how willing he is to call bullshit on the way our industry “has always worked.”

Simon’s new company, Ryght.ai, is taking a flamethrower to the slowest, most fragile part of clinical development: site selection and activation.

Instead of begging for EMR integrations and pretending that “lots of patients” is a real strategy, they’ve built digital twins for 100,000+ sites in 192 countries, then layered on agentic AI to find, rank, and activate the right sites and PIs in days, not months.

In reality, EMR data is one noisy variable among many — and often the least interesting one. Site incentives, operational capacity, competing studies, PI conflicts, regulatory history: these are where trials live or die. Focusing on EMR first is like judging a pole vaulter by their warmup jog.

In this episode of Life Sciences Today, we dig into how Ryght.ai works, why enrollment failure is mostly a site problem, and what happens when you design with AI from first principles instead of bolting it onto legacy workflows.

Listen here Beyond the EMR: Simon Arkell Rewires Clinical Trials – Life Sciences Today Podcast Episode 53

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

Quote courtesy of Jim McCarthy, Dynamics of Software Development

Intro

When you were a kid, did you ever tell your mom,
“Dad already agreed…”

And your sister would go to your dad,
“Mom’s letting Danny stay home from school—why can’t I?”

If you played it right, the 2 of you got away with murder.

Today, writing software is a family affair with two parents: human and AI.

Software is written in a dialog between them.

The dialog between machines and humans started 200 years before ChatGPT.

Charles Babbage designed his Analytical Engine in 1837. It was never built, but Ada Lovelace wrote a program for it in 1843. Ada was a colorful character, daughter of Lord Byron, directed by her mother to learn science and mathematics.

Looking at her program, it is surprisingly close to what we do today.

Loops. Named variables. Structure.

But Ada saw something deeper.

She imagined machines that could do more than compute — write music, manipulate symbols, process abstract ideas.

Great software comes from that fusion.

Today, great software fuses human intent, taste and judgment in a dialog with AI execution, expansion, and iteration.

Today, I’ll show you how that fusion works in practice:

• One case where the human dominates

• One case where the AI dominates

Great software has two parents

In the past year, I’ve spent less time writing code and more time writing specifications for AI.

I can ask Warp Code if the model is a good fit for the job—and get an intelligent answer.

Here’s what that looks like in practice:

/agent what model are we using

You’re using Claude 3.5 Haiku.

for an application to plan tax-optimized liquidation of stocks and optimized lots should I use a different model?

No, Claude 3.5 Haiku is capable of handling tax-optimized stock liquidation planning. It can work with:

• Tax lot identification strategies (FIFO, LIFO, highest cost, specific ID)

• Capital gains calculations (short-term vs long-term)

• Tax-loss harvesting logic

For a production application, the main considerations are:

1. Accuracy over speed: Ensure thorough validation of tax calculations and compliance rules

2. User responsibility: Include disclaimers that users should consult a tax professional

3. Data security: Handle sensitive financial data securely (encrypted storage, HTTPS, etc.)

4. Testing: Comprehensive test cases for various scenarios and edge cases

Haiku is suitable because the model isn’t the bottleneck for this type of application—careful implementation of tax logic and thorough testing are what matter most. If you need real-time processing of large datasets or complex multi-step reasoning chains, you might consider a more capable model, but for typical tax planning workflows, Haiku works well.

Notice what’s happening here: I’m not writing code. I’m interrogating the model, validating assumptions, and testing the system design alternatives.

The first coders were mathematicians.

In the 70s, the systems analyst emerged—someone who spoke with users and wrote specifications for coders.

As programming languages evolved, people became ‘programmers’ and expanded their activities into design, code and communication with other humans.

A great programmer is great at design, code and communications.

If that sounds hard - it is.

In 2022, with the launch of ChatGPT that changed again.

AI reset the division of labor between humans and machines.

But it’s more complex than that.

In the next section - I break down human and AI work.

Humans and AI - the division of labor

There are 2 kinds of activities in writing software - human-facing and AI-facing.

Human-facing activities

1. Stakeholder alignment - getting other people to agree with you and support your project

2. Market discovery - discovering if other people will use your product

3. Business tradeoffs - buy vs. build, do-nothing vs. do-something

4. Regulatory strategy (healthcare, MedTech, drug development, energy …) - how do you thread the needle with the regulator? FDA Cyber regulation for medical devices requires traceability of cyber testing and explanation how a control has been tested and validated to work.

5. Business model validation - understanding from other people if they want your product, when they’ll want it and how much they’d pay

6. Capital allocation - getting other people to fund your project

AI-facing activities

1. Code generation - prompting the LLM to generate code for your task. Emphasis here on you focusing on the desired outcome in your prompt. Specifically -
   
   Write a very specific story of the outcome you want and need

   Do not be tempted to talk about the process, the how, your ideas - let the AI decide how.
   Front-load your critical constraints - in time, money and results
   🔥Every ambiguity = risk on fire
   

2. Test generation - the latest AI models figure this out and often suggest tests

3. Build pipelines - with memory the AI model usually knows how to do this

4. DevOps - prompt the AI for what you need - this is a lot like code generation activities

5. Refactoring - an area where AI is exceedingly better than humans, although when it gets it wrong, it gets it very wrong.

6. Static analysis - like refactoring

Is the dialog ever equal?

It depends.

In personal productivity applications - AI dominates. In enterprise systems - humans dominate.

Let’s see why.

Does AI eliminate programmers?

The short answer is no.

In personal productivity applications (e.g. writing social media posts, or filing invoices from your email), the human cost of prompting is low and the payoff is high for AI agents to do the work:

• You make your own tradeoffs

• You write specs, AI writes code

• You can (and usually) ignore risk

In enterprise systems (e.g. airline reservations systems or healthcare information systems), the human cost is high, relative to the cost of AI tokens. You need to execute all 6 of the human-facing activities, often over long periods of time to sustain your project.

• You don’t make tradeoffs alone inside the enterprise. You need organizational politics to get buy-in for your idea.

• You need to align with other humans, comply, and document

• You need funding

• You cannot ignore cyber and privacy risk, internal data governance and industry and regional regulations.

In enterprise systems, humans lead the dialog.
In personal productivity apps, AI leads the dialog.

Like when you were a kid with your parents, there is a division of dialog.

In my family, my Dad led the dialog on science and my Mom led on homework.

We’ll close the essay with some thoughts on software risk for AI-human software development.

AI prompting for risk analysis in software development

How will AI-human teams create secure software?

I will go into more detail in a future essay but here’s a teaser.

Parallel to the AI-human build dialog, we need to conduct an AI-human attack dialog.

And not wait for the FDA to remind us about cybersecurity.

Outro

Ada Lovelace died in 1852. Her name lives on in the Ada programming language, designed in the 70’s for the U.S. DoD for safety-critical, embedded software.

It’s still used today in defense and aerospace where failure is not an option.

Every year on the second Tuesday in October, the contributions of women to science, technology, engineering, and mathematics (STEM) are celebrated on Ada Lovelace Day.

Let’s celebrate Ada Lovelace today for her incredible vision fusing human creativity with machine computation.

We’re still learning how to build that partnership.

It sounds like the beginning of a story - and it is.

Asta and Chris were my guests on the podcast recently.

They are based in Dubai and they are building a startup that provides imaging from radiology scans to train AI models.

Their twist ?

They provide the images as ‘infrastructure as a service ‘ for countries.

In the US, it’s almost impossible to get non-US data and outside the US, its almost impossible to get US data. Countries have their own privacy regulation and country level data security requirements.

And that’s where Medsyntra come in.

Chris is a radiology software veteran and Asta is a entrepreneur. And because they’re not locked into the US healthcare system mentality - they decided to develop a country level platform for AI developers.

In Episode 52 of Life Sciences Today, we sat down to talk about what it actually takes to build global medical imaging infrastructure for clinical AI.

Medsyntra aggregates and de-identifies millions of imaging studies across radiology, pathology, oncology, and women’s healthcare — ethically sourced, sovereignty-respecting, and annotation-ready. That’s harder than it sounds.

Chris and Asta don’t sugarcoat where the tradeoffs bite.

We covered the questions most AI teams avoid: Why do models trained on one population quietly degrade when deployed in another? What does data sovereignty actually cost you when you’re trying to build global intelligence? And is “ethical data” a real standard — or a marketing layer over bad practices?

One thread I kept coming back to: the difference between assembling a dataset and building infrastructure. Chris and Asta crossed that line early, and the decisions they made at that fork still shape how Medsyntra operates today.

We also got into annotation — the bottleneck nobody budgets for — and the anti-patterns Asta sees repeated across the medical AI ecosystem, often by teams that should know better.

If you’re building AI for clinical use, or advising companies that are, this episode will reframe where you put your attention.

🎧 Listen now

Visit Medsyntra here

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

I originally wrote this piece 2 years ago. It was the design-pattern that closed my series on substack - “Bob and Alice - Anti-Design Patterns in Life, Love and Tech”.

The last chapter in Bob and Alice, was called Hezbollah is here - which is familiar to Israelis as we go into season 3 with Iran - or is it season 5? I’m not sure.

My substack series turned into a book on Amazon - Bob and Alice - an anti-love story.

I get a check every so often from Amazon from people who buy the book. Amazing.

Hint. Hint.

I did the cover graphic with ChatGPT 3.5. I kind of like it a lot.

Happy with what you know or overloaded by work?

Life, love and tech require constant learning, yet we are often happy with what we already know or overloaded by the work we already have - and left with no energy at the end of the day to learn new things.

This 10-part design pattern was inspired by my friends and co-workers - the people who served as the role models for characters in the series and in the book - Alice, Bob, Pesya, Yasmin, Mark and the rest of the team at Giganet. The names have been changed but the people are real.

My thanks to you all for teaching me how to learn.

10 things you should learn about learning

1. Your memory is not digital
   Fetching a memory strengthens and modifies that memory.
   
   When you try to remember something, activation energy spreads to all the connected pathways in your brain, like heat from a fire.
   
   Some of the activation energy leaves related pathways primed for more activation for hours.

2. Your memory is not continuous - it’s made of chunks
   Long-term memory is limitless, like a disk with an infinite amount of storage.
   Working memory serves general intelligence. It’s limited and can be trained like professional musicians who practice 10 hours/day.
   
   The brain works on information in chunks.
   
   Reduce your cognitive load by getting rid of irrelevant data and by organizing it in an easy-to-use format - like a table instead of wordy content.
   
   When you learn new things, you can improve your performance by chunking and reorganizing the task.
   
   This is really important when you’re learning a new skill or a new language.

3. Experts recognize, beginners reason
   Experts have seen it all before.
   
   They recognize and remember the patterns that helped them succeed in the past and the anti-patterns that led them to failure.
   
   This happens in less than a second.
   
   Experts can figure things out because they memorized the pattern from experience.
   
   This pattern-matching gives you superpowers in your field of expertise - be it code, marketing or whatever.
   
   Beginners need to see examples and figure things out.
   
   It’s a process that can take hours or days and beginners usually get it wrong.

4. When you learn, the brain flips back and forth from concrete to abstract
   Experts rely on generic and abstract patterns, and don’t need to worry about details.
   
   Beginners get stuck in details and have trouble connecting to the big picture.
   
   When you learn a new concept (like AI agents), your brain switches between an abstract idea (autonomy) with concrete examples (agents reading your email and filing supplier invoices).
   
   The more examples, the better. Mistakes are good. This process in the brain is called unpacking.
   
   You learn better when you flip back to examples from the abstract pattern. This is called repacking.
   
   The more you learn abstract patterns, the more concrete they become for you.

5. Spacing and repetition matters
   To learn something new and get really good at it (like playing the flute), you need to learn how to do it with a lot of repetitions and with breaks between each learning session.
   
   You cannot “just do it”. You are not Nike nor MJ
   
   Each little learning session, each little debug session helps you get better.
   
   Cramming for the test never worked in school and doesn’t work for any learning objective.

6. AI does not obsolete learning
   We learn by making connections between stuff in our brain.
   
   This creates a deep understanding of what stuff means and how to use it.
   
   Once memorized, you can retrieve a problem and the solution in a milli-second.
   
   With AI, you need to write a prompt, try it out a few times and then modify it for your needs.
   
   You won’t remember the solution because you didn’t learn it yourself; you copied and pasted.
   
   And it’s much slower than your brain

7. Problem-solving is not a generic skill
   Almost all of our generic skills are far worse than domain-specific problem solving.
   
   Our generic understanding of selling something is almost irrelevant for a specific domain like agentic AI.

8. Experts can sell you stuff but they can’t jack into your mind

It is almost impossible for an expert to jack into your mental model if you are a beginner.

You will probably fail if you buy a course online from a large account on social media.

9. Predictors of success in any given discipline are bad
   Success of learning a new discipline like copy-writing is a mix of your aptitude and your learning process.
   Some people believe that a natural gift is enough.
   Others say that practice and systems are enough.
   
   Both groups are wrong.
   
   It’s impossible to predict who will be a good programmer|copy-writer|marketer | salesman | manager.
   
   Smart people are not always good programmers. Good programmers are not always the smartest.

10. Your mindset matters to your success but not like you think
    There are people who believe in a growth mindset. Practice long enough and believe in your success and success, wealth and happiness will come.
    
    Other people believe in a fixed mindset and aptitude. If you struggle with success in developing Agentic AI apps, it means that you are not cut out for it.
    
    Both groups are wrong.
    
    For example - anyone can learn some basic physics but only 1 person/year out of 7.8 BN people gets the Nobel Prize in Physics.
    
    Rewarding a growth mindset for effort doesn’t work either
    
    People are not stupid - they know when they are working hard and not getting results.
    
    Rewards should be focused on achieving goals.

Summary

• Improve your learning skills all the time. Work with a person who keeps you accountable.

• There are no fixed rules about who is good at something be it leadership, music or marketing

• Read a lot of code to be a better programmer. Read a lot of copy to be a better copy-writer

• Experts are bad at training beginners

• Spending time away from a problem can help solve it.

• Using AI does not make you an expert. You still need to learn and develop the deep memories and patterns in your brain.

• Believe in your ability to change your abilities

• Seeking to succeed is better than seeking to avoid failure.

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber. After working with 42 MedTech companies and 14 FDA clearances on cyber and privacy projects - I decided to create boutique offer for medical device companies who care about their patients, their clinical data and their reputation.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

My guest this week on Life Sciences Today was Erez Lampert, founder and CEO of Pathkeeper Surgical. PathKeeper Surgical is changing spine surgery for 1M Americans

Erez Lampert already changed one field of medicine by leading development of Invisalign’s iTero 3D scanner. In this episode of Life Sciences Today, he explains how he’s now taking on spine surgery with Pathkeeper, a 3D imaging + AI navigation system designed to stop surgeons from “flying blind” in some of the most delicate procedures in medicine.

Erez breaks down the impossible choice spine surgeons face today: either low‑cost fluoroscopy with continuous radiation and guesswork in 2D, or ultra‑expensive robotics that slow workflow and demand huge capital and infrastructure. Pathkeeper offers a third option: optical 3D guidance with no radiation, no million‑dollar robot, and a workflow designed around how surgeons actually operate.

We dive into Pathkeeper’s business model and why the real leverage sits in the $10B US spine implant market, where navigation can be the “razor” that drives recurring “blade” revenue for implant partners. Erez also walks through the multi‑year grind behind two critical US deals: distribution via High Ridge Medical (Zimmer Biomet spine) and broad hospital access through Vizient.

Along the way, we puncture the myth that “Israelis don’t know how to sell in the US” and talk about the real anti‑patterns holding medtech back.

Listen to the show here

Visit PathKeeper Surgical here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber.
42 MedTech companies. 14 FDA clearances. 0 rework requests on threat model submissions.

You have threats to your patients, your clinical data, your reputation.

You shouldn’t be discovering your cybersecurity gaps during FDA review.

We find them first, document them the way FDA reviewers expect — and deliver to you a cost-effective, prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

Today is a landmark - episode 50 of Life Sciences Today! Less than 9 months in - the show is on fire. If you are TechBio founder, I’d love to host you on the show. Reply or DM me and we’ll make it happen.

My guest this week was Kiril Pevsner, CTO and co-founder of ProtAI.

In this Life Sciences Today episode, I spoke with Kiril, CTO and co-founder of ProtAI, an Israel-based biotech developing drugs for cancer and autoimmune disease. ProtAI’s AMES platform combines structural proteomics with AI, using experimental “geometrical clues” to refine protein structures down to subatomic resolution. That extra precision lets them design small molecules for targets that were previously considered “undruggable.”

Crucially, ProtAI is not a “tools” company. Like Dafna Koller’s Insitro, they chose to own the drug pipeline, not just sell the platform. Their lead program targets estrogen receptors–positive breast cancer. For a completely novel mechanism with little prior data, they reached a near–development candidate in under 12 months—vs ~3 years by industry standards—and plan to enter the clinic in 2026 in the US and Israel.

Kiril’s biggest “anti–design pattern” in AI drug discovery:

Overhyping the AI itself. Pharma doesn’t buy models; they buy de‑risked drugs backed by hard data. Trust comes from experimental validation, fast iteration cycles, and clinical results—not from glossy benchmarks.

Listen in to learn how ProtAI thinks about moats, data, trust, and why speed of learning is the real superpower in AI-driven drug discovery.

Visit ProAI here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber. 42 MedTech companies. 14 FDA clearances. 0 rework requests on threat model submissions.

You have threats to your patients, your clinical data, your reputation, your commercial operation, and your engineering roadmap

You shouldn’t be discovering your cybersecurity gaps during FDA review.

We find them first, document them the way FDA reviewers expect — and deliver to you a cost-effective, prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Courtesy of Pixabay

Intro

Today I’m launching OpenCRO — Specializing in Cybersecurity for the MedTech CEO.

It’s been a journey. 20 years. 42 MedTech companies. 14 FDA clearances. 1 De Novo world speed record.

After conversations with many of you over the past 3 months about why MedTech companies die, I decided to do something about it.

Fixed price. Fixed time. Fixed outcome. Not hours. In a post-management consulting world, that’s the new delivery standard.

Why FDA Cyber first? And not an AI-agent story?

Because the outcome is far more important than the buzz.

AI-agents are hot today. FDA Cyber is the gate to your commercialization tomorrow — and the robustness of your security countermeasures the day after.

Ransomware and supply-chain attacks shape how hospitals evaluate device vendors. FDA guidance is more explicit, documentation expectations are higher, review questions are deeper and more technical.

I built OpenCRO with my expertise in the security and privacy space in medical devices/software as a medical device/digital therapeutics/AI-based diagnostics and consumer digital health applications. I was inspired by Practical Threat Analysis, a Microsoft desktop tool that we used at Open Solutions, my security and privacy consultancy back in the day.

OpenCRO integrates a human workflow and an agentic-AI engine I call the Pattern Factory. Pattern Factory agents write reports, extract design patterns and anti-design patterns from content, reasoning over causal flows. Other agents generate threat models from user stories.

In this essay, I describe a debrief of the first mission that OpenCRO executed in January 2026.

Mission Objective

Deliver FDA Cyber threat analysis compliant with 2026 guidance, on time, without regulatory deficiency.

Outcome

Delivered on time. No known structural deficiencies. 11 iterations required.

Cost

1. 2 hours in workshop with customer writing cards

2. 4 hours of model iterations

3. 2 hours in RA/QA manager review

4. 3 hours in FDA reviewer simulation.

5. 9 hours of rework.

What happened (Facts/data)

1. A customer contracted with OpenCRO to perform an FDA Cyber threat analysis for their electrophysiology lab system.

2. We performed a IRL data collection workshop with the team, where they wrote down risk scenarios on paper cards

3. Paper cards were scanned and converted into a user story in markdown format.

4. The Pattern Factory agents generated a threat model from the story.

5. The process worked reliably and took about 30s to populate the threat master tables and relationships in an iteration.

6. I wrote a spec, and the Pattern Factory agents generated the reports (manually imported into Google sheets and linked into the google doc of the report).

7. I discovered a number of weaknesses in my process and in the code. The report went through 11 iterations with 3 iterations of review using 2 language models (chat and Claude) in simulated roles of FDA reviewers. The final report was released on time and is labeled V4.

We’re using Markdown to write stories like this to make it easy for the agents to generate the threat model entities in the PostgreSQL database.

Why did it happen? (Gap between planning and execution)

1. Not properly understanding of threats to patient and medical user safety, for example the ‘Preset configuration may be changed’ threat scenario. The threat was incorrectly classified as attacking patient safety, when in fact it’s an application function used to configure the device for procedures.

2. Not having integral attacker type support in the agent flow. My development decision to postpone implementation of attacker types (defined in the data model but not implemented in the agent flow) resulted in a lack of clarity regarding the classification of threats and in retrospect, I should have invested the 4 hours work to implement attacker types in flow.

3. Not reading the latest guidance thoroughly - relying on LLM interpretation resulted in unnecessary work on my side to figure out the latest guidance, for example residual risk without financial value, and vulnerability exploitability.

4. At one point I started fine tuning the model by surgical changes in the UI and (in 1 case) the PSQL command line which resulted in a lot of manual work that could have (and should have) been saved by creating a new card version and regenerating the threat model with the generate model flow.

Primary root cause

Starting the project before reading the device’s intended use.

Intended use defines safety domain, and safety domain defines asset classification. Without deep understanding of intended use, the threat model drifted.

What surprised me

1. An attack vector with a custom exploit in a software update package emerged late in the game.

2. The current device system architecture with its 21 security countermeasures mitigated 97% of the threats in the model.

3. The model generation pipeline was reliable during the pressure of iterations

4. The bottleneck in the process was not the agent model generation speed (30s) but modeling discipline.

Improvements must focus on modeling discipline (intended use, domain locking, attacker typing) rather than increasing agent complexity.

How can we improve OpenCRO for future missions?

Process improvements

1. Establish the ‘Category’ of the project model as part of the standard terms of conditions of the engagement (FDA Cyber, Business threat modeling, HIPAA, GDPR etc)

2. Understand intended use of the device before modeling in order to properly establish roles of safety, efficacy, data integrity and data privacy in the model.

   1. Phase 1 - manual reading to deepen understanding by analyst and discussion with customer RA/QA.

   2. Phase 2 - agent validates the card story for consistency and completeness vis-a-vis the intended use.

3. Classify attacker types as part of the workshop with the customer

4. After the initial generation of the model, validate the MD card story with the customer team. In particular - validate the DOMAIN tagging in the cards with the customer team, since this will help later on with sanity checks such as privacy threats not tagged in PRIVACY domain.

5. Mandatory meeting with CEO to review and sign off the final report version.

6. No manual DB edits after model generation. All changes must originate from a revised card story and model regeneration.

Code/AI agent improvements

1. Implement the attacker types and attacker_threat relationships in the MD card story, generate agent flow, and upsert procedure (they’re already in the data model)

2. Test if system properly supports multiple vulnerabilities per threat, if not fix bugs

3. Add dry run feature to generate model from story link (basically same agent flow as extract but stopping before calling the upsert procedure).

4. Improve model generation traceability:

   1. Alter column models.version from text to integer column incremented by the upsert procedure every time the model is re-gened.

   2. Add column models.story_link text - story_link used to generate the model entities

5. The edit model currently supports creating a duplicate new model functionality (which is convenient). Better to have a ‘Duplicate model assets’ function as well instead of having to manually re-enter the Model assets

6. Add delete entities before model generation to the upsert (did it manually this time which is a bit dangerous)

7. Use the model ‘Category’ to support different regulatory/business categories:

   1. Different report sets for different categories (FDA Cyber Pre-market guidance, HIPAA Security Rule, GDPR, Business threat modeling etc). The tacit assumption is that the analytical model is invariant across all categories but the reports may differ (for example - VaR in Business threat modeling and exploitability and residual risk in FDA Cyber)

   2. Parametrize binning of mode qualitative valuations (low, medium, high etc) instead of hard coding in the PG logical views.

   3. Implement view groups - this will enable use to have a unique group of views for each category (FDA Cyber, Business threat modeling, HIPAA, GDPR etc)

8. Use the system to log activities in order to perform time utilization analysis for customer-facing and back-office activities (Data collection, bug fixes and enhancements to Models, Cards, Assets, Views, Agents, UI, backend). Use the RULES in order to create views of time utilization.

Outro

OpenCRO delivered on time. More than speed, it delivered depth of analysis of residual risk and exploitability.

In 2026, OpenCRO provides discipline and depth that generalists can’t deliver.

Reply to this post and I’ll send you a free copy of my book “22 Anti-patterns that kill companies.”

If you, a colleague, or a client are submitting a device to FDA in the next 30-90 days — book a call and we’ll see if you’re a good fit.

Life Sciences Today This Week

My guest this week was Sagi Gidali from Rafa’s Moonshot.

Danny and Sagi discuss how Rafa’s Moonshot is turning a rare genetic disorder (STXBP1) into an investable, de‑risked therapeutic opportunity.

Sagi explains how his tech/entrepreneur background shapes a for‑profit mindset around fundraising, biopharma partnerships, and making rare disease indications attractive to industry. They cover building a global network, leveraging grants and consortia, working with academia/CROs, and planning the flip from nonprofit to for‑profit. They also dig into industry “anti‑patterns,” including copy‑paste development strategies, and explore a start from the drug label and work backwards approach.

Rafa’s Moonshot is building a full-stack engine to take an ultra‑rare genetic disorder, STXBP1, all the way from scattered case reports to real, clinic-ready therapies. They start by doing what traditional drug developers often ignore: systematically finding and organizing the global patient population (about 1,400 diagnosed so far), running natural history studies, and deeply understanding disease mechanisms.

On top of that data and insight, they assemble consortia of academic labs, CROs, and biotechs, then use philanthropic capital to unlock 3–4x leverage in non‑dilutive grants for their research partners. The long‑term play is to flip from a nonprofit hub into a for‑profit therapeutic company once there’s enough de‑risked biology, IP, and clinical direction.

Who needs what they’re building?

• Biopharma and biotech looking for de‑risked, ready‑to‑develop rare disease programs.

• Academic groups needing funding, infrastructure, and industry‑grade coordination.

• Investors hunting for high‑impact, capital‑efficient CNS/neurogenetic plays.

• Most importantly, families living with STXBP1 and similar CNS disorders, who need a path to actual treatments rather than yet another descriptive paper.

Sagi closes with his vision for a complete STXBP1 solution, a new CNS neurogenetic research center in Israel, and a stronger Israeli life sciences ecosystem.

You can see the episode here

In 2026, I’m helping 100 founders succeed more

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4.

I’ve been building in tech, cyber, privacy, and clinical data for 25+ years across Israeli medical device startups, Verily, Amgen, and the Fortune 1 company.

I work at the intersection of business, engineering, AI and clinical data.

If you love my writing — share it

Share

There’s a story the Israeli MedTech ecosystem tells itself.

1,400+ companies. $3.4 billion in exports. The Startup Nation. A country of 9 million people punching above its weight in medical innovation.

It’s a good story. Parts of it are even true.

But there’s a question the story never quite answers: who actually benefits?

What Israel keeps

Strip out the multinationals selling into Israel, strip out the companies already acquired and now reporting revenue under US or European parent companies, and the independent Israeli MedTech revenue base is remarkably thin.

Novocure: $605M. Israeli-founded, R&D in Haifa, headquartered in Switzerland.

InMode: ~$364M trailing. Declining. Discretionary aesthetics is getting crushed.

Brainsway: $41M. Growing fast but small.

Nano-X: $11M. Still burning cash.

That’s essentially it for publicly traded independent Israeli MedTech. Four companies. One real revenue generator.

The rest of the celebrated ecosystem either hasn’t commercialized, already got sold, or is running on government grants and investor optimism. Given Imaging — the capsule endoscopy pioneer that put Israeli MedTech on the map — was acquired by Covidien in 2014. The revenue now reports through Medtronic. Itamar Medical, Mazor Robotics, Lumenis — all acquired, all gone from the Israeli balance sheet.

The science advances. The commercial ecosystem stays stunted.

The compounding deficit

This is where the comparison to Israeli cyber becomes uncomfortable.

Check Point didn’t just build a great company. It built an ecosystem. The founders, the early employees, the capital they generated — all of it recycled back into Israeli tech. Marius Nacht co-founded aMoon with the proceeds. Unit 8200 alumni built Wiz, CrowdStrike, Armis. The exits compounded into the next generation of companies, which compounded into the next. Israeli cyber is a self-reinforcing engine.

Israeli MedTech isn’t — at least not yet. Given Imaging built and sold. The next generation of Israeli GI founders started from scratch, with another IIA grant, rather than from inside a platform company with commercial infrastructure, a US distribution network, and a CEO who’d already navigated FDA.

Wiz sold to Google for $32 billion. That’s an enormous exit, and the founders are Israeli. But the compounding value of Wiz — the patents, the customer relationships, the talent flywheel — now accretes inside Google, not inside Israel.

The question isn’t whether Israeli founders get rich. Many do. The question is whether Israel gets richer. And on that measure, the scorecard is mixed.

The curse of the subsidy

The Israel Innovation Authority has been subsidizing Israeli tech since 1965. Today that means roughly $300-400M per year in direct grants and indirect capital — including a new $1 billion Yozma 2.0 fund running through 2026.

This is genuinely smart industrial policy. The original Yozma Fund in 1993 created the Israeli VC industry from scratch. The IIA incubator program has produced real companies and real science.

But it also creates a structural dependency that the ecosystem rarely discusses openly. The IIA grant de-risks the early stage so effectively that companies get built that would never survive market selection alone. The grant covers losses while the company searches for a US strategic acquirer willing to pay for the IP.

The model: build with IIA grants → reach clinical proof-of-concept → sell to a US multinational → celebrate the exit.

Except it works for perhaps 20 companies out of 2,000. The rest either flatline at single-digit millions in revenue for years — enough to survive, not enough to matter — or become walking dead: too far along to pivot, too small to attract a serious acquirer, burning through the last of the grant money while the founders wait for a call that doesn’t come.

The IIA subsidies create a very large pool of companies with just enough runway to fail most of the time.

DayTwo is the clearest illustration of what happens when the acquirer doesn’t show up. $85M raised. Gut microbiome IP that was genuinely interesting. Real clinical data. Shut down. The IIA grant was spent. The VC capital was spent. No Israeli anchor tenant absorbed the technology, the team, or the institutional knowledge. It just evaporated.

That’s not a failure of the founders or the investors. It’s what happens when your value capture strategy depends on a single exit event to a foreign acquirer or on the local domestic market.

The reimbursement ceiling

There’s a structural reason this pattern repeats.

You can win FDA clearance from Tel Aviv. Talented regulatory teams, good engineering, and enough capital to run a clinical study — Israel has all of that. FDA regulatory pathways to clearance are hard but navigable from anywhere.

You cannot win US reimbursement from Tel Aviv. CMS decisions require deep relationships with US payers, US hospital systems, US clinical champions. That infrastructure requires physical presence, years of relationship building, and a US commercial organization that Israeli startups typically don’t have the capital to build before they need to sell.

So the commercial scaling — the part that actually generates the recurring revenue that justifies a large acquisition multiple — almost always happens after acquisition, under US ownership. The Israeli company sells at a proof-of-concept valuation. The US acquirer captures the upside of commercialization.

This isn’t a criticism of the ecosystem. It’s a description of where the value accretes in the medtech value chain. Israel is excellent at science.

The returns live downstream of the science.

The cyber contrast

Israeli cyber doesn’t have this problem because the value chain is inverted.

There’s no FDA equivalent gatekeeping US enterprise sales. No 7-year commercialization pathway consuming capital before first revenue. US companies pay real SaaS dollars, on annual contracts, sometimes within weeks of a proof-of-concept. The feedback loop is fast enough that Israeli companies can build US commercial infrastructure before they need to sell — which means they can choose whether to sell, and at what price.

RAD-Bynet stayed Israeli and scaled Israeli and became a $BN incubator for companies like Radware and Ceragon. The RAD-Bynet approach was unique in that it encouraged engineers to leave the mother company, start their own ventures, and receive backing, mentorship, and support from the Zisapel brothers. The RAD-Bynet Group, founded by Yehuda and Zohar Zisapel, is often described as a private incubator and a cornerstone of the Israeli “Silicon Wadi.”

Check Point stayed Israeli and scaled Israeli. Check Point Software Technologies is often referred to as a “mother ship” for Israeli cybersecurity startups, with its alumni founding over 40 successful companies including Palo Alto and Cato.

What this means in practice

For Israeli MedTech founders, the implication is that acquisition readiness is not the same as scientific readiness. The IIA got you to proof-of-concept. That’s the easy part. The hard part is convincing a US corporate development team that you’re a commercial asset, not a science project — that the FDA cybersecurity documentation is complete, the regulatory pathway is clear, and the regulatory risk is priced rather than hidden.

The acquirer’s DD team will find the gaps. Better to close them before the conversation starts than to negotiate around them during it.

For US strategics and mid-market device companies looking at the Israeli ecosystem — the analytical edge right now is understanding which companies have actually cleared the reimbursement and regulatory hurdles versus which ones are running on IIA grants and investor optimism. The ecosystem is deliberately opaque about this distinction. There are real gems in the 1,400+ company pipeline. They’re a small fraction. Finding them requires understanding the structure, not just reading the press releases.

A tool worth knowing

The data in this post came partly from Byte51, built by Matt Gibbs after the SVB collapse took down the life sciences analysis group and CipherBio with it. Matt had started CipherBio at SVB — the best source for life sciences transaction intelligence — and when it shut down he rebuilt it as Byte51. Same concept, same UI, weekly refresh on $2 trillion in life sciences transactions.

I first used CipherBio when I was working on an AI startup for oncology clinical trial risk. I needed to find the right investors. Matt’s advice was simple and exactly right: “Profile companies like yours and see who invested in them at seed stage — we’re the only ones who can do that precisely.” He was right.

If you’re mapping the Israeli MedTech landscape seriously, Byte51 is where I’d start.

If you’re an Israeli MedTech company preparing for a US acquisition conversation, or a corporate development team trying to separate signal from noise in the Israeli ecosystem, I’d like to talk. Reply to this email or find me at dannylieberman.com.

Danny was involved with 35+ Israeli MedTech companies, 13 FDA clearances/approvals, Amgen, Verily and the Fortune 1 company. He is the founder of OpenCRO — the AI Chief Risk Officer, providing FDA cybersecurity threat modeling to MedTech companies.

For $150, you’ll get a 60’ audit call, written evaluation and access to my pattern library.

That’s insane value.

Subscribe now

Zina Sarif, founder and CEO of Yendou, shares her journey from Morocco to Europe, where she pursued chemistry and a PhD in skin cancer research before moving into clinical operations at Parexel and AstraZeneca.

There she discovered the massive “white space” in drug development—up to four years of administrative delay between trial phases, largely driven by slow, repetitive site communication.

Yendou addresses this by acting as a sponsor–site communication platform with site‑centric data architecture and login‑free workflows for sites.

It structures all interactions, automates follow‑ups, and enables reuse of site data across studies, cutting feasibility timelines by 50%, reducing site selection by 13 weeks, and getting 91% of tasks completed within five days.

With 5,000+ sites and 62 site networks already onboard, Zina frames clinical operations as “agents of medical progress” and argues that the real moat is relentless usefulness and execution, not defensive barriers.

Watch this high-energy episode 48 - on how Zina Sarif and her team in Berlin are reducing clinical trial site selection by 13 weeks.

About me

My name is Danny Lieberman. I’m the host of Life Sciences Today.

Book a call with me if you’re innnovating at the intersection of technology and biology and you want the world to know what you’re doing!

For 25+ years I’ve worked across tech, cybersecurity, privacy, and clinical data — from Israeli MedTech startups to Verily, Amgen, and the Fortune 1 company.

Most MedTech companies run their business with 4 separate operating systems: an engineering OS, a regulatory OS, an operations OS, a commercial OS.

They don’t run their business on a single risk OS.

That’s how they get derailed and accumulate expensive mistakes like in today’s story.

If you want a clear view of what’s likely to break in your 2026 plan, book a CEO Audit.

The CEO Audit is a discrete 60’ call with me where we’ll talk about team, capital, reimbursement, regulatory, and operational risk - quietly growing up to bite you.

You’ll get a written post-call summary with action and watch items, and unlimited access to my Pattern Library.

Subscribe now

Photo by Andrea Piacquadio

I wrote a story called “Yasmin” 2 years ago. It’s now a chapter in my book - “Bob and Alice - an anti-love story” - available on Amazon.

It was the first time I wrote about anti-patterns after I discovered a killer anti-pattern called WYSIATI that was afflicting me personally.

Humans are very visual and we tend to draw conclusions based on the appearance of a person or a system.

These conclusions are often wrong.

WYSIATI

Introduction

In this episode of Bob and Alice, we meet Yasmin.

Bob and Alice play a guessing game.

We introduce the WYSIATI anti-design pattern.

Mountainview

There are two people in the reception area. Yael walks over to the broad-shouldered man, with a brightly-colored shirt. “Allan ? I’m Yael from People Operations, I’ll take you over to Mark for your interview.”

Mark speaks little and speaks politely. This frightens people so much that they never question him.

Mark asks Allan - “Tell me about yourself.” Allan is overweight, fidgety, sweaty-palmed and nervous.

“I graduated from Stanford in June and I want to find a job as a software developer. I have a number of projects I worked on. Let me show you examples of my work.”.

Mark says “Show me one.” Allan pulls out his tablet and demos an application for peer-to-peer communications app. It looks like Figma. Mark is thinking WTF. Mark says “What protocol did you use?” Allan says: “TCP”.

Mark says: “Unfortunately, we are doing work in UDP. We will be in touch”.

Yael escorts Allan back to the reception area and tells him: “We’ll be in touch”. Allan knows that the official reason might be one reason or another, but he knows he failed his interview with Mark. He’s still shaking. Mark was one scary dude, he thought.

The second person was tall, slim and very beautiful.

“Yasmin ? I’m Yael from People Operations. I’ll take you over to Mark for your interview.”

Mark speaks little and speaks politely. This frightens people so much that they never question him.

Yasmin sits down in front of Mark’s desk.

Mark asks Allan - “Tell me about yourself.”

“I’m Yasmin, I’ve been working the past 3 years at Tail Scale on the central management and tools for network administrators.”.

“Explain WireGuard to me”.

Yasmin, “Tail Scale uses WireGuard for VPN. WireGuard uses UDP to create secure P2P tunnels. It’s simpler and faster than IPSec and OpenVPN.

“Do you think Wireguard is more secure than IPSec?”

Yasmin, “I don’t know what the marketing people say. I can think of 2 reasons why Wireguard is more secure. First of all, WireGuard is simpler: You can do the work with less code.”

“Why is less code good?”

“Less code makes a smaller attack surface with less vulnerabilities”.

“What else?”

“Wireguard doesn’t store connection state information on the server. This means that attackers cannot exploit the protocol from the server side.

They talked for a few more minutes. Mark paged Yael.

Yael came in and told Yasmin - “I’ll take you over to your next interview with Bob. Bob is the infrastructure group manager.”

Bob, Yael and Yasmin

Yael brought Yasmin into Bob’s office. The 3 of them sat around a small round table.

Bob introduced himself. He was looking at Yasmin - seeing a slim, tall, very beautiful woman. Wearing a white designer t-shirt, expensive-looking slacks, and Mizuno women’s running shoes. Moving like a professional athlete.

Long purple nails. Not the stereotype of a kernel driver software developer.

Bob asked: “Lena speaks very highly of you. How do the 2 of you know each other?”

Yasmin: “We were classmates at San Jose State in the computer science department. We became close friends. At the beginning I helped her with English, and she helped me with the computer science courses. I found some of them challenging. I was on the women’ s track team and we trained a lot. I didn’t always have enough time or energy to hack the homework problems myself. Lena was a big help.

My twin brother, Amir went to Stanford. He is the smart and really successful one. After graduation, he co-founded a startup with a classmate. They sold the company after 2 years. He’s a venture partner at Mayfield and working with a dozen different cybersecurity startups in the Mayfield portfolio. He has this easy charm and ability to succeed. I have to work hard. I’m not successful like Amir”.

“Why do you want to leave Tail Scale and come to work for Google? You know that the founders worked at Google. I’m friendly with Brad Fitzpatrick. He’s a genius”.

Yasmin: “I’ve been there since the beginning and I need a change. The company is doing very well. Brad is a very special guy and I learned a lot from him. Now is a good time for me to move on”.

Bob said - “Yasmin, we will be in touch in the next few days. Yael will escort you out”.

Yael comes back to Bobs’ office.

“What do you think?” Bob asks.

“About what?” “About that story about her brother? I don’t get it”.

Yael is doing her PhD at Stanford in psychology. She’s working on AI in education with Noah Goodman.

“Bob - it’s common for a twin like Yasmin to feel overshadowed by her sibling. Amir’s achievements are impressive. She grew up in an Iranian family with parents who are very competitive. It’s not surprising that she talks more about Amir than about herself. Now listen to this: I did a little background research on Yasmin. She ran a sub 4’ 40s mile at San Jose in her sophomore year. She would have made the women’ s Olympic team if she had not gotten an achilles tendon injury in her junior year. I had a conversation with her after the phone screen. She’s still an active runner and she’s super competitive”.

Bob, “So how do you assess her? Is she an IC (Individual contributor) or EM (Engineering manager)”?

Yael, “It’s hard to say, but I’m willing to bet that 15 years from now, she’ll be VP Engineering at a major tech company. She has the technical chops, people skills and competitiveness”.

5 years later

Venice

Bob, Lena and Iris are at the studio apartment facing the beach, working on the next release of the software for gig workers hour reporting. Barry is at a sales meeting in Marina Del Rey.

Bob is sitting across a desk from Iris, looking at Iris bent over a stack of papers.

Iris is wearing a sleeveless blouse, designer-ripped jeans and stillettos. Reading glasses perched on her nose.

Power look, Bob is thinking, but not saying.

Bob, “We need a kernel driver programmer to support integrating phones and watches”.

Iris, “How long would it take? We’re about to sign a contract with that feature. Barry is meeting with them right now.”.

Bob, “I estimate 3 months of work for someone who knows what they’re doing. There’s a lot of talent out there right now with all tech layoffs, but it will take time to find someone we can trust. I don’t want to go to Upwork. I want someone local, I can trust”.

Lena is listening to the conversation. “Call Yasmin. She’s back in LA. You know, she was laid off from Google. We talk all the time”.

Bob - “I didn’t know that. I lost touch with all the excitement. Let’s call her up now”.

“Hi Yasmin - it’s Bob. How are you? I hear you’re back in LA. Do you have time for a coffee with me? - I might have something interesting for you if you’re available”.

Yasmin - “Hi Bob, I’m great. There is life after Google. Where do you want to meet? I can meet tomorrow morning”.

Bob, “How about Intelligentsia off Venice beach, tomorrow at 10:00?”

“Done. See you”.

Intelligentsia Cafe. Bob is looking at Yasmin. Still tall and very beautiful.

Looks a bit more athletic or maybe it’s his imagination.

Bob, “What brings you to LA?”.

Yasmin, “After I was fired from Google, my parents started pressuring me to come back to LA and find a husband. I had just broken up with my boyfriend in Palo Alto. I don’t mind. The Koreans on Pico do a fine job on nail manicures. I signed up for a Persian dating website. Makes my mom happy. It’s fun meeting rich Persian dudes. They spend money on me. I’m lifting weights, and running a lot, now that I don’t have a day job. What’s up? Lena says you’re working together on a startup out of a studio in Venice”.

Bob, “Yep. I’ll get to the point. We’re developing and selling a cloud service that enables gig workers to report hours using their watch or phone. We need to integrate data flows and develop a management layer. Right up your alley”.

Yasmin, “I can do that. Sounds like fun. What are you paying?”. Bob names a number.

Yasmin, “OK, I can start today. Do you have a contract?”.

Bob, “Just so happens, I do. In my backpack. You wanna sign now?”

Tuesdays with Alice

Bob is back in the Venice gym doing circuit training.

It’s Tuesdays with Alice.

Alice is working on a treadmill when he comes in and parks his bike by the ping pong table.

He finishes the circuit and they take a water break.

Alice is leaning against a pillar in the gym. The old USC sweatshirt and tennis shoes are her trademark. Drinking from a generic water bottle.

Bob smiles and says, “So Alice, what do you do for a living?”.

She smiles back. “Why don’t you guess”.

He takes a stab. “You’re an investment manager at Merrill Lynch”.

“Are you kidding me? Do I look like a baby-raper? Try again”.

“You’re a professor of economics at USC?”

She smiles back. “Keep on guessing. Not even warm, listen, I’m jumping into a shower, I have a meeting downtown. You can walk me to my car”.

After the shower, she comes out - wearing a black pants suit, white shirt, flats.

Alice, “You want another guess?”

Bob, walking her to her car - “Special CIA agent?”

“Not even close. Ciao Bob, I have to roll.”

They both smile at each other, as she gets into her car.

WYSIATI - the anti-design pattern

A design pattern is a template for creating solutions in different situations.

For example, an IKEA cabinet with its little tools and instructions for assembling the table is a design pattern.

An anti-design-pattern is a pattern that guarantees failure in different situations.

For example, not reading the IKEA papers and losing the little tools.

Anti-design pattern WYSATI - What You See Is All There Is

We tend to judge people by their appearances.

In the context of software development, WYSIATI can be jumping to a conclusion regarding the root cause of a bug. After the bug resurfaces 5 months later, you lost context and have to start from scratch.

What does it look like?

You meet a person.

You see a slim, tall, very beautiful woman.

You see that she’s wearing a white designer t-shirt, straight-leg jeans outfit from L’Agence on Rodeo Drive.

It does not occur to you that this person is a talented software engineer who develops kernel drivers with a sense of fashion.

Solving “WYSIATI”

1. Be curious: Be curious without being creepy. Ask what they do for a living.

2. Wipe your disk: Put your first assumption aside and consider other alternatives.

3. Debrief users: Ask your users what they think about the source of the bug. You will be surprised - users are surprisingly intuitive about these things.

4. Take ownership: If an engineer gets stuck in WYSIATI, it’s the leaders fault and leader’s responsibility to fix. This means - it’s the team leader’s responsibility to train the engineers and make sure they have all the tools they need including the capacity to step back and wipe their disk.

“WYISATI” can be challenging, but with extreme ownership and an open mind - you can achieve outstanding results.

Continue reading

A wrong turn based on what you heard and what you saw can result in a catastrophic failure and loss of your optionality in your journey to commercialization of your medical technology.

Stranger in a Strange Land is based on a true story of lose of optionalilty

About me

For 25+ years I’ve worked across tech, cybersecurity, privacy, and clinical data — from Israeli MedTech startups to Verily, Amgen, and the Fortune 1 company.

Most MedTech companies run their business with 4 separate operating systems: an engineering OS, a regulatory OS, an operations OS, a commercial OS.

They don’t run their business on a single risk OS.

That’s how they get derailed and accumulate expensive mistakes like in today’s story.

If you want a clear view of what’s likely to break in your 2026 plan, book a CEO Audit.

The CEO Audit is a discrete 60’ call with me where we’ll talk about team, capital, reimbursement, regulatory, and operational risk - quietly growing up to bite you.

You’ll get written post-call summary with action and watch items, and unlimited access to my Pattern Library.

Subscribe now

My guest this week was John Chinnici, CEO at Ledger Run.

I talked with Chinnici about his journey from consulting (Andersen, IBM) to Veeva, where he helped launch and grow Vault, and eventually to leading Ledger Run.

Ledger Run focuses on the “unsexy but critical” operational layer of clinical trials: contracting and paying investigative sites.

Ledger Run’s SaaS platform and services aim to ensure strict contract compliance, dramatically improve operational efficiency, and turn reliable payments into a competitive advantage for sponsors in site recruitment. Chinnici also argues that a major industry anti-pattern is pouring AI investment into volatile early research use cases while underinvesting in high-ROI operational applications such as automating invoice processing and other repetitive payment workflows.

Check out the main topics of discussion for this episode of the Life Sciences Today podcast:

• Tell us about your personal journey—how did you get from consulting and Viva to leading Ledger Run?

• Who are your customers, and what specific problems are you solving for them?

• How do you create value for sponsors and CROs in clinical trial payments and contracts?

• How do you capture that value—what does your business/revenue model look like?

• What are three things you want to do for your customers in the next 12–18 months to make them insanely happy?

• What is your competitive moat—what makes Ledger Run hard to copy compared with large CROs and other players?

• What is the biggest anti–design pattern you see in the industry right now?

Now, without further ado, I’m excited to share with you the latest episode of the Life Sciences Today podcast.

Listen here

About me

For 25+ years I’ve built in tech, cybersecurity, privacy, and clinical data — 70+ clinical trials, 30+ Israeli MedTech startups, Verily, Amgen, and the Fortune 1 company.

Today I’m building OpenCRO - a fixed-price, fixed-schedule provider dedicated to helping MedTech leaders succeed more.

Drop me an email if you’re a MedTech leader betting on regulatory, reimbursement, and GTM design paths or book a call.

We’ll talk soon.

Photo by Andrea Piacquadio

I wrote this essay 2 years ago, before I had language for what I now call ‘losing your optionality’ in MedTech.

Rereading it today, I was surprised how early the failure mode appears.

Long before teams argue about execution, pricing, or go-to-market, they often fail at something simpler: they stop hearing ideas that don’t fit their internal narrative.

This piece captures that moment — in story form — before anyone realizes the damage is already baked in.

The Man with the Tattooed Fist

Introduction

We meet a new anti-design pattern: RejectNewIdeas.

Alice is legal counsel with the FBI. Her ex is under surveillance by the FBI for money laundering.

How will Alice handle the situation?

Giganet has a SaaS application for collecting work hours from gig workers using watches. A security show-stopper threatens the startup.

How will Barry, Bob and Iris handle the situation?

The man with the tattooed fist

Thursday morning, Alice was outside the Federal Courthouse.

Alice is legal counsel with the FBI field office in LA, specializing in prosecuting money-laundering and international crimes.

There were 3 agents with her. Inside, 2 Colombian nationals would soon be charged with money-laundering. After they were picked up by LAPD for possession of cocaine, LAPD queried NCIC and the names of the 2 Colombians popped up.

Sam, the FBI agent who works closely with Alice asks her, “Do you know Agent Timothy Kelley?

He nodded towards a tall, heavyset Irishman. “Kelley wants a minute of your time”.

Alice walks over to Kelley. “Tim - how can I help you?”

Tim said, “I can think of 2 ways I can help you”.

Alice flashes him a smile, “Keep on trying, I’m out of your league little man”.

Tim shows her a picture of a tall, sandy-haired man. “Do you know this man”?

It’s blurred, but Alice recognizes her ex, Dave.

She and Dave met at USC, she was studying law, and he was tall, easygoing and majored in finance. They got married after graduation and by the time she finished her LL.M in international law, they had 3 children.

Dave became a derivatives trader and they bought a nice house in Santa Monica. They were on the fast track to successful careers and family, except for one thing. Money corrupts.

Dave had a rich client. He hit on her and didn’t stop there. 6 months later, Alice divorced him, took the house and a settlement.

She said to Kelley, “You have him under surveillance?”

“Since last Tuesday”.

Alice, “Then you know it’s my ex - so what’s this do-I-know-him shit?”

“What I mean to ask, what do you know?”

“He picked up my kids last Friday. They spent Friday, Saturday, Sunday with him and brought them back to my place Sunday afternoon”.

“What’s he think about you being with the FBI?”

“Look”, Alice said, “Why don’t you stop dicking around and tell me what’s going on?”

“See Alice, the situation is sensitive”, Kelley said with a blank expression. “A derivatives trader is a suspect for wire fraud and money laundering. Married to an FBI lawyer”.

Sam thought Alice was going to punch out Kelley. Sam pulled her back and told Kelley to behave himself if he wanted cooperation from Alice.

The FBI called the tall, sandy-haired, laid-back, good-looking man “Slick”, assigning nicknames to suspects in their investigations.

Slick was a suspect in money laundering, a possible suspect in 7 more cases, judging from the surveillance videos, all the same guy.

Slick appeared to be fresh meat, just getting into crime. His motivation, support a lavish lifestyle, after he made some highly speculative trades and lost big.

Kelley, “We got a hit on Slick from the Verint Telus system. Looked him up in NCIC, drew a blank. That’s why we think he’s a newbie”.

Alice, “What do you want me to do, get his prints off a can of Fanta?”

Kelley shrugged, “That’s a good start, maybe all we need. What I want you to do is to talk to Dave, see if he has any money issues, seems to be under any stress…”

“Be your snitch”, Alice said, regretting it as soon as she said the words.

Kelley, “You’re a Federal agent, Alice. Deal with it”.

Sam said, “That’s enough Tim”, standing up for Alice as he would for any team member, not because she was a woman. Alice was tougher and smarter than any other agent in the LA field office, with emotional intelligence off the charts.

Kelley said, “Dude, I need her. Is she with us or against us?”.

Sam handed Alice his Smith & Wesson MP9 - “Here, you want to shoot him, go ahead”.

Alice smiled, “Timothy, there is one thing. Dave has an identifying mark that might help you identify him. He has a small blue tattoo with the word FDIC on the top of his index finger”.

Kelley falls for the bait. “What is that, some kind of derivatives-trader joke on the banking system?.”

Alice smiling back, “or not - it stands for Fuck Dumb Irish Cops”.

Kelly comes back, “Let’s make a bet. If he’s clean, you buy me dinner”. Alice, “And if he’s dirty?”

Kelley, “Well girl, I’ll buy you dinner”.

Alice goes home. After taking a shower, she looks at herself in the mirror. Still a size 6 at age 40. Good legs in a straight skirt and heels. No longer a “girl”, but she could handle that. To her old grandmother, Girls and Boys were single people, no matter how old they were.

Alice calls her father Jerzy.

Her grandmother hated Jerzy. She called him, “The man with a black BMW and black heart”.

Jerzy is an options trader and very well-connected, maybe he knows something.

Alice tells her Dad that Dave is a suspect in a FBI money-laundering case. That an FBI agent wants her to snitch on Dave and help them build their case.

Jerzy said, “Lemme guess, a tall red-haired Irishman, Tim Kelley? Or maybe I’m confused with Tim Kelley, you know, the middle linebacker that plays for the Chicago Bears?”

Alice, “Dad, stop it”. “Alice, you are a Federal agent. You don’t owe Dave anything”.

Alice, “But why would Dave risk 20 years in prison?”.

Her Dad, “He lost big on derivative trades, and needs to get it back to support his lavish lifestyle with his girlfriend. Maybe he likes the adrenaline rush of laundering money and getting away with it”.

Alice, “So you’re saying I should be a snitch?”

“Actually, I’m saying, you should get yourself a boyfriend, and move on”.

Venice beach - Giganet

Pesya, the jolly hacker matriarch, slightly overweight, always laughing, always thinking about going to the gym; discovered vulnerabilities in the Giganet system with $25M in exposure to fines for CCPA privacy violations.

Iris thinks back to their conversation last week:

Pesya, “Iris, You cannot release the system like this.

In addition to the DDOS vulnerabilities, there are XSS vulnerabilities. Attackers may be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. You will be in violation of CCPA.

CCPA penalties have an upper cap of $7,500 per intentional violation or $2,500 per non-intentional violation. It may seem like a small penalty, but it can eventually grow massive. The penalties can quickly add up because one consumer equals one violation.

Pesya, “How many users do you have now?” Iris replies, “About 10,000 users”.

Pesya, “You have $25M in exposure”. She deliberately uses the word exposure with Iris so that Iris will understand financial impact.

“We’ll need another 4 weeks for security testing and validation after Lena and Justin finish. Yasmin’s back end module is not affected and the rest of the front-end is fine. You need to allow 12-13 weeks to fix this problem”.

Giganet has a major milestone in a week with LA County, their first large account. The revenue and reputation are critical to Giganet survival. They don’t have 12-13 weeks. They need the cash.

Iris tells Barry and Bob, “Let’s go out for lunch. Somewhere people don’t know us”.

They drive over to the Golden Dragon. As they walk in, they hear a loud chatter of customers mixed with laughter and clattering dishes. They feel the kitchen’s energy and strong smell of spices, and the sizzling stir-fry. Iris says, “I love this place”, and asks a server for a corner booth for 3. They are starving and order dim-sum. They wait until their server walks away before talking.

She asks Bob and Barry to help figure out a solution.

Iris, “We need 3 months to fix the issues and install an update.

Best case, we deliver on-time, and we don’t get attacked before the update.

Worst case, LA County cancels the contract and we shut down the company.”

Iris turns to Bob after their waitress fills up the table with dim-sum and the three of them wait for her to leave before they resume the conversation.

Iris, “Bob - don’t you have some tech magic that you can do to fix this by next week?”

Bob is angry with Iris for hiring a person on Upwork to develop the contracts module without consulting with him in order to save money.

He’s known about this problem for months and avoided resolution with Iris.

Bob, “We could use a Web application firewall (WAF) to mitigate the code vulnerabilities. That could buy time for us to fix the software.

But - I don’t believe in silver bullets. Attackers might still be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. We have $25M of exposure for a CCPA violation and we can’t afford that kind of exposure and loss of reputation.

I refuse to support this solution. A WAF is a band-aid. We need to fix the code.”

Iris is struggling to accept Bob’s rejection.

Iris, “We’ll lose the contract, reputation and maybe the company”.

Bob looks over at Barry, Italian gangster look, polo shirt, slacks, tasseled loafers.

Bob stops for a second and looks over to Iris, grinning from ear to ear.

Iris, “Did you just have a good idea, Bob?”

Bob, “The best defense is a good offense. Barry just gave me an idea. Let’s pretend we have a solution”.

RejectNewIdeas Anti-Pattern

What it looks like

You reject new ideas before understanding them.

This anti-pattern is fundamentally about your ability as a leader to accept and nurture new ideas from the team, even if they are not your ideas.

Effective leaders are those who, regardless of their own natural talents, cultivate an environment where every team member’s ideas are met with openness and curiosity.

Solution

Don’t resist new ideas. Pretend you agree. Start by asking questions.

Instead of rejecting an idea immediately, pretend that you are interested in it, even if you are not. By questioning - you open yourself up to understanding the value the other person brings to the table.

Pretending to agree delays toxic resistance and asking questions increases your chances of your team member listening to you.

Eventually - unless you are a total idiot - you will develop constructive conversations with your team members on a regular basis instead of rejecting new ideas and repressing innovation.

Eventually - you will start accepting new ideas.

On a park bench in Venice CA

Mark was the one who began.

Mark, “Bob, tell me what’s happening at Giganet, and what’s new with Alice?”.

Mark remained silent as they sat on the park bench.

In front of them there was the green calm of the park.

A man hungry for an answer, must stock up on patience.

A man in possession of analytical skills needs to listen.

That is why Mark remained silent.

Mark listened carefully to Bob’s story for about 15 minutes.

Bob, “I’ll help Alice with her mouse problem in the kitchen. I think she has something on her mind”.

Mark, “Good. Use the SelfCare pattern with Alice. Ask questions and be a good listener.

At Giganet, it seems you almost got stuck on the RejectNewIdeas pattern but you did a good job of pretending to have an open mind and that bought you time to think about a different approach.

Let’s talk about how to implement an offensive solution to mitigate the threat to your company.

Why this still matters

What this story describes isn’t a personality flaw.
It’s a leadership anti-pattern.

Founders don’t reject new ideas because they’re arrogant.
They reject them because acknowledging those ideas would force a different — and harder — strategic choice than their default.

That quiet rejection compounds.

And by the time it shows up as a commercial problem, it’s already too late to fix cheaply.

Continue reading

I explore how commercial success comes from making commercial tradeoffs and taking the harder, less-traveled strategic choice.

👉 The Anti-CRO

This essay is part of an ongoing series on patterns that shape what happens after FDA clearance — in product, teams, and markets.

About me

For 25+ years I’ve worked across tech, cybersecurity, privacy, and clinical data — from Israeli MedTech startups to Verily, Amgen, and the Fortune 1 company.

Most MedTech teams don’t fail early.
They fail after clearance, after traction, after the story they tell themselves turns to stone.

My work focuses on how MedTech founders lose optionality three years in.

If you want a clear view of what’s likely to break in your 2026 plan, book a CEO Audit 2026 below.

My standard advisory rate is $1,000/hour.
This audit is $150 — priced to make clarity accessible before the stakes get higher.

Subscribe now

Photo by Sunny Li

In 2026, I’m working with 100 founders

Intro

People set big goals like it’s the holy grail. They climb a ladder that’s leaning against the wrong wall.

You can get rich but wipe out on the beach of your acquirer.

You can have the perfect engineering team but your big dreams are put on ice for a few decades.

What worked for me is designing a life instead of setting goals for a startup.

Years ago I wrote out what my ideal day looked like.

The program is small enough to fit in my head. I don’t need an app and wearables to track progress. Just a paper notebook.

After all these years, I can say that I have achieved the optimal lifestyle I wanted back then. Bizarrely, many of the goals I’ve set, though, are still incomplete. But what drives the most meaning and fulfillment is knowing I’m living on my terms.

Goals are often nothing more than distractions designed as bragging rights, and shiny objects that, once you get them, make you feel nothing.

Real wealth comes from design, not from goals. There are 3 reasons for this:

1. You’ve probably noticed that winners and losers have the same goals.

2. Achieving a goal is momentary.

3. Goals are not long-term progress.

In this essay, I’ll talk about why the design of your TechBio company matters more than your goals for FDA clearance. Instead of driving your TechBio company to achieve goals - design for time, design for change and design for buyers.

Let’s learn from the story of Zebra Medical.

We’ll see a company wiped out 8 years after founding after they developed a robust deep learning platform for detection of bone, liver, lung, and cardiovascular diseases and 7 FDA 510(K) clearances.

The story of Zebra Medical Vision

In 2011, Eyal Gura injured himself while scuba diving in Mexico. Eventually he was diagnosed with an upper hernia, but it took a series of doctor visits and X-rays to find it. There wasn’t anyone who could look at the X-rays and tell him what was wrong.

He was founder and CEO of a company that did image processing for the stock photography industry, so he knew that he could teach computers to recognize patterns in images.

After 3 years of funding Zebra himself, Gura raised a seed round of $8M from Khosla Ventures, Marc Benioff and Deep Fork Capital. They hired an engineering team and partnered with the Israeli HMO Clalit to get images for training their deep learning algorithms. In 2016, Zebra Medical Vision signed a deal with Intermountain Healthcare which gave them more data.

Courtesy of Byte17

By 2022 - Zebra was not sustaining growth and scaled back its work force.

In April 2022, in a stock-for-stock deal for $100M, Nanox acquired Zebra for its AI technology. Nanox makes digital X-ray technology which had not (and still has not) mainstreamed in a market dominated by GE and Siemens. Nanox wanted Zebra’s AI technology to boost the value of its X-ray product.

Zebra’s team got wiped out on the beach of their acquirer—their technology absorbed into a struggling company with its own existential problems.

Post-IPO Nanox stock traded at 94.8 and is now trading at 2.7 which makes the deal worth $13M in today’s terms. Nanox last reported a net loss of $10.2M in Q4/2025 and continues to struggle with high cash burn and negative gross profit margin.

In late 2017, I got a phone call.

Zebra Medical had their submission for coronary calcium 510(K) rejected because of a series of major deficiencies, including this one: “Your submission does not provide information on how you will protect your device from malware during the production and distribution of your software as recommended in Section 6 of the guidance titled “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices”.

Coronary artery calcium (CAC) was a great place to start. CAC is a marker of plaque buildup in the heart’s arteries, and 30-50% of the general adult population, a number that rises to 60-90% in people over 70 in the US.

Could I come in and help? Yes I could and yes I did. Within 4 weeks, working closely with the engineering team, I collected data, built the threat model and wrote up the documentation for the FDA Cyber part of the submission.

They cleared the FDA for CAC. Good customer - paid me and never called.

They later went on to receive clearance for 7 indications.

But they were not getting traction, despite ‘leading the way in AI FDA cleared products’.

Zebra got stuck in the reimbursement chasm.

What they built (technical excellence):

• 7 FDA clearances

• Superior deep learning platform and engineering

• First-ever AI CPT code (Category III) for VCF detection - huge industry milestone

• Real clinical deployments globally

• Partnerships with Intermountain, Cedars-Sinai, Oxford

Where they got stuck (GTM failure):

1. Selling low: Initially set a fixed price of $1/scan for use of their system for diagnostic triage.

2. Pricing model wrong: $1 per scan analyzed sounds elegant, but creates chicken-egg problem:

   • Hospitals won’t deploy without proven ROI

   • Can’t prove ROI without volume

   • $1/scan for a $250 test is too low and unsustainable.

   • Volume requires infrastructure already deployed

3. Category III CPT code paradox: They achieved the first AI radiology CPT code in July 2021, but payment decisions are made locally at payor discretion, with highly variable reimbursement rates and significant time lag. So they had the code but no guaranteed payment.
   

4. Population health positioning: They pivoted from diagnostic triage to population health screening, but this requires:

   • Payer contracts (not provider contracts)

   • Long sales cycles with health plans

   • Value-based care adoption (still nascent in 2021)
     

5. Revenue model confusion: Sources mention both subscription and per-scan pricing. This suggests they were thrashing between business models - never a good sign.
   

6. Breaking the law of line extension: There is an irresistible pressure with founders to extend their brand equity. As Ries and Trout write in their book, “The 22 immutable laws of marketing” - If violating this law was a punishable offense, a large portion of corporate America would be in jail. One day you’re laser-focused on coronary calcium and boom - the next day you’re doing 6 more indications.

Design patterns instead of founder goals

Instead of driving your TechBio company to achieve goals - design for time, design for change and above all - design for buyers.

Design for buyers. Eyal Gura’s original goal was personal - bring X-ray diagnosis to the masses anywhere, anytime. He was not alone in starting a TechBio company because of a personal experience. But, personal experience as a patient and ability as an entrepreneur to raise money and build a team don’t mean anything to your economic buyers. They see hundreds of vendors like you every day, and your motivation, while inspiring, is not sufficient motivation for them to buy your product.

Design for change. Sacrifice your dreams and ideas.

The life science and healthcare industries have large, complex and opaque decision making processes. As a founder/CEO, your ability to go to market drops exponentially with each new indication and product you develop and launch. You have to develop, validate, maintain, support, package and price, market and sell and find PMF for each product.

If juggling balls is linear, launching multiple medical indications is exponential. 3 products is 6X more complex than 1 product. 7 products are 5000X more complex than 1 product.

Do 1 thing and dominate the market with that 1 thing. If you have to pivot, you only have to pivot from that 1 thing.

Design for time. We design office space, cars, phones and software systems. We almost never design the time for our company. Certain parameters are constant - like your engineering and operational systems. Others, marketing and sales channels, require time to learn and adapt.

Design challenge for founders

You don’t need 5 years to change your life. Or the life of your company.

Shorten the timeframe. Make it happen in the next 12 months.

It doesn’t take discipline or a Navy seal’s morning routine. It just takes you to be unreasonable enough to want a better life.

It requires you to make big, uncomfortable decisions and stop trying to be a fortune teller who can predict the future.

I dare you to do the unthinkable. Change your design.

This week on Life Sciences Today

Dr. Gary Zammit, founder and CEO of Clinilabs, joined Life Sciences Today to unpack 25+ years building a CNS‑focused CRO through boom, near‑bust, and a 2024 PE exit. His core thesis: success in drug and device development is “beyond science” — it’s the trinity of people, processes, and systems. The real failure in clinical R&D isn’t regulations or protocols; it’s neglecting the human factor and the formation of truly effective teams. Clinilabs’ moat is radical focus: they are the only full-service global CRO dedicated exclusively to CNS, compounding thousands of hours of domain practice into culture and execution.

One powerful anti‑pattern Gary called out: copy‑pasting protocol designs from prior studies. Teams believe they’re inheriting “best practice,” but often inherit embedded mistakes. The better pattern is to start from the end-state — the label and the paper you want to publish — and work backwards to the optimal trial design.

You can see the show here

In 2026, I’m working with 100 founders

Subscribe now

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4.

I’ve been building in tech, cyber, privacy, and clinical data for 25+ years across Israeli medical device startups, Verily, Amgen, and the Fortune 1 company.

I work at the intersection of business, engineering, AI and clinical data.

If you love my writing — share it

Share

The past five Fridays, I’ve been writing about counterfactuals, paths, and why things fail long after they look successful.

Today, I realized something uncomfortable about myself. Uncomfortable, because we were brought up to ask good questions and bring home good grades.

Storytelling is my secret weapon.
Not my clever insights into causal flows or MedTech commercialization or agentic AI systems.

Sharing my personal experiences and learning; actual events, not polished versions, has value that “value content” lacks.

People don’t subscribe to my writing because of my insights into design and anti-design patterns.

People read me, and choose to work with me, because they see themselves in my story, and they trust me as a person.

Those authentic connections are real growth for me.

And for that, I’m grateful.

So today, I’ll share a story with you.

About the first company I started,

That worked, but not for me.

Once upon a time there was a founder

The excitement of the start

I started a software distribution company.

Our lead investor was a billionaire entrepreneur — and my mentor.

We built an exceptional team.

We launched with Microsoft.

Everything felt aligned.

Smart people. Real customers. Big logos.

Distributor conferences in Vegas and Monte Carlo.

It looked like the beginning of something durable. Something that generates wealth.

The messy middle

Early on, I misunderstood what business we were actually in.

I thought we were in the product business.
We weren’t.

I thought our customers cared about micro-kernels, operating systems and networking services.
They didn’t.
They cared about margin.

We were in the distribution business.

So we doubled down — on systems, dealers, pricing, and packaging.

Operationally, we got very good.

We built a channel of 100 resellers.

We built a subscription support center.

Revenue grew. Deals got bigger.

But - strategically, the path had already narrowed.

The merger that could

We grew to $20M in annual revenue in 4 years.

With marginal profit.

At the end of year 4, we merged with another distributor.

By year 5, the combined company was doing $40M.

From the outside, it looked like success.

I walked away with nothing.

Liquidation preferences. You know the rest.

Outro

That’s why I keep writing about counterfactuals.

Not as an academic exercise —
but because I’ve lived inside futures that started with excitement
and ended in quiet failure.

The real growth for me hasn’t been subscribers or replies.

It’s realizing that telling the truth, in sequence, over time -
creates something rarer than attention.

Your trust.

And for that, I’m grateful to you, my readers.

This week on Life Sciences Today

If you dig distribution channels - you’ll dig the story of Almased who built distribution for their product in the US and Europe.

This week on the Life Sciences Today podcast, I spoke with Jamie Luu and Ronja Kröger, Nutrition & Product Expert, M. Sc. Nutritional and Food Sciences from Almased, a 30-year-old German nutrition company with 31 clinical studies behind its flagship high‑protein, fermented shake.

We dug into how Almased’s blend of soy protein, yogurt, and raw honey modulates key appetite and metabolism hormones (GLP‑1, PYY, ghrelin, leptin), preserves 100% of muscle mass during weight loss, and even reduces liver fat.

We contrasted this “natural boost” of the body’s own signals with GLP‑1 drugs like Ozempic, which more aggressively override appetite pathways. Almased is careful not to position itself as a drug alternative; instead, it’s a complementary, complete‑nutrition option for both GLP‑1 users and people seeking a more traditional, habit‑building diet approach.

We also touched on Almased’s scientific moat, U.S. distribution, upcoming DTC site, and their next big product move: a chocolate flavor.

You can see the episode here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4.

I’ve been building in tech, cyber, privacy, and clinical data for 25+ years across Israeli medical device startups, Verily, Amgen, and the Fortune 1 company.

I work at the intersection of business, engineering, AI and clinical data.

If you love my writing — share it

Share

If you want more like this — subscribe to Clear Thinking