Subscribe for more of my writing.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

Intro

Jennifer Ernst and I connected on LinkedIn.

The breadth of her experience and the precision of her thinking and ability to execute against all odds - this person doesn’t know the word ‘impossible’.

One of the most interesting and inspiring people I’ve ever had the privilege to meet.

From Xerox Parc to neuromodulation to treat sinus headaches, and a pivot to immunotherapeutics to protect against radiation injury and to support immune function in oncology settings.

Yes - this sounds like a career of 3 people.

Jennifer spent her career at the edge of science and market reality.

She started at Xerox PARC, helping translate breakthrough research into viable business models.

Later, she helped scale Thin Film Electronics and then co-founded Tivic Health, where she brought a non-invasive neuromodulation device from concept to FDA clearance in just three years for less than $3 million. She eventually took the company public and later helped lead a pivot into biopharma.

That story alone is compelling. But the deeper insight from our conversation was about commercialization.

FDA clearance is hard but it’s only the beginning.

In MedTech, especially in devices and neuromodulation, there is often an assumption that FDA clearance is the hardest part. It is hard. It takes years, capital, discipline, and good data. But Jennifer’s point was sharper: FDA approval is not the finish line. It is the beginning.

Her metaphor was perfect. Getting FDA approval is base camp at Everest. You are not at the summit. You are barely at the start of the real climb.

The real climb is reimbursement, adoption, and business model design.

Neuromodulation is a particularly revealing example. The field is exciting because these devices are often non-invasive, can have strong safety profiles, and may offer meaningful alternatives to drugs or surgery. But that promise creates its own trap. If a device is non-invasive, there may be no surgical procedure tied to it. If there is no procedure, there may be no billing code. And if there is no billing code, physicians may have little economic incentive to adopt it, even if the device helps patients.

That creates the commercialization bottleneck Jennifer kept returning to: how does everyone in the system get paid?

It is not enough for the product to work. The payer has to see cost avoidance. The physician has to have a viable revenue path. The company has to support education, adoption, and ongoing use. A technically elegant product can still fail if it lands in a market structure that has no way to absorb it.

Jennifer’s own experience made this concrete. Tivic’s sinus device had a strong safety profile and compelling results. But launching during COVID, dealing with shut physician offices, facing high customer acquisition costs, and lacking a recurring revenue model made the commercial path far harder than the regulatory one. That is a lesson many founders learn too late: the market does not reward clinical novelty by itself.

Jennifer identified a major anti-pattern in neuromodulation:

too many companies try to go direct-to-consumer without understanding the real cost of consumer marketing.

Direct-to-consumer without understanding what that really means

That move is seductive.

If physicians are hard to educate and reimbursement is unclear, direct to consumer sounds like freedom.

But in reality, consumer health requires enormous spending on education, trust-building, and repeat engagement.

Medical devices also carry higher manufacturing and quality costs than standard consumer electronics (because of specially-designed hardware, manufactured in very small quantities and with a specialized supply chain).

If the product is a one-time purchase with no recurring revenue, the economics can break fast.

In other words, skipping the healthcare system does not mean you escape the commercialization challenge.

It usually means you inherit a different one — and often a more expensive one.

Jennifer’s insight is one every founder in medtech should keep in mind: approval gets you to base camp. The summit is building a system where the product gets used, paid for, and sustained.

(Tivic Health rebranded as Valion Bio end of April 2026)

Visit Valion Bio here

Jennifer is now working on her next rodeo - if you want to contact her - DM me on substack and I’ll make the introduction.

She’s good people.

Watch the show here.

OpenCRO

My conversation with Jennifer reinforces a theme I think about a great deal in my own work: commercialization is not something to “add later” after you develop a device or drug.

Revenue assurance has to be designed into the company’s value proposition.

That is the premise behind OpenCRO, my latest company.

We help medtech teams build development and commercialization programs in which the revenue logic is legible early — before companies discover, too late, that regulatory progress and commercial readiness are not the same thing.

One of the most common mistakes I see is treating the product label as a regulatory output rather than a commercial input. By the time payers ask, “How do you measure benefit?”, the pivotal trial is often already enrolled and the protocol can no longer be changed. At that point, commercial failure is no longer hypothetical. It is simply delayed.

I have seen variations of this problem across more than 40 medtech commercialization programs in the US - and I hear it from leaders on Life Sciences Today

If that sounds familiar, I’m offering a free 30-minute stress test of where your next deal is most likely to break: FDA review, hospital IT, procurement — or all three.

I’d love to talk to you - grab a time here. No strings.

30 minutes on revenue assurance

Subscribe for more of my writing.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

Intro

Life saving decisions in clinical research are being made with a word processing tool launched 43 years ago.

That’s the hook, but it’s also the reality.

In my latest conversation on Life Sciences Today, I sat down with Scott Chetham, Co-founder and CEO of Faro Health, to talk about one of the least glamorous and most important bottlenecks in drug development: protocol design.

Scott has spent more than 20 years inside clinical development, working nearly every angle of the system — hospital coordinator, principal investigator, pharma, biotech — before starting Faro.

What he built comes from lived frustration, not abstract theory.

His core point is simple: the industry still lacks real-time feedback at the moment when trial design decisions are being made. That means teams tend to over-collect data, overburden sites and patients, and drive up both costs and timelines.

In other words, by the time many companies realize a protocol is bloated or unclear, the damage is already baked in.

Faro’s approach is to move protocol review upstream and make it actionable.

Scott described a system that uses AI to perform clinical, therapeutic, regulatory, and operations review in about an hour — work that he says previously took five people working for three weeks. He pointed to a published study with Merck showing -

$130 million in cost avoidance across six programs by identifying data points that were never going to be used anyway.

That alone is compelling.

But the sharpest insight from the conversation came when I asked Scott about the biggest anti-pattern in the industry.

The biggest anti-pattern in the industry

His answer: teams don’t talk to each other.

That sounds obvious until you realize how much clinical operations depend on cross-functional precision.

Protocol design touches clinical operations, feasibility, data management, safety, regulatory, analysis, and eventually reimbursement strategy.

A single detail buried in one section of a protocol can ripple all the way through EDC build, SDTM shells, statistical analysis, and the clinical study report.

And yet, companies still operate in silos.

Scott made the point that when R&D leaders bring in a new platform without including clinical ops and feasibility teams early, success becomes much harder.

Not everyone needs a vote, he said — but everyone needs visibility.

That’s the kind of insight you only get from someone who has actually done the work.

A lot of AI CEOs can talk about transformation.

Far fewer can tell you where the process actually breaks, why it breaks, and what happens downstream when one team misreads what another team meant.

In clinops, the weeds are the strategy. And Scott clearly knows the terrain.

Visit Faro Health here

Watch the Life Sciences Today show with Scott here

OpenCRO

This conversation also touches a theme I think about a great deal in my own work: commercialization is not something to “add later” after you do a clinical protocol.

Revenue assurance has to be designed into the company’s value proposition.

That is the premise behind OpenCRO, my latest company. We help medtech teams build development and commercialization programs in which the revenue logic is legible early — before companies discover, too late, that regulatory progress and commercial readiness are not the same thing.

One of the most common mistakes I see is treating the product label as a regulatory output rather than a commercial input. By the time payers ask, “How do you measure benefit?”, the pivotal trial is often already enrolled and the protocol can no longer be changed. At that point, commercial failure is no longer hypothetical. It is simply delayed.

I have seen variations of this problem across more than 40 medtech commercialization programs in the US.

If that sounds familiar, I’m offering a free 30-minute stress test of where your next deal is most likely to break: FDA review, hospital IT, procurement — or all three.

I’d love to talk to you - grab a time here. No strings.

30 minutes on revenue assurance

Subscribe for more of my writing.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

This week on Life Sciences Today

What if the central weakness in Israeli medtech is not scientific invention, but the system that is supposed to turn invention into enduring companies?

In Israel. Not in the US.

That was the question at the center of my conversation with Shai Policker, GP at Edge VC this week on my podcast Life Sciences Today.

I came into the discussion with a deliberately sharp thesis:

Israeli medtech does not have a science problem. It has an ecosystem problem. Israel continues to produce exceptional science, engineering talent, and clinically informed innovation.

Too often, the technology is created in Israel while the commercialization capability, managerial infrastructure, and long-term value capture relocates to the US.

In my view, the Israeli medtech industry loses its optionality in commercialization.

Losing optionality in commercialization

For years, early-stage funding often gave companies enough capital to advance the technology, but not enough to build the US commercial infrastructure needed to become serious standalone businesses.

The result is 5-10 years of development that lead to many Israeli medtech companies becoming walking-dead - generating just enough revenue to stay alive.

The outcome is an ecosystem that generates a great deal of innovation that loses its optionality 5-10 years later.

What made the conversation worthwhile is that Shai did not merely disagree in principle. He offered a different operating model.

Shai pushed back

Shai has seen the industry from multiple vantage points: as an electrical engineer trained at the Technion, as a medtech operator with more than 25 years in the field, as someone who spent a decade in the US, and now as an investor. Before joining Edge VC, he led the IAA-backed Medics incubator. That background gives him an unusually practical perspective on the distance between invention and commercialization.

What Edge does differently is not simply a matter of sector focus.

Their model begins with validated unmet needs from large strategic medical device companies, rather than with an entrepreneur looking for capital.

From there, they assemble teams — engineers, physicians, and operators — around those needs.

The model is designed to reduce one of the chronic weaknesses of Israeli medtech: the gap between technical ingenuity in Israel and commercial execution in the US. Edge’s answer is to bridge that gap deliberately, with American operating infrastructure and commercialization capability built into the company formation process.

Shai offered a useful example in Synchrony Medical.

The company developed a wearable vest for airway clearance in COPD and bronchiectasis patients. The original insight came from a respiratory physiotherapist at Sheba Medical Center. The team licensed the patent, built the company, ran clinical work in Israel and the US, secured FDA approval, and reached first commercial sale with only $2.5 million invested.

Whether one treats that as an exception or a template, it is a concrete demonstration of Shai’s broader point: the right product, regulatory pathway, and commercialization design can produce a real business without requiring endless capital.

The big anti-pattern

He also identified what may be the most important anti-pattern in the sector: the pursuit of highly complex PMA-pathway products, especially in interventional cardiology, with decade-long timelines and enormous capital demands. There are undeniable successes in that category. But there are also many more companies that disappear into the long valley between technical promise and commercial viability.

His proposed alternative is notably less glamorous and much more practical: build more companies around 510(k)-pathway products, where $10–15 million can plausibly carry a company to approval, first revenue, and operating viability.

That, to me, is what made this conversation valuable. It was not just a debate about whether Israeli medtech is underperforming. It was a debate about what kind of institutional and commercial design actually gives innovation a chance to compound.

If you care about medtech, venture creation, commercialization, or the future structure of Israeli innovation, I think you’ll find this episode worth your time.

Visit Edge VC

Listen to the episode here.

OpenCRO

This conversation also touches a theme I think about a great deal in my own work: commercialization is not something to “add later.”

Revenue assurance has to be designed into the company’s value proposition.

That is the premise behind OpenCRO, my latest company. We help medtech teams build development and commercialization programs in which the revenue logic is legible early — before companies discover, too late, that regulatory progress and commercial readiness are not the same thing.

One of the most common mistakes I see is treating the product label as a regulatory output rather than a commercial input. By the time payers ask, “How do you measure benefit?”, the pivotal trial is often already enrolled and the protocol can no longer be changed. At that point, commercial failure is no longer hypothetical. It is simply delayed.

I have seen variations of this problem across more than 40 medtech commercialization programs in the US.

If that sounds familiar, I’m offering a free 30-minute stress test of where your next deal is most likely to break: FDA review, hospital IT, procurement — or all three.

I’d love to talk to you - grab a time here. No strings.

30 minutes on revenue assurance

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

This week on Life Sciences Today

What if clinical trial protocols could go from months of track changes in Word to a clean protocol generated by AI?

This week, I sat down with Pedro Coelho, founder and CEO of Biorce, to explore how his team went from tagging mistakes to building AI that gets it right the first time.

Clarity of thought

The first thing that stands out in a conversation with Pedro is his ambition, and the sharpness of his thinking.

Biorce didn’t start by designing AI prompts to write clinical protocols.

They started by identifying problems - the first is a tough fact of life that everyone involved in clinical trials knows - the number of changes to the protocol during a clinical trial.

The number of changes, the messiness of track changes, multiple versions and implementation into the clinical trial data collection systems for sites and patients is a nightmare for life sciences companies/

Someone told Pedro early on: you’re like McKinsey finding problems and not fixing them.

That comment helped trigger a pivot. Instead of only spotting flaws, Biorce began using AI to correct and improve protocols directly.

The result is a system that generates clinical protocols in 5 minutes; protocols that are 85–95% complete, more robust than the usual process with Word, and less likely to require endless revisions in the first six months.

I was involved in 70+ clinical trials and I know what a mess trial amendments can be.

When Biorce scales it will be a major change to a major blocker in clinical trials.

The anti-pattern: believing in things that don’t work

A little background first.

Monitoring is a manual activity that involves people (CRA - clinical research associates) going to research sites and comparing pieces of paper with digital records.

Monitoring can consume 20–30% of a trial budget, while updating less than 3% of the data points ( a study Medidata did on 14,000 drug trials over 10 years ago). At FlaskData we analyzed 10M+ data points in medtech trials and found that the number updated by CRA monitoring activity was < 1%.

In 2009, FDA issued guidance for RBM (risk-based monitoring).

During COVID, the industry went to RRBM (Remote risk-based monitoring, doing the same thing over zoom) and then to RBQM (Risk-based quality monitoring, doing the same thing but prioritizing the massively non-value add activity under the guise of improving quality).

Monitoring is part of a broader anti-pattern that people in drug development know but rarely say out loud: huge parts of the system persist because they are inherited, not because they are effective.

Biorce is interesting because of the clarity of their thinking, their logic and execution.

They’re part of a wider movement of clinical software startups challenging assumptions and rocking boats of bureaucracy.

Listen to the show here

You need a good nights sleep to think clearly

Anyone who dealt with a cyber event appreciates the value of a good nights sleep.

I know. I once got a 2AM call from a customer ICU, back in the day.

FDA-cleared devices in hospitals are attacker entry points.

Today, hospitals are attacked by AI-driven ransomware-as-a-service platforms.

Cyber risk doesn’t stop with FDA clearance.

It stops the night you can sleep well.

Get a peaceful nights sleep

Photo of Moldavanko courtesy of Kyiv Post

I’ve been writing for 140 straight weeks.

This week I continue the story of Giganet Health - the digital health startup from Venice, CA. Giganet Health sells health solutions to gig worker employers in California - organizations like LA County are all Giganet Health customers.

This week - the Giganet team needs to scale up their security as they try to close their first major enterprise account.

Like most startups - the answer comes from a friend of someone inside the company.

And - we greet an old friend: the anti-design pattern: Boss Gets Stuck.

You may ask - what does Boss Gets Stuck have to do with cybersecurity?

You’ll just have to read today’s episode of Clear Thinking.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

Lyubka Shneiveis - matron of the hackers

Little old Lyubka is the matriarch of the Silicon Valley hackers.  

She was born in Moldavanka, the tough south-side Odessa neighborhood, which was as Isaac Babel wrote: “crowded with suckling babies, drying rags and conjugal nights filled with big-city chic and soldierly tirelessness”..

Her family immigrated to America and they settled in another tough neighborhood, Chicago’s South Side. 

Lyubka was the youngest of 5 children, gifted in math and science. Her parents worked hard and pushed their children to academic excellence. Lyubka completed the University of Chicago with a PhD in theoretical computer science. After graduating, she joined Google in 1999, where she fit right in. 

When Google fired 12,000 people to focus on AI, Lyubka was already in her mid 50s.  

It was legend that she was the only employee who kept her original desk for 25 years, where she researched browser security. 

She reported to Mark, the tall, lanky bald man. 

Lyubka didn’t mind being terminated. Her kids were on track. She had money in the bank, her 2 books on browser security were published by O’Reilly and sold nicely. She was on her own, doing what she enjoyed, an empty-nester divorcee who did not have to deal with an ex and children. 

She divorced Bill after he left her for a younger, more svelte woman.  

Lyubka raised their 3 kids on her own. Her oldest son graduated CalTech in aerospace engineering, the middle daughter taught kindergarten in Palo Alto, and the youngest was back in Chicago doing graduate work in finance at the University of Chicago.

Venice, CA

Bob, “Iris, we need someone for software security, do we have the budget to hire someone?”.

Iris jumps in, “With the LA County contract, yes. Do you guys have someone in mind?”. 

Lena said, “Sure. Bob - you should call Lyubka. Her son lives in West LA, she is moving to LA”.

Bob was not surprised that Lena had all this information.

Yasmin, Lena and Lyubka were close friends. At Google, the 3 of them had lunch together every day. It was an improbable combination that worked well.

Petite GI Jane Lena, the elite software warrior. Married to Sergey, the RF board designer and gamer.

Yasmin, the slim, tall, very beautiful kernel developer and serious runner. Dating rich LA Persians.

Lyubka, the jolly hacker matron, slightly overweight, always laughing, thinking about going to the gym, but more interested in CVE-2023-6345, the zero-day she had just discovered in the Chrome 2D graphics engine.

Iris, “Lena, can you call up this Lyubka person and bring her in for an  interview?”

Lena, “Iris, sure, but she doesn’t need an interview. You need to convince her to come to us. She  is the number one person in the world in browser security. Lyubka will be doing you a favor if she joins Giganet. It would be a major marketing coup for Barry”.

Barry is one of the two co-founders of Giganet, together with Iris, who was his CFO at a failed Silicon Valley startup.  

Barry is Italian gangster chic - Polo shirt, slacks, Italian loafers and cigars. 

Barry asks, “Why is Lyubka a major marketing coup?”.

Lena, “Baaaarrrrrrry.  It’s obvious.  Play the browser-security card. When enterprise customers like LA County ask what you do for browser security in your SaaS application - you can roll out Lyubka. She will slam-dunk them. Lyubka is good for business. Make a press release”.

Barry, “Call her”.

The next day, Lyubka comes into the studio apartment facing the beach in Venice. The reunion with Lena and Yasmin brings back happy times.

Today, Yasmin is wearing another outfit from L’Agence, courtesy of her uber-rich Persian boyfriend - a Jennah checked blazer, white t-shirt, straight-leg jeans and her trademark Mizuno running shoes.

Bob, “Lyubka, it’s great to see you again! We’re looking for someone to handle software security for the application. Wondering if you might be interested?”.

Lyubka says, “Tell me more about what you’re working on”.

Sitting around a table in the living room, the team talks about the project. 

Lyubka says, “You know, I can help you and it really sounds like fun. Make me an offer. The timing is good for me. I just moved to LA from the Valley. I want to be close to Zack and his family and enjoy my grandchildren. ”.

Iris makes her an offer and they close on the spot.

Lyubka comes in the next morning at 8:00.

Iris opens up early. She and her ex-Navy Seal husband like to get in some surfing early morning on Venice beach.

Iris, “Hi Lyubka, do you want a cappuccino?”.  

“Green tea, if you have, I want to jump into the code and start building a threat model. When is your next major release?”.   

Iris, “Uh, next week - we have a milestone with LA County”.

Lyubka, “Awesome.  You’re lucky Bob was the architect and Lena and Yasmin developed the software. They are all world-class on software security. You are in good hands”.

Iris is beginning to feel queasy. Physically Sick to Her Stomach. 

She thinks back to a conversation with Lena 3 months ago about the gig workers contracts module.

Iris had written the specifications herself, and had outsourced the contracts code to a 5-star rated contractor named Yuriy she found on Upwork. Iris was proud of the great hourly rate she had negotiated with the contractor.

Iris, “I think it looks really great”.

Lena, “It’s an ugly piece of shit. Yuriy made a completely different look-and-feel from the rest of our beautiful application. The typography is different, the fonts are huge, the navigation is across the top bar instead of our standard left side-bar. He didn’t bother to use our style guide. He uses strange-looking buttons to add and edit line items to a contract. It’s ugly and your customers will hate it. He must have had some old Angular 1.0 code and reused it. That’s why you got such a good deal.”

Your customers. Not our customers.

Iris, “Lena, we need to think about time-to-market.Besides, the contracts interface is used by payroll staff, it’s not the same users. I don’t know if it matters”.

Lena, “Do what you want, it’s your decision”.

After the confrontation with Lena, Iris decided to stop the discussion and move on.

That conversation was 3 months ago. 

Today, a world-class security expert is about to look at code written by a Ukrainian Upworker.

Iris is a finance person. She worked for the IRS investigating white-collar crime, she understands risk management, she knows that the contracts module is non-standard with the rest of the code. But she has no tools to estimate their exposure. Lyubka does.

That afternoon, Lyubka asks Yasmin to conduct a code review of the contracts module.

Yasmin has this technique where they go around in a circle reading each other's source code.  

Yasmin, “Justin, can you please start reading the code?” 

Justin is their QA person, fresh out of Santa Monica College. Korean, jet black hair. Hip-hop street wear. Very quick.

They spend the next hour listening to Justin read Angular 1.0 TypeScript code in the contracts module.

Lyubka, “Justin, what do you see here?”  

“I see a lot of Regex code. I see a bunch of places where the programmer wrapped <option> elements in <select> ones. I don’t understand why he does it this way. It looks bizarre”. 

Iris is observing. Getting Sicker to Her Stomach by the Minute.

Lyubka, “That is correct, Justin. There is no reason to do it that way. As a matter of fact - this code is very old and it’s very vulnerable to DDOS attacks and cross-site scripting. There are 8 known browser vulnerabilities in this code. We have to upgrade to the latest version of the framework and fix all the bugs in the TypeScript code.”

Iris asks, “How long will it take to fix?” She’s praying to the Lord that the answer is a day or two.

Lena, “At least a month to upgrade the framework, go through all the source code, fix bugs, and prepare for QA and a penetration test. I told you it was a piece of shit”.

Lyubka, “Iris, You cannot release the system like this”.  

In addition to the DDOS vulnerabilities, there are XSS vulnerabilities. Attackers may be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. You will be in violation of CCPA.

CCPA penalties have an upper cap of $7,500 per intentional violation or $2,500 per non-intentional violation. It may seem like a small penalty, but it can eventually grow massive. The penalties can quickly add up because one consumer equals one violation. 

Lyubka, “How many users do you have now?” Iris replies, “About 10,000 users”. 

Lyubka, “You have $25M in exposure”. She deliberately uses the word exposure with Iris so that Iris will understand financial impact. 

 “We’ll need another 4 weeks for security testing and validation after Lena and Justin finish. Yasmin’s back end module is not affected and the rest of the front-end is fine. You need to allow 12-13 weeks to fix this problem”.

Iris feels like she wants to throw up. 

The Boss Gets Stuck Anti-Design Pattern

Problem

After making a bad decision, the leader does not decide.

Not deciding happens for a number of reasons:

• Decision paralysis, usually out of fear of another person.

• Hierarchy. In large organizations, decisions can be bumped upstairs to someone else higher up in the hierarchy. The boss doesn't understand the problem and is inclined to do nothing and ignore signals from soldiers lower down in the organization. 
  
  Iris's problem wasn't being indecisive, but rather that she didn’t understand the possible impact of Yuriy’s code quality.

• Non-standard ways of decision making. In remote-first organizations, different business units may have different ways of taking decisions. One of them might be “do nothing” first.

• Disaggregation. When a decision-maker needs other people to make a decision, the process breaks down into smaller pieces. The smaller pieces have less information and less inclination to make a decision that makes them look bad.

The usual approach to Boss Gets Stuck uses traditional tools of organizational politics:

• Keep a low profile and hope you don’t get hit with flying missiles.

• Have meetings. As many as possible with as many people as possible.

• Dilute decisions. Make a decision that only addresses part of the problem, then tell people you solved the problem.

The usual approach makes problems worse.

Solution

You want to be purposeful about channeling conflict into constructing value. You do this in several ways:

• Achieve buy-in for a new / different idea.

• Use constructive confrontation to achieve buy-in. "Constructive confrontation" requires addressing problems directly, objectively, and in a positive manner. Have your data and your opinion, be prepared to get in a conference room with the other person and argue your opinion, assertively and backed by data.

• Do internal marketing. Get other people interested and curious about your new/different idea so that you can achieve buy-in from them.

• Pre-staff. After internal marketing and buy-in, meetings will be short and to-the-point since you already have buy-in before the staff decision making meeting.

Constructive confrontation results in 1 of 4 possibilities:

1. Agree and commit - This is the best. Everyone is on the same page and works towards the goal.

2. Agree and not commit - This is bad. It can torpedo a project.

3. Disagree and commit - This is good, because it acknowledges the reality of diversity in the team. 

4. Disagree and not commit -  Less good, but at least, the problems are out in the open. 

Conclusion

Software for Your Head: Core Protocols for Creating and Maintaining Shared Vision 

You need a good nights sleep to think clearly

Anyone who’s ever dealt with cyber events or for that matter - Israelis who spent the 6 weeks running to safe rooms and shelters - appreciate the goodness of a good nights sleep.

If you lead a TechBio, MedTech or Digital health company you know what I mean.

You know that you have cyber risk at home, at customers, in your supply chain.

It threatens deals, slows implementations and damages patient safety.

I know — I’ve had the 2AM call from a customer ICU.

Cyber risk doesn’t stop with FDA clearance.

It stops the night you can sleep well

Get a peaceful nights sleep

I hosted Eddie Ben-Ami, founder and CEO of Neuralight on the podcast last week.

Despite MRI and gene sequencing, the current “gold standard” is still a neurologist’s subjective bedside exam – pushing patients to test balance, or asking caregivers how hard it is to adjust clothes in bed.

Founder & CEO Eddie Ben-Ami explains how Neuralight replaces this with a 10‑minute, tablet-based eye-movement test using a standard camera. By leveraging decades of visual-system research (largely from primate studies), they extract functional biomarkers tied to specific neural pathways and brain regions. The result: objective, quantitative measures of brain function that are highly sensitive to change over time.

Over the past four years, Neuralight has run large longitudinal studies on thousands of patients across multiple neurodegenerative diseases. In Parkinson’s, they’ve shown their metrics are 10x more sensitive to change than the existing clinical gold standard, with results being presented at ADPD in Copenhagen alongside the very inventors of that standard.

Commercially, Neuralight is already being paid as a per-test diagnostic in five pharma drug trials (Phase 1 and 2), where their measures serve as secondary/exploratory endpoints. Their moat is a growing, hard-to-replicate dataset linking eye movements to rich clinical data. Looking ahead to 2026, they’re focused on: successful readouts from ongoing trials, expanding into psychiatry, and bringing their technology into preventative-care platforms so even healthy people can track brain function—before catastrophe strikes.

The problem with neurology’s toolbox

Neurology is, in Eddie’s words, “kind of backward.” In a world of gene sequencing and advanced MRI, the main tools physicians use to track disease progression in Parkinson’s, ALS, MS, and Huntington’s are still bedside assessments and intuition.

Neurologists literally push patients to see how close they get to falling.

Drug trials ask patients how hard it is to adjust their clothes in bed.

These are the gold standards.

What Neuralight Built Instead

The visual system is the best-understood part of the brain — decades of primate research have mapped exactly which neural pathways govern eye movements and how they degrade in neurodegenerative disease. Neuralight turned that knowledge into a 10-minute, tablet-based eye-tracking test using a standard camera.

No invasive procedures. No specialist equipment. Just a dot on a screen, a camera, and some extraordinary engineering.

The output: objective, quantified biomarkers of brain function tied to specific neural pathways. Not a black-box AI correlation. A direct, clean measurement of what specific brain regions are actually doing.

The Validation-First Playbook

I asked Eddie, “What is your favorite anti-pattern in digital health?”

We’ll start with healthy volunteers, build a beautiful product, and figure out how to get into pharma.

Eddie argued the opposite is required to win in this space:

Start with hard clinical use cases and pharma trials, prove you can move the needle on real endpoints, and only then go “downstream” into broader wellness/preventative markets.

Here’s where most startups would have rushed to market. Neuralight spent four years doing the opposite — collecting data on thousands of patients across multiple diseases, following them for over a year, comparing their biomarkers to existing gold standards, and proving their measurements were sensitive to real clinical change.

The result? In Parkinson’s disease, Neuralight’s metrics are 10x more sensitive to change than the current gold standard. They’re presenting this data at ADPD in Copenhagen alongside the very scientists who invented that standard.

That validation opened every door. Neuralight is now live in 5 commercial pharma drug trials, being paid per test, with healthy margins and happy partners.

The Peter Thiel Principle

Dominate one small space. Then expand concentrically. Don’t try to boil the ocean.

Neuralight started with neurodegenerative disease. Now they’re moving into psychiatry and preventative care. The flywheel is spinning — more partnerships, more data, better capabilities.

The lesson for every founder in life sciences: patience isn’t weakness. In a conservative, high-stakes industry, validation is your moat, your credibility, and your only real shortcut.

Do the work first. Then scale.

Listen to the show with Eddie Ben-Ami on Life Sciences Today, part of the Healthcare IT Network.

Stress-test your business not your parents

I can’t help your Mom’s Parkinson disease condition, but I can show you what risks really count for your business.

• You have a balance sheet.

• You track every dollar on the balance sheet.

• You can price cyber risk the same way you price anything else: Value at Risk, before and after countermeasures.

• You can build a prioritized, cost-effective cyber countermeasure plan.

• You can see if you’re a good fit for OpenCRO.

Book a free 20' stress test

For strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

Photo by Matheus Bertelli

I’ve been writing for 138 straight weeks. This week I continue the story of Giganet Health. Bob and Barry take the United Express from LAX to SJO and experience security theater first-hand courtesy of the TSA.

We learn that sometimes - you just have to ask for something.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

Venice California 6:00 AM

Sol was the fifth daughter of musical hippie parents from Haight-Ashbury. Sol was a cheerful, high energy crossfit trainer. I was in Sol’s 6:00 crossfit class in the Venice gym. By 7:00, psychopath Sol had taken us to the edge and finished us off.

Today, Barry and I were taking the United shuttle to SJO for a 1030 face-to-face meeting with the city of Sunnyvale. The sales cycle was stuck in an endless, aimless spiral of good meetings with HR and payroll people.

Rumor was that we had already lost the deal to EY.

I needed to clear my mind before Barry picked me up to go to LAX.

I sat down on a mat in a lotus position and started tonglen breath meditation.

Breathing in Alice’s pain, breathing out compassion. In a few minutes, I was in another place. Visualizing myself in front of the ocean. Visualizing Alice and Sunnyvale far away in the distance behind me. Breathing out my compassion to people with pain like me.

Early morning light streamed down the warm walls in shimmering lemon torrents, touching the gym equipment that responded with a bluish-gold reflection.

Alice walked in with her gym bag. She had a court appearance downtown, prosecuting a couple of low-level Columbians for money-laundering in connection with Hezbollah.

She looks left. Sees me in a lotus position, eyes closed, breathing slowly in and out. Taps me on my shoulder.

Alice, “Hey”.

I get up, “Hey”.

We look at each other.

Alice improvs a haiku for us -

Close beside him now,

His scent, a tangible truth—

Is his love as real?

LAX to SJO

Barry picks me up outside the gym.

He parks and we take the shuttle to Terminal 7 to United Express.

Two older women are in line in front of us with Trader Joe reusable canvas bags in each hand. They are negotiating with a TSA worker.

Woman #1, “My friend Clara is allergic to magnetometers. The magnetic field you know is very dangerous to you and it gives Clara terrible headaches”. The TSA worker calls her supervisor and after a brief discussion, sends Clara with a lady TSA worker for a pat-down outside the line.

I say to Barry, “Barry, you know that this is a perfect opportunity for her friend to remotely-detonate Clara. They could kill 150 people and shut down LAX and West Coast air traffic for the day”.

Barry, “Keep your voice down man. You’re spending too much time with Pesya”.

Pesya, matron of the Silicon Valley hackers, is their cybersecurity expert. Pesya sees exploits where other people see buildings, doors and windows. Thinking about joining a gym and losing weight. More interested in finding zero-days.

They land in San Jose on time.

Barry’s phone buzzes.

It’s Madison - their contract sales rep for Northern California. Madison works out of a WeWork in Sunnyvale.

Madison, “I see you guys. Look to your left. I’m in the cherry-red Toyota Tacoma”.

Madison is a formidable Australian gal who relocated to California to find her fortune. Cheeky and high-energy.

They get into the truck.

I ask Madison, “I love your truck, what’s the story?”.

Madison, “Last Monday was my birthday. Business is good. I wanted to treat myself. I deserve it. The dealer said the wait time is 2 months. So - I said, f-k man, but today is my birthday, I need this truck today. I’m buying it today - in cherry-red. I’m not leaving without the truck. The salesman made some calls and they found one at another Toyota dealership. While they brought it over, we did the paperwork. So here we are”.

Madison gets on the 101 North and merges into traffic, and in between phone calls, she updates us with the latest status of the deal with the city of Sunnyvale.

Barry, “Madison, what are all these calls?”

Madison, “I have another gig. I sell food packages online to expat Australians in the US. After I moved here 2 years ago, I got homesick for Vegemite and Tim-Tam and figured that there was a market for iconic Australian foods”.

Barry, “Very cool, so what is your assessment of the deal right now?”

Madison, “Well you know, we got an incoming lead just after the press release of our win with the City of San Jose. I called them back within 15’ of the contact form hitting our CRM. It looked very promising. The problem is that our contacts there are mid-level HR and payroll people.

I think they used us to build their technical specifications and get pricing.

I wanted to talk to the CFO, but I was afraid that if I bypassed HR, I would alienate my contacts and burn the deal.

I want this deal so I ran with my inbound lead ”.

Barry, “Yeah, well, don’t feel bad about feeling bad.

We still have a few tricks in our bag, like bringing in Pesya and scaring the crap out of them over cyber and CCPA (California Privacy) Compliance.

EY can bundle gig worker time collection into their master service agreement for IT outsourcing, but no way the suits from EY can compete with our security and technology platform”.

They get off at Mathilda Ave and arrive early, 15’ before the meeting.

Madison parks and Barry calls a 5’ huddle outside before the meeting.

Barry, “What we do is listen. Madison will make the introductions, let’s go”.

Barry is Italian mafia chic, charcoal gray suit, crisp light blue dress shirt, silk tie, dark brown loafers and Breitling.

I’m in my role as the Silicon Valley CTO (Chief Technology Officer) . Giganet-branded T-shirt, well-fitting chinos and Allbirds, wearing my Suunto Vertical watch.

Madison is in role of the Gen Z Australian sales rep opts for a smart-casual ensemble. Electric blue blazer over a red blouse paired with gray high-waisted trousers and stylish flats.

We’re escorted into a conference room with Mary the head of HR and Hilda head of payroll.

I’m thinking, bad sign, too few people at the meeting. This can’t be good news.

Madison does the introductions.

Mary starts, “I’d like to thank you all for coming in today. Madison has done a great job of presenting your value proposition to help us reduce costs, improve compliance and process gig worker health benefits.

But - I’m afraid that we have some bad news.

Our CFO is leading a reorganization. Changes are happening quickly, and several people in the accounting, HR and payroll departments are now looking for new opportunities.

We have to get through this organizational change before considering new technologies”.

Madison decides to be cheeky. “So you’re saying, your CFO is shaking bushes and people leaving?”

Mary unfazed, “Yes, Madison. We’re in a state of flux right now”.

Barry raises his hand. “Ma’am, can I ask you a question?”

Mary, curious at Barry’s Italian politeness, smiles, “Of course, Barry”.

Barry smiles back, “Can you introduce us to your CFO?”.

Mary smiles at Barry, “Of course, it would be my pleasure to do that. Let’s walk over to his office and say hello”.

Mary walks with Barry down the hall and introduces Barry to Jack, the CFO.

They set a time for lunch and exchange cards.

Hilda escorts the Giganet team out of the building.

Madison is direct, “Hilda, How is it we are only meeting your CFO now?”

Hilda smiles, “You never asked”.

Barry and Iris have lunch with Jack the following week at his favorite Mexican restaurant in San Francisco.

Jack the CFO talks finance with Iris the CFO. Iris shows how the Giganet SaaS solution fits Jack’s reorganization plan like a glove and makes Jack look good.

Iris asks Jack if his IT manager would like to meet number 1 in the world on browser security - Pesya Eichbaum.

Pesya meets the IT manager. They talk about cybersecurity and privacy trends and reducing IT workloads with native cloud platforms. Never specifically mentioning Giganet. The IT manager enjoyed meeting a Valley legend and how taking gig worker privacy off his plate makes him look good.

3 weeks after lunch with Jack the CFO, Barry strikes a deal.

Those who are victorious plan effectively and change decisively.

Sell Low

Barry and I debriefed the Sunnyvale deal, to see what we did right and where we went wrong. This is what we came up with.

In classic sales process, you start with a lead, qualify, build rapport, construct a business case and close a sale.

This may be true for buying and selling dishwashers but it’s not true in technology sales.

In a world where corporate politics flourish even in the smallest company, knowing who authorizes the purchase order is a major key to selling technology.

Proving return on investment on your solution is not enough

In fact:

• Return on investment does not sign checks

• Helping end-users with your software does not sign checks

• Unless your offer has emotional and political benefits for a buyer, they won’t sign a check. The CFO has a stack of offers on her desk with ROI without budget to buy.

The first mistake most technology salespeople make is calling too low in an organizational chart.

Salespeople get intimidated selling to the highest level because of the fear of rejection brought on by their inability to frame a strong enough sales value proposition for a senior manager. Account managers usually push to get into a targeted company, and accept any entry point to get traction.

This is always the wrong move.

Let me repeat that. This is ALWAYS the wrong move.

If you are a sales manager in a technology company, focus on having all of your sales account managers cold call ONLY VPs and above.

Remember, no matter how big the company is, managers and directors are nice people, but they almost never have the authority to sign off on business proposals.

Even when they tell you it is their decision, they are still going to go ask their boss.

Another fact in technology sales is that managers never send you up to their boss, only down to their subordinates.

When was the last time a Director of IT or Operations said to you,

“Bob, I am going to introduce you to my boss, the VP.”

It doesn’t happen. Either they bring your opportunity directly to their boss and try to make themselves look good, or they send you to George, the Program Manager. Either way, you lose.

The Director is not as good a salesperson as you are, and will likely communicate your message in the wrong way to the VP. Worse, you are stuck with George, who cannot make any decisions.

The solution is always sell up – the higher, the better.

On a park bench in Venice CA

Alice has a dream. She dreams she is sitting on a park bench with a tall, lanky bald man in his 60s.

The tall bald man was the one who began. He has a friendly, warm, and caring demeanor.

He introduces himself, “My name is Mark”.

She replies, “I am Alice”.

Alice feels secure and comfortable with Mark, like they were old friends.

Mark, “Alice, how are you? What’s new at the Bureau and with Bob?”.

The tall bald man remained silent as they sat on the park bench.

In front of them there was the green calm of the park.

A woman hungry for answers, must stock up on patience.

A man in possession of analytical skills needs to listen.

That is why Mark remained silent.

Mark listened carefully to Alice.

Alice, “FBI is good. I put away 2 bad guys today. I saw Bob this morning”.

Mark smiled and asked, “Nice - how was it?”.

Alice, “I shared a haiku with Bob”.

Close beside him now,

His scent, a tangible truth—

Is his love as real?

Alice trusts Mark and asks, “What should I do?”

And she wakes up before Mark can answer.

The end of the consulting firm

3 days into the cease-fire with Iran, it’s Friday and I’m back to dancing Gaga at the Suzanne Dalal Center.

It is a time to rebuild and I’m building what I think will become a new category:

Expert-led, agent-operated services.

The present

I spoke with an Israeli digital health VC recently.

I pointed out that none of their portfolio companies had cleared FDA.

He said:

“We don’t have to. It’s easier to skip the regulatory pathways.”

A few years ago, I would have argued.

About moats.
About clinical evidence.
About randomized trials.
About defensibility.

That was Danny 2.005.

The past

I left the rat race 21 years ago.

My secret sauce is less ambition.

I don't:

• Want to change the world.

• Raise VC

• Build the next unicorn.

• Be featured on any lists.

• Get the highest valuation.

Instead:

• I want to spend my time working on things I love with people I love

• I want to be able to travel wherever I want to, whenever I want to.

• I want to spend way more time with my friends and family.

• I want to spend more time playing music

• I want to stop doing things I don't like doing.

Thinking about what you actually want in life can force different behavior.
Take you down a different path.
A path towards living more intentionally.
Are you copying someone else's life?
Or designing your own?

Six months ago, I designed Danny 2.026.

The future

I’m building a new category:

Expert-led, agent-operated services.

The rule with new categories is simple:

If you can’t explain it to your grandmother, it’s not real.

So here goes.

The Bubbie Version

I studied physics.
I became a good programmer.

Then after working at big companies like Intel, I became an entrepreneur. 5 startups, 4 wins, 1 glorious loss.

Over 20 years, I helped 42 companies get through FDA.

Today, cybersecurity is part of treating patients.

So I built a business that helps companies pass FDA cybersecurity:

Fixed price.
Fixed time.
Fixed outcome.

Not hours.

Results - what people have always wanted.

Why Outcomes?

Why not talk about AI agents?

Because outcomes matter more than buzz.

AI agents are hot today.

FDA cybersecurity is:

• the gate to commercialization

• the difference between getting approved or not

• the difference between surviving post-deployment or not

What’s Changing

The executives I speak with aren’t looking for more cyber consultants.

They’re looking for cost-effectiveness and prioritization for their product and their company - not for a JnJ.

Ransomware and supply-chain attacks now shape procurement of medical devices.

FDA expectations are higher:

• more explicit guidance

• deeper technical review

• stricter documentation

The old model—teams billing hours—is breaking.

What I’m Building

OpenCRO is built on one idea:

One accountable expert where agents handle the execution.

I distilled 20 years into a system:

• Human workflow for judgment

• Agentic engine (“Pattern Factory”) for execution

Agents:

• write reports

• extract patterns and anti-patterns

• reason over causal flows

• generate threat models from user stories

The Shift

Consulting firms sell hours.

Software sells tools.

This model sells outcomes.

If You’re In This World

If you’re a MedTech leader navigating:

• FDA

• reimbursement

• commercialization

you already know how high the stakes are.

Drop me a note
or book time.

For more design patterns subscribe to Clear Thinking

Subscribe now

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Clinical trials are racing to cure cancer, defeat rare diseases, and bring life-saving treatments to patients — yet researchers are still scribbling data on paper diaries. It took 22 years for electronic data capture to become standard.

In this episode, I sit down with Kim Boericke, the new CEO of Veristat, one of the most data-driven CROs in the business. Kim brings 30 years of industry experience — from Quintiles to Icon to Thread Research — and a refreshingly clear-eyed vision for what needs to change.

We cover how Veristat is using AI to compress drug development timelines, why “write the label first” is the smartest protocol strategy nobody uses, and what the FDA’s new cybersecurity-as-quality guidance really means for sponsors.

Plus: the biggest anti-pattern holding the entire industry back — and why your online grocery order has better data infrastructure than most clinical trials.

Listen to the show here

Outcompete online grocery shopping

I can’t fix your clinical data management plan, but I can fix your cyber and privacy if you want to protect patients and your reputation.

I’m doing a free gap analysis with 10 CEOs this quarter.

Read this before our call - OpenCRO risk framework

The 7-step risk analysis loop and prioritized, cost-effective countermeasure plans built for regulated software.

For more strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

My guest this week was Josh Haimson, co-founder and CEO of Inductive Bio.

Josh built a career in AI for drug discovery and biopharma research

• He started at MIT: machine learning for surgical intervention predictions using medical records

• At Flat Iron Health: he built AI/ML teams for oncology data analysis across hundreds of millions of medical records

• After the Roche/Genentech acquisition: he ran the AI group inside the Roche drug discovery organization.

• Left Roche to start Inductive after identifying ADMET optimization opportunities

I asked Josh, “So what is ADMET exactly”?

Josh, “ADMET (Absorption, Distribution, Metabolism, Excretion, Toxicity) is everything a drug needs to do in the body besides cure the disease”.

It’s one of the biggest bottlenecks in pharma — a grueling 4-5 year process of making thousands of molecules, one iteration at a time.

Inductive Bio built virtual chemistry labs where AI scientists explore millions of hypotheses overnight. The result? That 4-5 year timeline collapses to 1-2 years, with higher quality molecules and better odds in the clinic.

Their secret weapon: a pre-competitive data consortium where pharma companies pool ADMET data — not out of altruism, but because it’s the smartest business decision they can make.

The Industry anti-pattern

But here’s Josh’s warning to the industry: stop believing too much in the AI hype. Biology is still deeply incomplete. No AI spits out a perfect molecule. The real wins come from tight feedback loops, good data, and radical honesty about what we don’t yet know.

Listen to the show here

Visit Inductive Bio here

Before FDA and before the attack

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies.
0 rework requests.
Walmart Vision.

Fixed price. Fixed outcome.

Most MedTech teams think cybersecurity is documentation.

It’s not.

It’s whether you clear FDA
and how you survive the day after an attack.

I’ll review your current cyber and privacy position
and show you where FDA and attackers will push.

No charge.

Start here before we talk
Business Threat Modeling Framework (free, CC license)
→ Download

For strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

Photo by Designecologist

Join other smart people who absolutely love my writing today.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Security blankets and security checklists

Intro

I once did a PCI-DSS compliance audit for a provider doing healthcare payments.

The IT Security lead asked me, “Do you have a checklist?”

I said, “No.”

He said, “Previous security company had an Excel.”

I said, “Good for them. I don’t.”

He said, “Yeah, well, that Excel was like 5 years old anyhow. Way out of date for today’s exploits.”

I said, “Exactly. I deliver outcomes you want today, not 5 year old checklists.”

We did the audit in 3 days. Fixed price. Fixed time. Fixed outcomes.

The stakes are higher in hospitals

That was payments. This is patient safety.

In medical devices that go into hospitals, the stakes are patient lives and the checklist has a different name.

They call it a risk model of patient safety.

And here’s what happens to it after FDA submission.

Your consultant worries that sharing vulnerabilities could expose failed controls, unmitigated attack surfaces, or security gaps they couldn’t close.

Transparency may hurt their next sale — or hand ammunition to competitors.

Consultant culture is project-focused.

Get the contract. Deliver the document. Move on.

The best-practice solution to avoiding accountability is to encourage the industry to trash risk analysis after submission — so nobody can see their dirty laundry.

And that includes FDA.

Free gap analysis

I’m an entrepreneur. Writer. Podcast host. Musician. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. Fortune 1 company. 0 rework requests.

If you’re heading into an FDA submission in the next 6–12 months, I’ll review where you stand at no charge.

The OpenCRO risk framework: BusinessThreatModeling.pdf

7-step risk analysis loop. Prioritized, cost-effective countermeasures. Built for regulated software. Fixed price. Fixed outcome.

Book a free gap analysis

For more strategic patterns on defending your operation:

Subscribe now

Photo by cottonbro studio

Join other smart people who absolutely love my writing today.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Introduction

This piece was inspired by a customer I once had.

When a non-technical person leads a project with highly technical people, you get an anti-design pattern: BlindLeadingTheBlind.

Giganet Health exploits BlindLeadingTheBlind in order to close a big deal with their first large account, LA County and buy time to fix security vulnerabilities.

Giganet Health

Iris felt sleepy and was in a bad mood.

Bob and Barry walked into the Venice studio apartment to show her their plan. “Get a corkscrew”, Bob said, and pulled a bottle of wine out of his backpack. “This is a time to celebrate! I know how we can deliver the system on time to LA County. This is the real thing. Let’s drink to it!”

Bob looks over at Barry, Italian gangster look, polo shirt, slacks, tasseled loafers. Barry poured them some wine and raised his glass - “Alla vita, alle ricchezze e al buon vino”. Bob’s face was lit up, “Happiness is inspiration. Let’s drink to it! This is a turning point for Giganet”.

Pesya, their jolly hacker matriarch, slightly overweight, always laughing, always thinking about going to the gym; had discovered vulnerabilities in the Giganet system with $25M in exposure to fines for CCPA privacy violations.

Iris thinks back to their conversation last week:

Pesya, “Iris, You cannot release the system like this to LA County.

In addition to the DDOS vulnerabilities, there are XSS vulnerabilities. Attackers may be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. You will be in violation of CCPA.

CCPA penalties have an upper cap of $7,500 per intentional violation or $2,500 per non-intentional violation. It may seem like a small penalty, but it can eventually grow massive. The penalties can quickly add up because one consumer equals one violation.

Pesya, “How many users will LA County have?” Iris replies, “About 10,000 users”.

Pesya, “You have $25M in exposure”. She deliberately uses the word exposure with Iris so that Iris will understand financial impact.

“We’ll need another 4 weeks for security testing and validation after Lena and Justin finish. Yasmin’s back end module is not affected and the rest of the front-end is fine. You need to allow 12-13 weeks to fix this problem”.

Giganet has a delivery milestone in a week with LA County, their first large account. The revenue and reputation are critical to Giganet survival. They don’t have 12-13 weeks. They need the cash.

Iris, “OK, guys, what’s the plan?”

Barry, “Bob, it’s your idea, so go ahead”.

Bob, “Pesya knows their security consultant. Noah Cheng was one of her hacker apprentices. She’ll talk to him, and that will be enough”.

Iris poured herself some more wine and drank. She had remarkably beautiful hands - slim, white and smooth, fingers delicately pointed.

Iris, “Is this legal?”

Bob, “Totally. Remember how I told you that the best defense is a good offense?

We release the software to the customer on time, get the milestone payment and find a way for the customer to not actually use the software. We’ll do that with their own bureaucracy.

Noah will explain to the customer project manager that even though Giganet is CCPA compliant, they need to set up application firewall rules to limit internal network access for HR”..

Iris, “That doesn’t sound like a lot of work to me, maybe 2-3 days”.

Bob, “You’re right, it’s 3 days work but it will take them 4 months. Watch and weep”.

ISD - Internal Services Department Information Technology Service

Todd Jameson is project manager for rolling out new Web applications in LA County.

Todd works for Dell Technologies Services and is onsite with ISD Information Technology Service. He came up through the ranks as an analyst and project manager at Perot Data Services and after the acquisition and name change, stayed with Dell.

He’s been with LA County for 12 years.

If you were to ask Todd, he would say he is a “technology leader”.

A technology leader that spends his time in meetings and tracking projects.

A technocrat dedicated to budgets and vendor management.

He likes reading Gartner reports to follow broad tech trends. Lately, with the outburst of AI, he’s started talking to vendors. Talking to vendors on the Gartner hype list can turn into a full time job but it’s more interesting than meetings with his change control board.

He has a 9:00 meeting with Noah Cheng, their cybersecurity consultant for web application development.

Todd, “Hey, Noah. I wanted to touch base with you regarding our upcoming deployment of the new Giganet SaaS application. How’s everything going on the security front?”

Noah, “Security is Dope, man. You know their engineering team are ex-Google executives and their CSO is Pesya Eichbaum. She’s number 1 in the world for browser security.

However, as I dive deeper into the Giganet architecture and potential vulnerabilities, I believe that having an application firewall for HR access is a proactive measure to mitigate potential risks to your network. It’ll add an extra layer of protection against any unforeseen threats. You can use your existing F5 firewall”.

Todd, “I don’t understand the technical side but I don’t want to compromise on security. Can you give me a plan?”

Noah, “Of course, Todd. I’ll prepare a comprehensive proposal with time estimates, potential benefits, and a deployment plan. I’ll make sure to highlight the added security and potential risk reduction it brings to the table”.

Todd, “ Great, Noah. Please keep me in the loop as you work on this proposal. We want to make sure we’re making informed decisions about our security measures”.

Noah, “Will do, Todd. I’ll get started on that right away and will keep you updated as I make progress. If you have any immediate questions or concerns, don’t hesitate to reach out.

Todd, “Thanks, Noah. I appreciate your dedication to our project’s security”.

After the meeting Noah calls Pesya.

Pesya, “How did it go?”

Noah, “Nailed it, I just bought you 4 months. It’ll take me a month to prepare the proposal, it’ll take Todd another month to get it past his internal review committee, it’ll take them another 2 months to implement. In the meantime, you’re good to go with HR for the delivery milestone”.

The Blind Leading The Blind Anti-Pattern

This anti-pattern is created when a non-technical person leads a project with technical people.

This anti-pattern is created by a project manager who leads with laundry lists, turf management and organizational politics. She’s often regarded as a nuisance by the technical people. Even though her intentions are good, the results are often negative as the team gets bogged down in details and changes, causing additional problems.

The organization moves slowly, often without a sense of strategic direction that is integrated with business strategy.

Solution

Flip the pyramid.

People who actually understand and develop technology work best in small autonomous teams creating things.

The LA County example works in an inverted way: Todd, the project manager, provides technical requirements to his internal information security team for implementation. His internal infosec team doesn’t have the business context or understanding that the Giganet system can save millions of dollars. They don’t care, and given competing priorities, they may keep the project back.

About Giganet

Giganet Health is a Digital health startup based in Venice, California. The founders are industry veterans that worked at Silicon Valley tech companies.

Giganet uses agentic AI and the Apple Watch to monitor and relieve work-related stress as part of a holistic program that empowers people to own their own good health and reduce doctor visits by up to 83%.

Their customers are large employers in California.

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. Fortune 1 company. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library - a steal at $150.

Subscribe now

It’s not every day my guest is a founder and Olympic athlete.

Simon is a two-time pole-vault Olympian and seven-time founder who came to the US from Australia on an athletic scholarship at the University of New Mexico.

And the rest is history.

What really struck me wasn’t the medals or the exits — it was how willing he is to call bullshit on the way our industry “has always worked.”

Simon’s new company, Ryght.ai, is taking a flamethrower to the slowest, most fragile part of clinical development: site selection and activation.

Instead of begging for EMR integrations and pretending that “lots of patients” is a real strategy, they’ve built digital twins for 100,000+ sites in 192 countries, then layered on agentic AI to find, rank, and activate the right sites and PIs in days, not months.

In reality, EMR data is one noisy variable among many — and often the least interesting one. Site incentives, operational capacity, competing studies, PI conflicts, regulatory history: these are where trials live or die. Focusing on EMR first is like judging a pole vaulter by their warmup jog.

In this episode of Life Sciences Today, we dig into how Ryght.ai works, why enrollment failure is mostly a site problem, and what happens when you design with AI from first principles instead of bolting it onto legacy workflows.

Listen here Beyond the EMR: Simon Arkell Rewires Clinical Trials – Life Sciences Today Podcast Episode 53

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

Quote courtesy of Jim McCarthy, Dynamics of Software Development

Intro

When you were a kid, did you ever tell your mom,
“Dad already agreed…”

And your sister would go to your dad,
“Mom’s letting Danny stay home from school—why can’t I?”

If you played it right, the 2 of you got away with murder.

Today, writing software is a family affair with two parents: human and AI.

Software is written in a dialog between them.

The dialog between machines and humans started 200 years before ChatGPT.

Charles Babbage designed his Analytical Engine in 1837. It was never built, but Ada Lovelace wrote a program for it in 1843. Ada was a colorful character, daughter of Lord Byron, directed by her mother to learn science and mathematics.

Looking at her program, it is surprisingly close to what we do today.

Loops. Named variables. Structure.

But Ada saw something deeper.

She imagined machines that could do more than compute — write music, manipulate symbols, process abstract ideas.

Great software comes from that fusion.

Today, great software fuses human intent, taste and judgment in a dialog with AI execution, expansion, and iteration.

Today, I’ll show you how that fusion works in practice:

• One case where the human dominates

• One case where the AI dominates

Great software has two parents

In the past year, I’ve spent less time writing code and more time writing specifications for AI.

I can ask Warp Code if the model is a good fit for the job—and get an intelligent answer.

Here’s what that looks like in practice:

/agent what model are we using

You’re using Claude 3.5 Haiku.

for an application to plan tax-optimized liquidation of stocks and optimized lots should I use a different model?

No, Claude 3.5 Haiku is capable of handling tax-optimized stock liquidation planning. It can work with:

• Tax lot identification strategies (FIFO, LIFO, highest cost, specific ID)

• Capital gains calculations (short-term vs long-term)

• Tax-loss harvesting logic

For a production application, the main considerations are:

1. Accuracy over speed: Ensure thorough validation of tax calculations and compliance rules

2. User responsibility: Include disclaimers that users should consult a tax professional

3. Data security: Handle sensitive financial data securely (encrypted storage, HTTPS, etc.)

4. Testing: Comprehensive test cases for various scenarios and edge cases

Haiku is suitable because the model isn’t the bottleneck for this type of application—careful implementation of tax logic and thorough testing are what matter most. If you need real-time processing of large datasets or complex multi-step reasoning chains, you might consider a more capable model, but for typical tax planning workflows, Haiku works well.

Notice what’s happening here: I’m not writing code. I’m interrogating the model, validating assumptions, and testing the system design alternatives.

The first coders were mathematicians.

In the 70s, the systems analyst emerged—someone who spoke with users and wrote specifications for coders.

As programming languages evolved, people became ‘programmers’ and expanded their activities into design, code and communication with other humans.

A great programmer is great at design, code and communications.

If that sounds hard - it is.

In 2022, with the launch of ChatGPT that changed again.

AI reset the division of labor between humans and machines.

But it’s more complex than that.

In the next section - I break down human and AI work.

Humans and AI - the division of labor

There are 2 kinds of activities in writing software - human-facing and AI-facing.

Human-facing activities

1. Stakeholder alignment - getting other people to agree with you and support your project

2. Market discovery - discovering if other people will use your product

3. Business tradeoffs - buy vs. build, do-nothing vs. do-something

4. Regulatory strategy (healthcare, MedTech, drug development, energy …) - how do you thread the needle with the regulator? FDA Cyber regulation for medical devices requires traceability of cyber testing and explanation how a control has been tested and validated to work.

5. Business model validation - understanding from other people if they want your product, when they’ll want it and how much they’d pay

6. Capital allocation - getting other people to fund your project

AI-facing activities

1. Code generation - prompting the LLM to generate code for your task. Emphasis here on you focusing on the desired outcome in your prompt. Specifically -
   
   Write a very specific story of the outcome you want and need

   Do not be tempted to talk about the process, the how, your ideas - let the AI decide how.
   Front-load your critical constraints - in time, money and results
   🔥Every ambiguity = risk on fire
   

2. Test generation - the latest AI models figure this out and often suggest tests

3. Build pipelines - with memory the AI model usually knows how to do this

4. DevOps - prompt the AI for what you need - this is a lot like code generation activities

5. Refactoring - an area where AI is exceedingly better than humans, although when it gets it wrong, it gets it very wrong.

6. Static analysis - like refactoring

Is the dialog ever equal?

It depends.

In personal productivity applications - AI dominates. In enterprise systems - humans dominate.

Let’s see why.

Does AI eliminate programmers?

The short answer is no.

In personal productivity applications (e.g. writing social media posts, or filing invoices from your email), the human cost of prompting is low and the payoff is high for AI agents to do the work:

• You make your own tradeoffs

• You write specs, AI writes code

• You can (and usually) ignore risk

In enterprise systems (e.g. airline reservations systems or healthcare information systems), the human cost is high, relative to the cost of AI tokens. You need to execute all 6 of the human-facing activities, often over long periods of time to sustain your project.

• You don’t make tradeoffs alone inside the enterprise. You need organizational politics to get buy-in for your idea.

• You need to align with other humans, comply, and document

• You need funding

• You cannot ignore cyber and privacy risk, internal data governance and industry and regional regulations.

In enterprise systems, humans lead the dialog.
In personal productivity apps, AI leads the dialog.

Like when you were a kid with your parents, there is a division of dialog.

In my family, my Dad led the dialog on science and my Mom led on homework.

We’ll close the essay with some thoughts on software risk for AI-human software development.

AI prompting for risk analysis in software development

How will AI-human teams create secure software?

I will go into more detail in a future essay but here’s a teaser.

Parallel to the AI-human build dialog, we need to conduct an AI-human attack dialog.

And not wait for the FDA to remind us about cybersecurity.

Outro

Ada Lovelace died in 1852. Her name lives on in the Ada programming language, designed in the 70’s for the U.S. DoD for safety-critical, embedded software.

It’s still used today in defense and aerospace where failure is not an option.

Every year on the second Tuesday in October, the contributions of women to science, technology, engineering, and mathematics (STEM) are celebrated on Ada Lovelace Day.

Let’s celebrate Ada Lovelace today for her incredible vision fusing human creativity with machine computation.

We’re still learning how to build that partnership.

It sounds like the beginning of a story - and it is.

Asta and Chris were my guests on the podcast recently.

They are based in Dubai and they are building a startup that provides imaging from radiology scans to train AI models.

Their twist ?

They provide the images as ‘infrastructure as a service ‘ for countries.

In the US, it’s almost impossible to get non-US data and outside the US, its almost impossible to get US data. Countries have their own privacy regulation and country level data security requirements.

And that’s where Medsyntra come in.

Chris is a radiology software veteran and Asta is a entrepreneur. And because they’re not locked into the US healthcare system mentality - they decided to develop a country level platform for AI developers.

In Episode 52 of Life Sciences Today, we sat down to talk about what it actually takes to build global medical imaging infrastructure for clinical AI.

Medsyntra aggregates and de-identifies millions of imaging studies across radiology, pathology, oncology, and women’s healthcare — ethically sourced, sovereignty-respecting, and annotation-ready. That’s harder than it sounds.

Chris and Asta don’t sugarcoat where the tradeoffs bite.

We covered the questions most AI teams avoid: Why do models trained on one population quietly degrade when deployed in another? What does data sovereignty actually cost you when you’re trying to build global intelligence? And is “ethical data” a real standard — or a marketing layer over bad practices?

One thread I kept coming back to: the difference between assembling a dataset and building infrastructure. Chris and Asta crossed that line early, and the decisions they made at that fork still shape how Medsyntra operates today.

We also got into annotation — the bottleneck nobody budgets for — and the anti-patterns Asta sees repeated across the medical AI ecosystem, often by teams that should know better.

If you’re building AI for clinical use, or advising companies that are, this episode will reframe where you put your attention.

🎧 Listen now

Visit Medsyntra here

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

I originally wrote this piece 2 years ago. It was the design-pattern that closed my series on substack - “Bob and Alice - Anti-Design Patterns in Life, Love and Tech”.

The last chapter in Bob and Alice, was called Hezbollah is here - which is familiar to Israelis as we go into season 3 with Iran - or is it season 5? I’m not sure.

My substack series turned into a book on Amazon - Bob and Alice - an anti-love story.

I get a check every so often from Amazon from people who buy the book. Amazing.

Hint. Hint.

I did the cover graphic with ChatGPT 3.5. I kind of like it a lot.

Happy with what you know or overloaded by work?

Life, love and tech require constant learning, yet we are often happy with what we already know or overloaded by the work we already have - and left with no energy at the end of the day to learn new things.

This 10-part design pattern was inspired by my friends and co-workers - the people who served as the role models for characters in the series and in the book - Alice, Bob, Pesya, Yasmin, Mark and the rest of the team at Giganet. The names have been changed but the people are real.

My thanks to you all for teaching me how to learn.

10 things you should learn about learning

1. Your memory is not digital
   Fetching a memory strengthens and modifies that memory.
   
   When you try to remember something, activation energy spreads to all the connected pathways in your brain, like heat from a fire.
   
   Some of the activation energy leaves related pathways primed for more activation for hours.

2. Your memory is not continuous - it’s made of chunks
   Long-term memory is limitless, like a disk with an infinite amount of storage.
   Working memory serves general intelligence. It’s limited and can be trained like professional musicians who practice 10 hours/day.
   
   The brain works on information in chunks.
   
   Reduce your cognitive load by getting rid of irrelevant data and by organizing it in an easy-to-use format - like a table instead of wordy content.
   
   When you learn new things, you can improve your performance by chunking and reorganizing the task.
   
   This is really important when you’re learning a new skill or a new language.

3. Experts recognize, beginners reason
   Experts have seen it all before.
   
   They recognize and remember the patterns that helped them succeed in the past and the anti-patterns that led them to failure.
   
   This happens in less than a second.
   
   Experts can figure things out because they memorized the pattern from experience.
   
   This pattern-matching gives you superpowers in your field of expertise - be it code, marketing or whatever.
   
   Beginners need to see examples and figure things out.
   
   It’s a process that can take hours or days and beginners usually get it wrong.

4. When you learn, the brain flips back and forth from concrete to abstract
   Experts rely on generic and abstract patterns, and don’t need to worry about details.
   
   Beginners get stuck in details and have trouble connecting to the big picture.
   
   When you learn a new concept (like AI agents), your brain switches between an abstract idea (autonomy) with concrete examples (agents reading your email and filing supplier invoices).
   
   The more examples, the better. Mistakes are good. This process in the brain is called unpacking.
   
   You learn better when you flip back to examples from the abstract pattern. This is called repacking.
   
   The more you learn abstract patterns, the more concrete they become for you.

5. Spacing and repetition matters
   To learn something new and get really good at it (like playing the flute), you need to learn how to do it with a lot of repetitions and with breaks between each learning session.
   
   You cannot “just do it”. You are not Nike nor MJ
   
   Each little learning session, each little debug session helps you get better.
   
   Cramming for the test never worked in school and doesn’t work for any learning objective.

6. AI does not obsolete learning
   We learn by making connections between stuff in our brain.
   
   This creates a deep understanding of what stuff means and how to use it.
   
   Once memorized, you can retrieve a problem and the solution in a milli-second.
   
   With AI, you need to write a prompt, try it out a few times and then modify it for your needs.
   
   You won’t remember the solution because you didn’t learn it yourself; you copied and pasted.
   
   And it’s much slower than your brain

7. Problem-solving is not a generic skill
   Almost all of our generic skills are far worse than domain-specific problem solving.
   
   Our generic understanding of selling something is almost irrelevant for a specific domain like agentic AI.

8. Experts can sell you stuff but they can’t jack into your mind

It is almost impossible for an expert to jack into your mental model if you are a beginner.

You will probably fail if you buy a course online from a large account on social media.

9. Predictors of success in any given discipline are bad
   Success of learning a new discipline like copy-writing is a mix of your aptitude and your learning process.
   Some people believe that a natural gift is enough.
   Others say that practice and systems are enough.
   
   Both groups are wrong.
   
   It’s impossible to predict who will be a good programmer|copy-writer|marketer | salesman | manager.
   
   Smart people are not always good programmers. Good programmers are not always the smartest.

10. Your mindset matters to your success but not like you think
    There are people who believe in a growth mindset. Practice long enough and believe in your success and success, wealth and happiness will come.
    
    Other people believe in a fixed mindset and aptitude. If you struggle with success in developing Agentic AI apps, it means that you are not cut out for it.
    
    Both groups are wrong.
    
    For example - anyone can learn some basic physics but only 1 person/year out of 7.8 BN people gets the Nobel Prize in Physics.
    
    Rewarding a growth mindset for effort doesn’t work either
    
    People are not stupid - they know when they are working hard and not getting results.
    
    Rewards should be focused on achieving goals.

Summary

• Improve your learning skills all the time. Work with a person who keeps you accountable.

• There are no fixed rules about who is good at something be it leadership, music or marketing

• Read a lot of code to be a better programmer. Read a lot of copy to be a better copy-writer

• Experts are bad at training beginners

• Spending time away from a problem can help solve it.

• Using AI does not make you an expert. You still need to learn and develop the deep memories and patterns in your brain.

• Believe in your ability to change your abilities

• Seeking to succeed is better than seeking to avoid failure.

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber. After working with 42 MedTech companies and 14 FDA clearances on cyber and privacy projects - I decided to create boutique offer for medical device companies who care about their patients, their clinical data and their reputation.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

My guest this week on Life Sciences Today was Erez Lampert, founder and CEO of Pathkeeper Surgical. PathKeeper Surgical is changing spine surgery for 1M Americans

Erez Lampert already changed one field of medicine by leading development of Invisalign’s iTero 3D scanner. In this episode of Life Sciences Today, he explains how he’s now taking on spine surgery with Pathkeeper, a 3D imaging + AI navigation system designed to stop surgeons from “flying blind” in some of the most delicate procedures in medicine.

Erez breaks down the impossible choice spine surgeons face today: either low‑cost fluoroscopy with continuous radiation and guesswork in 2D, or ultra‑expensive robotics that slow workflow and demand huge capital and infrastructure. Pathkeeper offers a third option: optical 3D guidance with no radiation, no million‑dollar robot, and a workflow designed around how surgeons actually operate.

We dive into Pathkeeper’s business model and why the real leverage sits in the $10B US spine implant market, where navigation can be the “razor” that drives recurring “blade” revenue for implant partners. Erez also walks through the multi‑year grind behind two critical US deals: distribution via High Ridge Medical (Zimmer Biomet spine) and broad hospital access through Vizient.

Along the way, we puncture the myth that “Israelis don’t know how to sell in the US” and talk about the real anti‑patterns holding medtech back.

Listen to the show here

Visit PathKeeper Surgical here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber.
42 MedTech companies. 14 FDA clearances. 0 rework requests on threat model submissions.

You have threats to your patients, your clinical data, your reputation.

You shouldn’t be discovering your cybersecurity gaps during FDA review.

We find them first, document them the way FDA reviewers expect — and deliver to you a cost-effective, prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

Today is a landmark - episode 50 of Life Sciences Today! Less than 9 months in - the show is on fire. If you are TechBio founder, I’d love to host you on the show. Reply or DM me and we’ll make it happen.

My guest this week was Kiril Pevsner, CTO and co-founder of ProtAI.

In this Life Sciences Today episode, I spoke with Kiril, CTO and co-founder of ProtAI, an Israel-based biotech developing drugs for cancer and autoimmune disease. ProtAI’s AMES platform combines structural proteomics with AI, using experimental “geometrical clues” to refine protein structures down to subatomic resolution. That extra precision lets them design small molecules for targets that were previously considered “undruggable.”

Crucially, ProtAI is not a “tools” company. Like Dafna Koller’s Insitro, they chose to own the drug pipeline, not just sell the platform. Their lead program targets estrogen receptors–positive breast cancer. For a completely novel mechanism with little prior data, they reached a near–development candidate in under 12 months—vs ~3 years by industry standards—and plan to enter the clinic in 2026 in the US and Israel.

Kiril’s biggest “anti–design pattern” in AI drug discovery:

Overhyping the AI itself. Pharma doesn’t buy models; they buy de‑risked drugs backed by hard data. Trust comes from experimental validation, fast iteration cycles, and clinical results—not from glossy benchmarks.

Listen in to learn how ProtAI thinks about moats, data, trust, and why speed of learning is the real superpower in AI-driven drug discovery.

Visit ProAI here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber. 42 MedTech companies. 14 FDA clearances. 0 rework requests on threat model submissions.

You have threats to your patients, your clinical data, your reputation, your commercial operation, and your engineering roadmap

You shouldn’t be discovering your cybersecurity gaps during FDA review.

We find them first, document them the way FDA reviewers expect — and deliver to you a cost-effective, prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Courtesy of Pixabay

Intro

Today I’m launching OpenCRO — Real-world MedTech Cybersecurity,

OpenCRO is an expert-led, agent-operated company.

It’s been a journey. 20 years. 42 MedTech companies. 14 FDA clearances. 1 De Novo world speed record.

After conversations with many of you over the past 3 months about why MedTech companies die, I decided to do something about it.

• Fixed outcome. Fixed price.

• Not hours.

• In a post-management consulting world, that’s the new delivery standard.

  Why FDA Cyber first? And not an AI-agent story?

  Because the outcome is far more important than the buzz.

AI-agents are hot today. FDA Cyber is the gate to your commercialization tomorrow — and the robustness of your security countermeasures the day after.

Ransomware and supply-chain attacks shape how hospitals evaluate device vendors. FDA guidance is more explicit, documentation expectations are higher, review questions are deeper and more technical.

I built OpenCRO with my expertise in the security and privacy space in medical devices/software as a medical device/digital therapeutics/AI-based diagnostics and consumer digital health applications. I was inspired by Practical Threat Analysis, a Microsoft desktop tool that we used at Open Solutions, my security and privacy consultancy back in the day.

OpenCRO integrates a human workflow and an agentic-AI engine I call the Pattern Factory. Pattern Factory agents write reports, extract design patterns and anti-design patterns from content, reasoning over causal flows. Other agents generate threat models from user stories.

In this essay, I describe a debrief of the first mission that OpenCRO executed in January 2026.

Mission Objective

Deliver FDA Cyber threat analysis compliant with 2026 guidance, on time, without regulatory deficiency.

Outcome

Delivered on time. No known structural deficiencies. 11 iterations required.

Cost

1. 2 hours in workshop with customer writing cards

2. 4 hours of model iterations

3. 2 hours in RA/QA manager review

4. 3 hours in FDA reviewer simulation.

5. 9 hours of rework.

What happened (Facts/data)

1. A customer contracted with OpenCRO to perform an FDA Cyber threat analysis for their electrophysiology lab system.

2. We performed a IRL data collection workshop with the team, where they wrote down risk scenarios on paper cards

3. Paper cards were scanned and converted into a user story in markdown format.

4. The Pattern Factory agents generated a threat model from the story.

5. The process worked reliably and took about 30s to populate the threat master tables and relationships in an iteration.

6. I wrote a spec, and the Pattern Factory agents generated the reports (manually imported into Google sheets and linked into the google doc of the report).

7. I discovered a number of weaknesses in my process and in the code. The report went through 11 iterations with 3 iterations of review using 2 language models (chat and Claude) in simulated roles of FDA reviewers. The final report was released on time and is labeled V4.

We’re using Markdown to write stories like this to make it easy for the agents to generate the threat model entities in the PostgreSQL database.

Why did it happen? (Gap between planning and execution)

1. Not properly understanding of threats to patient and medical user safety, for example the ‘Preset configuration may be changed’ threat scenario. The threat was incorrectly classified as attacking patient safety, when in fact it’s an application function used to configure the device for procedures.

2. Not having integral attacker type support in the agent flow. My development decision to postpone implementation of attacker types (defined in the data model but not implemented in the agent flow) resulted in a lack of clarity regarding the classification of threats and in retrospect, I should have invested the 4 hours work to implement attacker types in flow.

3. Not reading the latest guidance thoroughly - relying on LLM interpretation resulted in unnecessary work on my side to figure out the latest guidance, for example residual risk without financial value, and vulnerability exploitability.

4. At one point I started fine tuning the model by surgical changes in the UI and (in 1 case) the PSQL command line which resulted in a lot of manual work that could have (and should have) been saved by creating a new card version and regenerating the threat model with the generate model flow.

Primary root cause

Starting the project before reading the device’s intended use.

Intended use defines safety domain, and safety domain defines asset classification. Without deep understanding of intended use, the threat model drifted.

What surprised me

1. An attack vector with a custom exploit in a software update package emerged late in the game.

2. The current device system architecture with its 21 security countermeasures mitigated 97% of the threats in the model.

3. The model generation pipeline was reliable during the pressure of iterations

4. The bottleneck in the process was not the agent model generation speed (30s) but modeling discipline.

Improvements must focus on modeling discipline (intended use, domain locking, attacker typing) rather than increasing agent complexity.

How can we improve OpenCRO for future missions?

Process improvements

1. Establish the ‘Category’ of the project model as part of the standard terms of conditions of the engagement (FDA Cyber, Business threat modeling, HIPAA, GDPR etc)

2. Understand intended use of the device before modeling in order to properly establish roles of safety, efficacy, data integrity and data privacy in the model.

   1. Phase 1 - manual reading to deepen understanding by analyst and discussion with customer RA/QA.

   2. Phase 2 - agent validates the card story for consistency and completeness vis-a-vis the intended use.

3. Classify attacker types as part of the workshop with the customer

4. After the initial generation of the model, validate the MD card story with the customer team. In particular - validate the DOMAIN tagging in the cards with the customer team, since this will help later on with sanity checks such as privacy threats not tagged in PRIVACY domain.

5. Mandatory meeting with CEO to review and sign off the final report version.

6. No manual DB edits after model generation. All changes must originate from a revised card story and model regeneration.

Code/AI agent improvements

1. Implement the attacker types and attacker_threat relationships in the MD card story, generate agent flow, and upsert procedure (they’re already in the data model)

2. Test if system properly supports multiple vulnerabilities per threat, if not fix bugs

3. Add dry run feature to generate model from story link (basically same agent flow as extract but stopping before calling the upsert procedure).

4. Improve model generation traceability:

   1. Alter column models.version from text to integer column incremented by the upsert procedure every time the model is re-gened.

   2. Add column models.story_link text - story_link used to generate the model entities

5. The edit model currently supports creating a duplicate new model functionality (which is convenient). Better to have a ‘Duplicate model assets’ function as well instead of having to manually re-enter the Model assets

6. Add delete entities before model generation to the upsert (did it manually this time which is a bit dangerous)

7. Use the model ‘Category’ to support different regulatory/business categories:

   1. Different report sets for different categories (FDA Cyber Pre-market guidance, HIPAA Security Rule, GDPR, Business threat modeling etc). The tacit assumption is that the analytical model is invariant across all categories but the reports may differ (for example - VaR in Business threat modeling and exploitability and residual risk in FDA Cyber)

   2. Parametrize binning of mode qualitative valuations (low, medium, high etc) instead of hard coding in the PG logical views.

   3. Implement view groups - this will enable use to have a unique group of views for each category (FDA Cyber, Business threat modeling, HIPAA, GDPR etc)

8. Use the system to log activities in order to perform time utilization analysis for customer-facing and back-office activities (Data collection, bug fixes and enhancements to Models, Cards, Assets, Views, Agents, UI, backend). Use the RULES in order to create views of time utilization.

Outro

OpenCRO delivered on time. More than speed, it delivered depth of analysis of residual risk and exploitability.

In 2026, OpenCRO provides discipline and depth that generalists can’t deliver.

Reply to this post and I’ll send you a free copy of my book “22 Anti-patterns that kill companies.”

If you, a colleague, or a client are submitting a device to FDA in the next 30-90 days — book a call and we’ll see if you’re a good fit.

Life Sciences Today This Week

My guest this week was Sagi Gidali from Rafa’s Moonshot.

Danny and Sagi discuss how Rafa’s Moonshot is turning a rare genetic disorder (STXBP1) into an investable, de‑risked therapeutic opportunity.

Sagi explains how his tech/entrepreneur background shapes a for‑profit mindset around fundraising, biopharma partnerships, and making rare disease indications attractive to industry. They cover building a global network, leveraging grants and consortia, working with academia/CROs, and planning the flip from nonprofit to for‑profit. They also dig into industry “anti‑patterns,” including copy‑paste development strategies, and explore a start from the drug label and work backwards approach.

Rafa’s Moonshot is building a full-stack engine to take an ultra‑rare genetic disorder, STXBP1, all the way from scattered case reports to real, clinic-ready therapies. They start by doing what traditional drug developers often ignore: systematically finding and organizing the global patient population (about 1,400 diagnosed so far), running natural history studies, and deeply understanding disease mechanisms.

On top of that data and insight, they assemble consortia of academic labs, CROs, and biotechs, then use philanthropic capital to unlock 3–4x leverage in non‑dilutive grants for their research partners. The long‑term play is to flip from a nonprofit hub into a for‑profit therapeutic company once there’s enough de‑risked biology, IP, and clinical direction.

Who needs what they’re building?

• Biopharma and biotech looking for de‑risked, ready‑to‑develop rare disease programs.

• Academic groups needing funding, infrastructure, and industry‑grade coordination.

• Investors hunting for high‑impact, capital‑efficient CNS/neurogenetic plays.

• Most importantly, families living with STXBP1 and similar CNS disorders, who need a path to actual treatments rather than yet another descriptive paper.

Sagi closes with his vision for a complete STXBP1 solution, a new CNS neurogenetic research center in Israel, and a stronger Israeli life sciences ecosystem.

You can see the episode here

In 2026, I’m helping 100 founders succeed more

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4.

I’ve been building in tech, cyber, privacy, and clinical data for 25+ years across Israeli medical device startups, Verily, Amgen, and the Fortune 1 company.

I work at the intersection of business, engineering, AI and clinical data.

If you love my writing — share it

Share