Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

This week on Life Sciences Today

What if clinical trial protocols could go from months of track changes in Word to a clean protocol generated by AI?

This week, I sat down with Pedro Coelho, founder and CEO of Biorce, to explore how his team went from tagging mistakes to building AI that gets it right the first time.

Clarity of thought

The first thing that stands out in a conversation with Pedro is his ambition, and the sharpness of his thinking.

Biorce didn’t start by designing AI prompts to write clinical protocols.

They started by identifying problems - the first is a tough fact of life that everyone involved in clinical trials knows - the number of changes to the protocol during a clinical trial.

The number of changes, the messiness of track changes, multiple versions and implementation into the clinical trial data collection systems for sites and patients is a nightmare for life sciences companies/

Someone told Pedro early on: you’re like McKinsey finding problems and not fixing them.

That comment helped trigger a pivot. Instead of only spotting flaws, Biorce began using AI to correct and improve protocols directly.

The result is a system that generates clinical protocols in 5 minutes; protocols that are 85–95% complete, more robust than the usual process with Word, and less likely to require endless revisions in the first six months.

I was involved in 70+ clinical trials and I know what a mess trial amendments can be.

When Biorce scales it will be a major change to a major blocker in clinical trials.

The anti-pattern: believing in things that don’t work

A little background first.

Monitoring is a manual activity that involves people (CRA - clinical research associates) going to research sites and comparing pieces of paper with digital records.

Monitoring can consume 20–30% of a trial budget, while updating less than 3% of the data points ( a study Medidata did on 14,000 drug trials over 10 years ago). At FlaskData we analyzed 10M+ data points in medtech trials and found that the number updated by CRA monitoring activity was < 1%.

In 2009, FDA issued guidance for RBM (risk-based monitoring).

During COVID, the industry went to RRBM (Remote risk-based monitoring, doing the same thing over zoom) and then to RBQM (Risk-based quality monitoring, doing the same thing but prioritizing the massively non-value add activity under the guise of improving quality).

Monitoring is part of a broader anti-pattern that people in drug development know but rarely say out loud: huge parts of the system persist because they are inherited, not because they are effective.

Biorce is interesting because of the clarity of their thinking, their logic and execution.

They’re part of a wider movement of clinical software startups challenging assumptions and rocking boats of bureaucracy.

Listen to the show here

You need a good nights sleep to think clearly

Anyone who dealt with a cyber event appreciates the value of a good nights sleep.

I know. I once got a 2AM call from a customer ICU, back in the day.

FDA-cleared devices in hospitals are attacker entry points.

Today, hospitals are attacked by AI-driven ransomware-as-a-service platforms.

Cyber risk doesn’t stop with FDA clearance.

It stops the night you can sleep well.

Get a peaceful nights sleep

Photo of Moldavanko courtesy of Kyiv Post

I’ve been writing for 140 straight weeks.

This week I continue the story of Giganet Health - the digital health startup from Venice, CA. Giganet Health sells health solutions to gig worker employers in California - organizations like LA County are all Giganet Health customers.

This week - the Giganet team needs to scale up their security as they try to close their first major enterprise account.

Like most startups - the answer comes from a friend of someone inside the company.

And - we greet an old friend: the anti-design pattern: Boss Gets Stuck.

You may ask - what does Boss Gets Stuck have to do with cybersecurity?

You’ll just have to read today’s episode of Clear Thinking.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

Lyubka Shneiveis - matron of the hackers

Little old Lyubka is the matriarch of the Silicon Valley hackers.  

She was born in Moldavanka, the tough south-side Odessa neighborhood, which was as Isaac Babel wrote: “crowded with suckling babies, drying rags and conjugal nights filled with big-city chic and soldierly tirelessness”..

Her family immigrated to America and they settled in another tough neighborhood, Chicago’s South Side. 

Lyubka was the youngest of 5 children, gifted in math and science. Her parents worked hard and pushed their children to academic excellence. Lyubka completed the University of Chicago with a PhD in theoretical computer science. After graduating, she joined Google in 1999, where she fit right in. 

When Google fired 12,000 people to focus on AI, Lyubka was already in her mid 50s.  

It was legend that she was the only employee who kept her original desk for 25 years, where she researched browser security. 

She reported to Mark, the tall, lanky bald man. 

Lyubka didn’t mind being terminated. Her kids were on track. She had money in the bank, her 2 books on browser security were published by O’Reilly and sold nicely. She was on her own, doing what she enjoyed, an empty-nester divorcee who did not have to deal with an ex and children. 

She divorced Bill after he left her for a younger, more svelte woman.  

Lyubka raised their 3 kids on her own. Her oldest son graduated CalTech in aerospace engineering, the middle daughter taught kindergarten in Palo Alto, and the youngest was back in Chicago doing graduate work in finance at the University of Chicago.

Venice, CA

Bob, “Iris, we need someone for software security, do we have the budget to hire someone?”.

Iris jumps in, “With the LA County contract, yes. Do you guys have someone in mind?”. 

Lena said, “Sure. Bob - you should call Lyubka. Her son lives in West LA, she is moving to LA”.

Bob was not surprised that Lena had all this information.

Yasmin, Lena and Lyubka were close friends. At Google, the 3 of them had lunch together every day. It was an improbable combination that worked well.

Petite GI Jane Lena, the elite software warrior. Married to Sergey, the RF board designer and gamer.

Yasmin, the slim, tall, very beautiful kernel developer and serious runner. Dating rich LA Persians.

Lyubka, the jolly hacker matron, slightly overweight, always laughing, thinking about going to the gym, but more interested in CVE-2023-6345, the zero-day she had just discovered in the Chrome 2D graphics engine.

Iris, “Lena, can you call up this Lyubka person and bring her in for an  interview?”

Lena, “Iris, sure, but she doesn’t need an interview. You need to convince her to come to us. She  is the number one person in the world in browser security. Lyubka will be doing you a favor if she joins Giganet. It would be a major marketing coup for Barry”.

Barry is one of the two co-founders of Giganet, together with Iris, who was his CFO at a failed Silicon Valley startup.  

Barry is Italian gangster chic - Polo shirt, slacks, Italian loafers and cigars. 

Barry asks, “Why is Lyubka a major marketing coup?”.

Lena, “Baaaarrrrrrry.  It’s obvious.  Play the browser-security card. When enterprise customers like LA County ask what you do for browser security in your SaaS application - you can roll out Lyubka. She will slam-dunk them. Lyubka is good for business. Make a press release”.

Barry, “Call her”.

The next day, Lyubka comes into the studio apartment facing the beach in Venice. The reunion with Lena and Yasmin brings back happy times.

Today, Yasmin is wearing another outfit from L’Agence, courtesy of her uber-rich Persian boyfriend - a Jennah checked blazer, white t-shirt, straight-leg jeans and her trademark Mizuno running shoes.

Bob, “Lyubka, it’s great to see you again! We’re looking for someone to handle software security for the application. Wondering if you might be interested?”.

Lyubka says, “Tell me more about what you’re working on”.

Sitting around a table in the living room, the team talks about the project. 

Lyubka says, “You know, I can help you and it really sounds like fun. Make me an offer. The timing is good for me. I just moved to LA from the Valley. I want to be close to Zack and his family and enjoy my grandchildren. ”.

Iris makes her an offer and they close on the spot.

Lyubka comes in the next morning at 8:00.

Iris opens up early. She and her ex-Navy Seal husband like to get in some surfing early morning on Venice beach.

Iris, “Hi Lyubka, do you want a cappuccino?”.  

“Green tea, if you have, I want to jump into the code and start building a threat model. When is your next major release?”.   

Iris, “Uh, next week - we have a milestone with LA County”.

Lyubka, “Awesome.  You’re lucky Bob was the architect and Lena and Yasmin developed the software. They are all world-class on software security. You are in good hands”.

Iris is beginning to feel queasy. Physically Sick to Her Stomach. 

She thinks back to a conversation with Lena 3 months ago about the gig workers contracts module.

Iris had written the specifications herself, and had outsourced the contracts code to a 5-star rated contractor named Yuriy she found on Upwork. Iris was proud of the great hourly rate she had negotiated with the contractor.

Iris, “I think it looks really great”.

Lena, “It’s an ugly piece of shit. Yuriy made a completely different look-and-feel from the rest of our beautiful application. The typography is different, the fonts are huge, the navigation is across the top bar instead of our standard left side-bar. He didn’t bother to use our style guide. He uses strange-looking buttons to add and edit line items to a contract. It’s ugly and your customers will hate it. He must have had some old Angular 1.0 code and reused it. That’s why you got such a good deal.”

Your customers. Not our customers.

Iris, “Lena, we need to think about time-to-market.Besides, the contracts interface is used by payroll staff, it’s not the same users. I don’t know if it matters”.

Lena, “Do what you want, it’s your decision”.

After the confrontation with Lena, Iris decided to stop the discussion and move on.

That conversation was 3 months ago. 

Today, a world-class security expert is about to look at code written by a Ukrainian Upworker.

Iris is a finance person. She worked for the IRS investigating white-collar crime, she understands risk management, she knows that the contracts module is non-standard with the rest of the code. But she has no tools to estimate their exposure. Lyubka does.

That afternoon, Lyubka asks Yasmin to conduct a code review of the contracts module.

Yasmin has this technique where they go around in a circle reading each other's source code.  

Yasmin, “Justin, can you please start reading the code?” 

Justin is their QA person, fresh out of Santa Monica College. Korean, jet black hair. Hip-hop street wear. Very quick.

They spend the next hour listening to Justin read Angular 1.0 TypeScript code in the contracts module.

Lyubka, “Justin, what do you see here?”  

“I see a lot of Regex code. I see a bunch of places where the programmer wrapped <option> elements in <select> ones. I don’t understand why he does it this way. It looks bizarre”. 

Iris is observing. Getting Sicker to Her Stomach by the Minute.

Lyubka, “That is correct, Justin. There is no reason to do it that way. As a matter of fact - this code is very old and it’s very vulnerable to DDOS attacks and cross-site scripting. There are 8 known browser vulnerabilities in this code. We have to upgrade to the latest version of the framework and fix all the bugs in the TypeScript code.”

Iris asks, “How long will it take to fix?” She’s praying to the Lord that the answer is a day or two.

Lena, “At least a month to upgrade the framework, go through all the source code, fix bugs, and prepare for QA and a penetration test. I told you it was a piece of shit”.

Lyubka, “Iris, You cannot release the system like this”.  

In addition to the DDOS vulnerabilities, there are XSS vulnerabilities. Attackers may be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. You will be in violation of CCPA.

CCPA penalties have an upper cap of $7,500 per intentional violation or $2,500 per non-intentional violation. It may seem like a small penalty, but it can eventually grow massive. The penalties can quickly add up because one consumer equals one violation. 

Lyubka, “How many users do you have now?” Iris replies, “About 10,000 users”. 

Lyubka, “You have $25M in exposure”. She deliberately uses the word exposure with Iris so that Iris will understand financial impact. 

 “We’ll need another 4 weeks for security testing and validation after Lena and Justin finish. Yasmin’s back end module is not affected and the rest of the front-end is fine. You need to allow 12-13 weeks to fix this problem”.

Iris feels like she wants to throw up. 

The Boss Gets Stuck Anti-Design Pattern

Problem

After making a bad decision, the leader does not decide.

Not deciding happens for a number of reasons:

• Decision paralysis, usually out of fear of another person.

• Hierarchy. In large organizations, decisions can be bumped upstairs to someone else higher up in the hierarchy. The boss doesn't understand the problem and is inclined to do nothing and ignore signals from soldiers lower down in the organization. 
  
  Iris's problem wasn't being indecisive, but rather that she didn’t understand the possible impact of Yuriy’s code quality.

• Non-standard ways of decision making. In remote-first organizations, different business units may have different ways of taking decisions. One of them might be “do nothing” first.

• Disaggregation. When a decision-maker needs other people to make a decision, the process breaks down into smaller pieces. The smaller pieces have less information and less inclination to make a decision that makes them look bad.

The usual approach to Boss Gets Stuck uses traditional tools of organizational politics:

• Keep a low profile and hope you don’t get hit with flying missiles.

• Have meetings. As many as possible with as many people as possible.

• Dilute decisions. Make a decision that only addresses part of the problem, then tell people you solved the problem.

The usual approach makes problems worse.

Solution

You want to be purposeful about channeling conflict into constructing value. You do this in several ways:

• Achieve buy-in for a new / different idea.

• Use constructive confrontation to achieve buy-in. "Constructive confrontation" requires addressing problems directly, objectively, and in a positive manner. Have your data and your opinion, be prepared to get in a conference room with the other person and argue your opinion, assertively and backed by data.

• Do internal marketing. Get other people interested and curious about your new/different idea so that you can achieve buy-in from them.

• Pre-staff. After internal marketing and buy-in, meetings will be short and to-the-point since you already have buy-in before the staff decision making meeting.

Constructive confrontation results in 1 of 4 possibilities:

1. Agree and commit - This is the best. Everyone is on the same page and works towards the goal.

2. Agree and not commit - This is bad. It can torpedo a project.

3. Disagree and commit - This is good, because it acknowledges the reality of diversity in the team. 

4. Disagree and not commit -  Less good, but at least, the problems are out in the open. 

Conclusion

Software for Your Head: Core Protocols for Creating and Maintaining Shared Vision 

You need a good nights sleep to think clearly

Anyone who’s ever dealt with cyber events or for that matter - Israelis who spent the 6 weeks running to safe rooms and shelters - appreciate the goodness of a good nights sleep.

If you lead a TechBio, MedTech or Digital health company you know what I mean.

You know that you have cyber risk at home, at customers, in your supply chain.

It threatens deals, slows implementations and damages patient safety.

I know — I’ve had the 2AM call from a customer ICU.

Cyber risk doesn’t stop with FDA clearance.

It stops the night you can sleep well

Get a peaceful nights sleep

I hosted Eddie Ben-Ami, founder and CEO of Neuralight on the podcast last week.

Despite MRI and gene sequencing, the current “gold standard” is still a neurologist’s subjective bedside exam – pushing patients to test balance, or asking caregivers how hard it is to adjust clothes in bed.

Founder & CEO Eddie Ben-Ami explains how Neuralight replaces this with a 10‑minute, tablet-based eye-movement test using a standard camera. By leveraging decades of visual-system research (largely from primate studies), they extract functional biomarkers tied to specific neural pathways and brain regions. The result: objective, quantitative measures of brain function that are highly sensitive to change over time.

Over the past four years, Neuralight has run large longitudinal studies on thousands of patients across multiple neurodegenerative diseases. In Parkinson’s, they’ve shown their metrics are 10x more sensitive to change than the existing clinical gold standard, with results being presented at ADPD in Copenhagen alongside the very inventors of that standard.

Commercially, Neuralight is already being paid as a per-test diagnostic in five pharma drug trials (Phase 1 and 2), where their measures serve as secondary/exploratory endpoints. Their moat is a growing, hard-to-replicate dataset linking eye movements to rich clinical data. Looking ahead to 2026, they’re focused on: successful readouts from ongoing trials, expanding into psychiatry, and bringing their technology into preventative-care platforms so even healthy people can track brain function—before catastrophe strikes.

The problem with neurology’s toolbox

Neurology is, in Eddie’s words, “kind of backward.” In a world of gene sequencing and advanced MRI, the main tools physicians use to track disease progression in Parkinson’s, ALS, MS, and Huntington’s are still bedside assessments and intuition.

Neurologists literally push patients to see how close they get to falling.

Drug trials ask patients how hard it is to adjust their clothes in bed.

These are the gold standards.

What Neuralight Built Instead

The visual system is the best-understood part of the brain — decades of primate research have mapped exactly which neural pathways govern eye movements and how they degrade in neurodegenerative disease. Neuralight turned that knowledge into a 10-minute, tablet-based eye-tracking test using a standard camera.

No invasive procedures. No specialist equipment. Just a dot on a screen, a camera, and some extraordinary engineering.

The output: objective, quantified biomarkers of brain function tied to specific neural pathways. Not a black-box AI correlation. A direct, clean measurement of what specific brain regions are actually doing.

The Validation-First Playbook

I asked Eddie, “What is your favorite anti-pattern in digital health?”

We’ll start with healthy volunteers, build a beautiful product, and figure out how to get into pharma.

Eddie argued the opposite is required to win in this space:

Start with hard clinical use cases and pharma trials, prove you can move the needle on real endpoints, and only then go “downstream” into broader wellness/preventative markets.

Here’s where most startups would have rushed to market. Neuralight spent four years doing the opposite — collecting data on thousands of patients across multiple diseases, following them for over a year, comparing their biomarkers to existing gold standards, and proving their measurements were sensitive to real clinical change.

The result? In Parkinson’s disease, Neuralight’s metrics are 10x more sensitive to change than the current gold standard. They’re presenting this data at ADPD in Copenhagen alongside the very scientists who invented that standard.

That validation opened every door. Neuralight is now live in 5 commercial pharma drug trials, being paid per test, with healthy margins and happy partners.

The Peter Thiel Principle

Dominate one small space. Then expand concentrically. Don’t try to boil the ocean.

Neuralight started with neurodegenerative disease. Now they’re moving into psychiatry and preventative care. The flywheel is spinning — more partnerships, more data, better capabilities.

The lesson for every founder in life sciences: patience isn’t weakness. In a conservative, high-stakes industry, validation is your moat, your credibility, and your only real shortcut.

Do the work first. Then scale.

Listen to the show with Eddie Ben-Ami on Life Sciences Today, part of the Healthcare IT Network.

Stress-test your business not your parents

I can’t help your Mom’s Parkinson disease condition, but I can show you what risks really count for your business.

• You have a balance sheet.

• You track every dollar on the balance sheet.

• You can price cyber risk the same way you price anything else: Value at Risk, before and after countermeasures.

• You can build a prioritized, cost-effective cyber countermeasure plan.

• You can see if you’re a good fit for OpenCRO.

Book a free 20' stress test

For strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

Photo by Matheus Bertelli

I’ve been writing for 138 straight weeks. This week I continue the story of Giganet Health. Bob and Barry take the United Express from LAX to SJO and experience security theater first-hand courtesy of the TSA.

We learn that sometimes - you just have to ask for something.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover Clear Thinking. 🙏

Share

Venice California 6:00 AM

Sol was the fifth daughter of musical hippie parents from Haight-Ashbury. Sol was a cheerful, high energy crossfit trainer. I was in Sol’s 6:00 crossfit class in the Venice gym. By 7:00, psychopath Sol had taken us to the edge and finished us off.

Today, Barry and I were taking the United shuttle to SJO for a 1030 face-to-face meeting with the city of Sunnyvale. The sales cycle was stuck in an endless, aimless spiral of good meetings with HR and payroll people.

Rumor was that we had already lost the deal to EY.

I needed to clear my mind before Barry picked me up to go to LAX.

I sat down on a mat in a lotus position and started tonglen breath meditation.

Breathing in Alice’s pain, breathing out compassion. In a few minutes, I was in another place. Visualizing myself in front of the ocean. Visualizing Alice and Sunnyvale far away in the distance behind me. Breathing out my compassion to people with pain like me.

Early morning light streamed down the warm walls in shimmering lemon torrents, touching the gym equipment that responded with a bluish-gold reflection.

Alice walked in with her gym bag. She had a court appearance downtown, prosecuting a couple of low-level Columbians for money-laundering in connection with Hezbollah.

She looks left. Sees me in a lotus position, eyes closed, breathing slowly in and out. Taps me on my shoulder.

Alice, “Hey”.

I get up, “Hey”.

We look at each other.

Alice improvs a haiku for us -

Close beside him now,

His scent, a tangible truth—

Is his love as real?

LAX to SJO

Barry picks me up outside the gym.

He parks and we take the shuttle to Terminal 7 to United Express.

Two older women are in line in front of us with Trader Joe reusable canvas bags in each hand. They are negotiating with a TSA worker.

Woman #1, “My friend Clara is allergic to magnetometers. The magnetic field you know is very dangerous to you and it gives Clara terrible headaches”. The TSA worker calls her supervisor and after a brief discussion, sends Clara with a lady TSA worker for a pat-down outside the line.

I say to Barry, “Barry, you know that this is a perfect opportunity for her friend to remotely-detonate Clara. They could kill 150 people and shut down LAX and West Coast air traffic for the day”.

Barry, “Keep your voice down man. You’re spending too much time with Pesya”.

Pesya, matron of the Silicon Valley hackers, is their cybersecurity expert. Pesya sees exploits where other people see buildings, doors and windows. Thinking about joining a gym and losing weight. More interested in finding zero-days.

They land in San Jose on time.

Barry’s phone buzzes.

It’s Madison - their contract sales rep for Northern California. Madison works out of a WeWork in Sunnyvale.

Madison, “I see you guys. Look to your left. I’m in the cherry-red Toyota Tacoma”.

Madison is a formidable Australian gal who relocated to California to find her fortune. Cheeky and high-energy.

They get into the truck.

I ask Madison, “I love your truck, what’s the story?”.

Madison, “Last Monday was my birthday. Business is good. I wanted to treat myself. I deserve it. The dealer said the wait time is 2 months. So - I said, f-k man, but today is my birthday, I need this truck today. I’m buying it today - in cherry-red. I’m not leaving without the truck. The salesman made some calls and they found one at another Toyota dealership. While they brought it over, we did the paperwork. So here we are”.

Madison gets on the 101 North and merges into traffic, and in between phone calls, she updates us with the latest status of the deal with the city of Sunnyvale.

Barry, “Madison, what are all these calls?”

Madison, “I have another gig. I sell food packages online to expat Australians in the US. After I moved here 2 years ago, I got homesick for Vegemite and Tim-Tam and figured that there was a market for iconic Australian foods”.

Barry, “Very cool, so what is your assessment of the deal right now?”

Madison, “Well you know, we got an incoming lead just after the press release of our win with the City of San Jose. I called them back within 15’ of the contact form hitting our CRM. It looked very promising. The problem is that our contacts there are mid-level HR and payroll people.

I think they used us to build their technical specifications and get pricing.

I wanted to talk to the CFO, but I was afraid that if I bypassed HR, I would alienate my contacts and burn the deal.

I want this deal so I ran with my inbound lead ”.

Barry, “Yeah, well, don’t feel bad about feeling bad.

We still have a few tricks in our bag, like bringing in Pesya and scaring the crap out of them over cyber and CCPA (California Privacy) Compliance.

EY can bundle gig worker time collection into their master service agreement for IT outsourcing, but no way the suits from EY can compete with our security and technology platform”.

They get off at Mathilda Ave and arrive early, 15’ before the meeting.

Madison parks and Barry calls a 5’ huddle outside before the meeting.

Barry, “What we do is listen. Madison will make the introductions, let’s go”.

Barry is Italian mafia chic, charcoal gray suit, crisp light blue dress shirt, silk tie, dark brown loafers and Breitling.

I’m in my role as the Silicon Valley CTO (Chief Technology Officer) . Giganet-branded T-shirt, well-fitting chinos and Allbirds, wearing my Suunto Vertical watch.

Madison is in role of the Gen Z Australian sales rep opts for a smart-casual ensemble. Electric blue blazer over a red blouse paired with gray high-waisted trousers and stylish flats.

We’re escorted into a conference room with Mary the head of HR and Hilda head of payroll.

I’m thinking, bad sign, too few people at the meeting. This can’t be good news.

Madison does the introductions.

Mary starts, “I’d like to thank you all for coming in today. Madison has done a great job of presenting your value proposition to help us reduce costs, improve compliance and process gig worker health benefits.

But - I’m afraid that we have some bad news.

Our CFO is leading a reorganization. Changes are happening quickly, and several people in the accounting, HR and payroll departments are now looking for new opportunities.

We have to get through this organizational change before considering new technologies”.

Madison decides to be cheeky. “So you’re saying, your CFO is shaking bushes and people leaving?”

Mary unfazed, “Yes, Madison. We’re in a state of flux right now”.

Barry raises his hand. “Ma’am, can I ask you a question?”

Mary, curious at Barry’s Italian politeness, smiles, “Of course, Barry”.

Barry smiles back, “Can you introduce us to your CFO?”.

Mary smiles at Barry, “Of course, it would be my pleasure to do that. Let’s walk over to his office and say hello”.

Mary walks with Barry down the hall and introduces Barry to Jack, the CFO.

They set a time for lunch and exchange cards.

Hilda escorts the Giganet team out of the building.

Madison is direct, “Hilda, How is it we are only meeting your CFO now?”

Hilda smiles, “You never asked”.

Barry and Iris have lunch with Jack the following week at his favorite Mexican restaurant in San Francisco.

Jack the CFO talks finance with Iris the CFO. Iris shows how the Giganet SaaS solution fits Jack’s reorganization plan like a glove and makes Jack look good.

Iris asks Jack if his IT manager would like to meet number 1 in the world on browser security - Pesya Eichbaum.

Pesya meets the IT manager. They talk about cybersecurity and privacy trends and reducing IT workloads with native cloud platforms. Never specifically mentioning Giganet. The IT manager enjoyed meeting a Valley legend and how taking gig worker privacy off his plate makes him look good.

3 weeks after lunch with Jack the CFO, Barry strikes a deal.

Those who are victorious plan effectively and change decisively.

Sell Low

Barry and I debriefed the Sunnyvale deal, to see what we did right and where we went wrong. This is what we came up with.

In classic sales process, you start with a lead, qualify, build rapport, construct a business case and close a sale.

This may be true for buying and selling dishwashers but it’s not true in technology sales.

In a world where corporate politics flourish even in the smallest company, knowing who authorizes the purchase order is a major key to selling technology.

Proving return on investment on your solution is not enough

In fact:

• Return on investment does not sign checks

• Helping end-users with your software does not sign checks

• Unless your offer has emotional and political benefits for a buyer, they won’t sign a check. The CFO has a stack of offers on her desk with ROI without budget to buy.

The first mistake most technology salespeople make is calling too low in an organizational chart.

Salespeople get intimidated selling to the highest level because of the fear of rejection brought on by their inability to frame a strong enough sales value proposition for a senior manager. Account managers usually push to get into a targeted company, and accept any entry point to get traction.

This is always the wrong move.

Let me repeat that. This is ALWAYS the wrong move.

If you are a sales manager in a technology company, focus on having all of your sales account managers cold call ONLY VPs and above.

Remember, no matter how big the company is, managers and directors are nice people, but they almost never have the authority to sign off on business proposals.

Even when they tell you it is their decision, they are still going to go ask their boss.

Another fact in technology sales is that managers never send you up to their boss, only down to their subordinates.

When was the last time a Director of IT or Operations said to you,

“Bob, I am going to introduce you to my boss, the VP.”

It doesn’t happen. Either they bring your opportunity directly to their boss and try to make themselves look good, or they send you to George, the Program Manager. Either way, you lose.

The Director is not as good a salesperson as you are, and will likely communicate your message in the wrong way to the VP. Worse, you are stuck with George, who cannot make any decisions.

The solution is always sell up – the higher, the better.

On a park bench in Venice CA

Alice has a dream. She dreams she is sitting on a park bench with a tall, lanky bald man in his 60s.

The tall bald man was the one who began. He has a friendly, warm, and caring demeanor.

He introduces himself, “My name is Mark”.

She replies, “I am Alice”.

Alice feels secure and comfortable with Mark, like they were old friends.

Mark, “Alice, how are you? What’s new at the Bureau and with Bob?”.

The tall bald man remained silent as they sat on the park bench.

In front of them there was the green calm of the park.

A woman hungry for answers, must stock up on patience.

A man in possession of analytical skills needs to listen.

That is why Mark remained silent.

Mark listened carefully to Alice.

Alice, “FBI is good. I put away 2 bad guys today. I saw Bob this morning”.

Mark smiled and asked, “Nice - how was it?”.

Alice, “I shared a haiku with Bob”.

Close beside him now,

His scent, a tangible truth—

Is his love as real?

Alice trusts Mark and asks, “What should I do?”

And she wakes up before Mark can answer.

The end of the consulting firm

3 days into the cease-fire with Iran, it’s Friday and I’m back to dancing Gaga at the Suzanne Dalal Center.

It is a time to rebuild and I’m building what I think will become a new category:

Expert-led, agent-operated services.

The present

I spoke with an Israeli digital health VC recently.

I pointed out that none of their portfolio companies had cleared FDA.

He said:

“We don’t have to. It’s easier to skip the regulatory pathways.”

A few years ago, I would have argued.

About moats.
About clinical evidence.
About randomized trials.
About defensibility.

That was Danny 2.005.

The past

I left the rat race 21 years ago.

My secret sauce is less ambition.

I don't:

• Want to change the world.

• Raise VC

• Build the next unicorn.

• Be featured on any lists.

• Get the highest valuation.

Instead:

• I want to spend my time working on things I love with people I love

• I want to be able to travel wherever I want to, whenever I want to.

• I want to spend way more time with my friends and family.

• I want to spend more time playing music

• I want to stop doing things I don't like doing.

Thinking about what you actually want in life can force different behavior.
Take you down a different path.
A path towards living more intentionally.
Are you copying someone else's life?
Or designing your own?

Six months ago, I designed Danny 2.026.

The future

I’m building a new category:

Expert-led, agent-operated services.

The rule with new categories is simple:

If you can’t explain it to your grandmother, it’s not real.

So here goes.

The Bubbie Version

I studied physics.
I became a good programmer.

Then after working at big companies like Intel, I became an entrepreneur. 5 startups, 4 wins, 1 glorious loss.

Over 20 years, I helped 42 companies get through FDA.

Today, cybersecurity is part of treating patients.

So I built a business that helps companies pass FDA cybersecurity:

Fixed price.
Fixed time.
Fixed outcome.

Not hours.

Results - what people have always wanted.

Why Outcomes?

Why not talk about AI agents?

Because outcomes matter more than buzz.

AI agents are hot today.

FDA cybersecurity is:

• the gate to commercialization

• the difference between getting approved or not

• the difference between surviving post-deployment or not

What’s Changing

The executives I speak with aren’t looking for more cyber consultants.

They’re looking for cost-effectiveness and prioritization for their product and their company - not for a JnJ.

Ransomware and supply-chain attacks now shape procurement of medical devices.

FDA expectations are higher:

• more explicit guidance

• deeper technical review

• stricter documentation

The old model—teams billing hours—is breaking.

What I’m Building

OpenCRO is built on one idea:

One accountable expert where agents handle the execution.

I distilled 20 years into a system:

• Human workflow for judgment

• Agentic engine (“Pattern Factory”) for execution

Agents:

• write reports

• extract patterns and anti-patterns

• reason over causal flows

• generate threat models from user stories

The Shift

Consulting firms sell hours.

Software sells tools.

This model sells outcomes.

If You’re In This World

If you’re a MedTech leader navigating:

• FDA

• reimbursement

• commercialization

you already know how high the stakes are.

Drop me a note
or book time.

For more design patterns subscribe to Clear Thinking

Subscribe now

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Clinical trials are racing to cure cancer, defeat rare diseases, and bring life-saving treatments to patients — yet researchers are still scribbling data on paper diaries. It took 22 years for electronic data capture to become standard.

In this episode, I sit down with Kim Boericke, the new CEO of Veristat, one of the most data-driven CROs in the business. Kim brings 30 years of industry experience — from Quintiles to Icon to Thread Research — and a refreshingly clear-eyed vision for what needs to change.

We cover how Veristat is using AI to compress drug development timelines, why “write the label first” is the smartest protocol strategy nobody uses, and what the FDA’s new cybersecurity-as-quality guidance really means for sponsors.

Plus: the biggest anti-pattern holding the entire industry back — and why your online grocery order has better data infrastructure than most clinical trials.

Listen to the show here

Outcompete online grocery shopping

I can’t fix your clinical data management plan, but I can fix your cyber and privacy if you want to protect patients and your reputation.

I’m doing a free gap analysis with 10 CEOs this quarter.

Read this before our call - OpenCRO risk framework

The 7-step risk analysis loop and prioritized, cost-effective countermeasure plans built for regulated software.

For more strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

My guest this week was Josh Haimson, co-founder and CEO of Inductive Bio.

Josh built a career in AI for drug discovery and biopharma research

• He started at MIT: machine learning for surgical intervention predictions using medical records

• At Flat Iron Health: he built AI/ML teams for oncology data analysis across hundreds of millions of medical records

• After the Roche/Genentech acquisition: he ran the AI group inside the Roche drug discovery organization.

• Left Roche to start Inductive after identifying ADMET optimization opportunities

I asked Josh, “So what is ADMET exactly”?

Josh, “ADMET (Absorption, Distribution, Metabolism, Excretion, Toxicity) is everything a drug needs to do in the body besides cure the disease”.

It’s one of the biggest bottlenecks in pharma — a grueling 4-5 year process of making thousands of molecules, one iteration at a time.

Inductive Bio built virtual chemistry labs where AI scientists explore millions of hypotheses overnight. The result? That 4-5 year timeline collapses to 1-2 years, with higher quality molecules and better odds in the clinic.

Their secret weapon: a pre-competitive data consortium where pharma companies pool ADMET data — not out of altruism, but because it’s the smartest business decision they can make.

The Industry anti-pattern

But here’s Josh’s warning to the industry: stop believing too much in the AI hype. Biology is still deeply incomplete. No AI spits out a perfect molecule. The real wins come from tight feedback loops, good data, and radical honesty about what we don’t yet know.

Listen to the show here

Visit Inductive Bio here

Before FDA and before the attack

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies.
0 rework requests.
Walmart Vision.

Fixed price. Fixed outcome.

Most MedTech teams think cybersecurity is documentation.

It’s not.

It’s whether you clear FDA
and how you survive the day after an attack.

I’ll review your current cyber and privacy position
and show you where FDA and attackers will push.

No charge.

Start here before we talk
Business Threat Modeling Framework (free, CC license)
→ Download

For strategic patterns in Life Sciences subscribe to Clear Thinking

Subscribe now

Photo by Designecologist

Join other smart people who absolutely love my writing today.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Security blankets and security checklists

Intro

I once did a PCI-DSS compliance audit for a provider doing healthcare payments.

The IT Security lead asked me, “Do you have a checklist?”

I said, “No.”

He said, “Previous security company had an Excel.”

I said, “Good for them. I don’t.”

He said, “Yeah, well, that Excel was like 5 years old anyhow. Way out of date for today’s exploits.”

I said, “Exactly. I deliver outcomes you want today, not 5 year old checklists.”

We did the audit in 3 days. Fixed price. Fixed time. Fixed outcomes.

The stakes are higher in hospitals

That was payments. This is patient safety.

In medical devices that go into hospitals, the stakes are patient lives and the checklist has a different name.

They call it a risk model of patient safety.

And here’s what happens to it after FDA submission.

Your consultant worries that sharing vulnerabilities could expose failed controls, unmitigated attack surfaces, or security gaps they couldn’t close.

Transparency may hurt their next sale — or hand ammunition to competitors.

Consultant culture is project-focused.

Get the contract. Deliver the document. Move on.

The best-practice solution to avoiding accountability is to encourage the industry to trash risk analysis after submission — so nobody can see their dirty laundry.

And that includes FDA.

Free gap analysis

I’m an entrepreneur. Writer. Podcast host. Musician. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. Fortune 1 company. 0 rework requests.

If you’re heading into an FDA submission in the next 6–12 months, I’ll review where you stand at no charge.

The OpenCRO risk framework: BusinessThreatModeling.pdf

7-step risk analysis loop. Prioritized, cost-effective countermeasures. Built for regulated software. Fixed price. Fixed outcome.

Book a free gap analysis

For more strategic patterns on defending your operation:

Subscribe now

Photo by cottonbro studio

Join other smart people who absolutely love my writing today.

Subscribe

👉 If you enjoy reading this post, feel free to share it with friends! Or feel free to click the ❤️ button on this post so more people can discover anti-patterns. 🙏

Share

Introduction

This piece was inspired by a customer I once had.

When a non-technical person leads a project with highly technical people, you get an anti-design pattern: BlindLeadingTheBlind.

Giganet Health exploits BlindLeadingTheBlind in order to close a big deal with their first large account, LA County and buy time to fix security vulnerabilities.

Giganet Health

Iris felt sleepy and was in a bad mood.

Bob and Barry walked into the Venice studio apartment to show her their plan. “Get a corkscrew”, Bob said, and pulled a bottle of wine out of his backpack. “This is a time to celebrate! I know how we can deliver the system on time to LA County. This is the real thing. Let’s drink to it!”

Bob looks over at Barry, Italian gangster look, polo shirt, slacks, tasseled loafers. Barry poured them some wine and raised his glass - “Alla vita, alle ricchezze e al buon vino”. Bob’s face was lit up, “Happiness is inspiration. Let’s drink to it! This is a turning point for Giganet”.

Pesya, their jolly hacker matriarch, slightly overweight, always laughing, always thinking about going to the gym; had discovered vulnerabilities in the Giganet system with $25M in exposure to fines for CCPA privacy violations.

Iris thinks back to their conversation last week:

Pesya, “Iris, You cannot release the system like this to LA County.

In addition to the DDOS vulnerabilities, there are XSS vulnerabilities. Attackers may be able to extract contract information about the gig workers and conduct a side-channel attack to identify people. You will be in violation of CCPA.

CCPA penalties have an upper cap of $7,500 per intentional violation or $2,500 per non-intentional violation. It may seem like a small penalty, but it can eventually grow massive. The penalties can quickly add up because one consumer equals one violation.

Pesya, “How many users will LA County have?” Iris replies, “About 10,000 users”.

Pesya, “You have $25M in exposure”. She deliberately uses the word exposure with Iris so that Iris will understand financial impact.

“We’ll need another 4 weeks for security testing and validation after Lena and Justin finish. Yasmin’s back end module is not affected and the rest of the front-end is fine. You need to allow 12-13 weeks to fix this problem”.

Giganet has a delivery milestone in a week with LA County, their first large account. The revenue and reputation are critical to Giganet survival. They don’t have 12-13 weeks. They need the cash.

Iris, “OK, guys, what’s the plan?”

Barry, “Bob, it’s your idea, so go ahead”.

Bob, “Pesya knows their security consultant. Noah Cheng was one of her hacker apprentices. She’ll talk to him, and that will be enough”.

Iris poured herself some more wine and drank. She had remarkably beautiful hands - slim, white and smooth, fingers delicately pointed.

Iris, “Is this legal?”

Bob, “Totally. Remember how I told you that the best defense is a good offense?

We release the software to the customer on time, get the milestone payment and find a way for the customer to not actually use the software. We’ll do that with their own bureaucracy.

Noah will explain to the customer project manager that even though Giganet is CCPA compliant, they need to set up application firewall rules to limit internal network access for HR”..

Iris, “That doesn’t sound like a lot of work to me, maybe 2-3 days”.

Bob, “You’re right, it’s 3 days work but it will take them 4 months. Watch and weep”.

ISD - Internal Services Department Information Technology Service

Todd Jameson is project manager for rolling out new Web applications in LA County.

Todd works for Dell Technologies Services and is onsite with ISD Information Technology Service. He came up through the ranks as an analyst and project manager at Perot Data Services and after the acquisition and name change, stayed with Dell.

He’s been with LA County for 12 years.

If you were to ask Todd, he would say he is a “technology leader”.

A technology leader that spends his time in meetings and tracking projects.

A technocrat dedicated to budgets and vendor management.

He likes reading Gartner reports to follow broad tech trends. Lately, with the outburst of AI, he’s started talking to vendors. Talking to vendors on the Gartner hype list can turn into a full time job but it’s more interesting than meetings with his change control board.

He has a 9:00 meeting with Noah Cheng, their cybersecurity consultant for web application development.

Todd, “Hey, Noah. I wanted to touch base with you regarding our upcoming deployment of the new Giganet SaaS application. How’s everything going on the security front?”

Noah, “Security is Dope, man. You know their engineering team are ex-Google executives and their CSO is Pesya Eichbaum. She’s number 1 in the world for browser security.

However, as I dive deeper into the Giganet architecture and potential vulnerabilities, I believe that having an application firewall for HR access is a proactive measure to mitigate potential risks to your network. It’ll add an extra layer of protection against any unforeseen threats. You can use your existing F5 firewall”.

Todd, “I don’t understand the technical side but I don’t want to compromise on security. Can you give me a plan?”

Noah, “Of course, Todd. I’ll prepare a comprehensive proposal with time estimates, potential benefits, and a deployment plan. I’ll make sure to highlight the added security and potential risk reduction it brings to the table”.

Todd, “ Great, Noah. Please keep me in the loop as you work on this proposal. We want to make sure we’re making informed decisions about our security measures”.

Noah, “Will do, Todd. I’ll get started on that right away and will keep you updated as I make progress. If you have any immediate questions or concerns, don’t hesitate to reach out.

Todd, “Thanks, Noah. I appreciate your dedication to our project’s security”.

After the meeting Noah calls Pesya.

Pesya, “How did it go?”

Noah, “Nailed it, I just bought you 4 months. It’ll take me a month to prepare the proposal, it’ll take Todd another month to get it past his internal review committee, it’ll take them another 2 months to implement. In the meantime, you’re good to go with HR for the delivery milestone”.

The Blind Leading The Blind Anti-Pattern

This anti-pattern is created when a non-technical person leads a project with technical people.

This anti-pattern is created by a project manager who leads with laundry lists, turf management and organizational politics. She’s often regarded as a nuisance by the technical people. Even though her intentions are good, the results are often negative as the team gets bogged down in details and changes, causing additional problems.

The organization moves slowly, often without a sense of strategic direction that is integrated with business strategy.

Solution

Flip the pyramid.

People who actually understand and develop technology work best in small autonomous teams creating things.

The LA County example works in an inverted way: Todd, the project manager, provides technical requirements to his internal information security team for implementation. His internal infosec team doesn’t have the business context or understanding that the Giganet system can save millions of dollars. They don’t care, and given competing priorities, they may keep the project back.

About Giganet

Giganet Health is a Digital health startup based in Venice, California. The founders are industry veterans that worked at Silicon Valley tech companies.

Giganet uses agentic AI and the Apple Watch to monitor and relieve work-related stress as part of a holistic program that empowers people to own their own good health and reduce doctor visits by up to 83%.

Their customers are large employers in California.

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. Fortune 1 company. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library - a steal at $150.

Subscribe now

It’s not every day my guest is a founder and Olympic athlete.

Simon is a two-time pole-vault Olympian and seven-time founder who came to the US from Australia on an athletic scholarship at the University of New Mexico.

And the rest is history.

What really struck me wasn’t the medals or the exits — it was how willing he is to call bullshit on the way our industry “has always worked.”

Simon’s new company, Ryght.ai, is taking a flamethrower to the slowest, most fragile part of clinical development: site selection and activation.

Instead of begging for EMR integrations and pretending that “lots of patients” is a real strategy, they’ve built digital twins for 100,000+ sites in 192 countries, then layered on agentic AI to find, rank, and activate the right sites and PIs in days, not months.

In reality, EMR data is one noisy variable among many — and often the least interesting one. Site incentives, operational capacity, competing studies, PI conflicts, regulatory history: these are where trials live or die. Focusing on EMR first is like judging a pole vaulter by their warmup jog.

In this episode of Life Sciences Today, we dig into how Ryght.ai works, why enrollment failure is mostly a site problem, and what happens when you design with AI from first principles instead of bolting it onto legacy workflows.

Listen here Beyond the EMR: Simon Arkell Rewires Clinical Trials – Life Sciences Today Podcast Episode 53

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

Quote courtesy of Jim McCarthy, Dynamics of Software Development

Intro

When you were a kid, did you ever tell your mom,
“Dad already agreed…”

And your sister would go to your dad,
“Mom’s letting Danny stay home from school—why can’t I?”

If you played it right, the 2 of you got away with murder.

Today, writing software is a family affair with two parents: human and AI.

Software is written in a dialog between them.

The dialog between machines and humans started 200 years before ChatGPT.

Charles Babbage designed his Analytical Engine in 1837. It was never built, but Ada Lovelace wrote a program for it in 1843. Ada was a colorful character, daughter of Lord Byron, directed by her mother to learn science and mathematics.

Looking at her program, it is surprisingly close to what we do today.

Loops. Named variables. Structure.

But Ada saw something deeper.

She imagined machines that could do more than compute — write music, manipulate symbols, process abstract ideas.

Great software comes from that fusion.

Today, great software fuses human intent, taste and judgment in a dialog with AI execution, expansion, and iteration.

Today, I’ll show you how that fusion works in practice:

• One case where the human dominates

• One case where the AI dominates

Great software has two parents

In the past year, I’ve spent less time writing code and more time writing specifications for AI.

I can ask Warp Code if the model is a good fit for the job—and get an intelligent answer.

Here’s what that looks like in practice:

/agent what model are we using

You’re using Claude 3.5 Haiku.

for an application to plan tax-optimized liquidation of stocks and optimized lots should I use a different model?

No, Claude 3.5 Haiku is capable of handling tax-optimized stock liquidation planning. It can work with:

• Tax lot identification strategies (FIFO, LIFO, highest cost, specific ID)

• Capital gains calculations (short-term vs long-term)

• Tax-loss harvesting logic

For a production application, the main considerations are:

1. Accuracy over speed: Ensure thorough validation of tax calculations and compliance rules

2. User responsibility: Include disclaimers that users should consult a tax professional

3. Data security: Handle sensitive financial data securely (encrypted storage, HTTPS, etc.)

4. Testing: Comprehensive test cases for various scenarios and edge cases

Haiku is suitable because the model isn’t the bottleneck for this type of application—careful implementation of tax logic and thorough testing are what matter most. If you need real-time processing of large datasets or complex multi-step reasoning chains, you might consider a more capable model, but for typical tax planning workflows, Haiku works well.

Notice what’s happening here: I’m not writing code. I’m interrogating the model, validating assumptions, and testing the system design alternatives.

The first coders were mathematicians.

In the 70s, the systems analyst emerged—someone who spoke with users and wrote specifications for coders.

As programming languages evolved, people became ‘programmers’ and expanded their activities into design, code and communication with other humans.

A great programmer is great at design, code and communications.

If that sounds hard - it is.

In 2022, with the launch of ChatGPT that changed again.

AI reset the division of labor between humans and machines.

But it’s more complex than that.

In the next section - I break down human and AI work.

Humans and AI - the division of labor

There are 2 kinds of activities in writing software - human-facing and AI-facing.

Human-facing activities

1. Stakeholder alignment - getting other people to agree with you and support your project

2. Market discovery - discovering if other people will use your product

3. Business tradeoffs - buy vs. build, do-nothing vs. do-something

4. Regulatory strategy (healthcare, MedTech, drug development, energy …) - how do you thread the needle with the regulator? FDA Cyber regulation for medical devices requires traceability of cyber testing and explanation how a control has been tested and validated to work.

5. Business model validation - understanding from other people if they want your product, when they’ll want it and how much they’d pay

6. Capital allocation - getting other people to fund your project

AI-facing activities

1. Code generation - prompting the LLM to generate code for your task. Emphasis here on you focusing on the desired outcome in your prompt. Specifically -
   
   Write a very specific story of the outcome you want and need

   Do not be tempted to talk about the process, the how, your ideas - let the AI decide how.
   Front-load your critical constraints - in time, money and results
   🔥Every ambiguity = risk on fire
   

2. Test generation - the latest AI models figure this out and often suggest tests

3. Build pipelines - with memory the AI model usually knows how to do this

4. DevOps - prompt the AI for what you need - this is a lot like code generation activities

5. Refactoring - an area where AI is exceedingly better than humans, although when it gets it wrong, it gets it very wrong.

6. Static analysis - like refactoring

Is the dialog ever equal?

It depends.

In personal productivity applications - AI dominates. In enterprise systems - humans dominate.

Let’s see why.

Does AI eliminate programmers?

The short answer is no.

In personal productivity applications (e.g. writing social media posts, or filing invoices from your email), the human cost of prompting is low and the payoff is high for AI agents to do the work:

• You make your own tradeoffs

• You write specs, AI writes code

• You can (and usually) ignore risk

In enterprise systems (e.g. airline reservations systems or healthcare information systems), the human cost is high, relative to the cost of AI tokens. You need to execute all 6 of the human-facing activities, often over long periods of time to sustain your project.

• You don’t make tradeoffs alone inside the enterprise. You need organizational politics to get buy-in for your idea.

• You need to align with other humans, comply, and document

• You need funding

• You cannot ignore cyber and privacy risk, internal data governance and industry and regional regulations.

In enterprise systems, humans lead the dialog.
In personal productivity apps, AI leads the dialog.

Like when you were a kid with your parents, there is a division of dialog.

In my family, my Dad led the dialog on science and my Mom led on homework.

We’ll close the essay with some thoughts on software risk for AI-human software development.

AI prompting for risk analysis in software development

How will AI-human teams create secure software?

I will go into more detail in a future essay but here’s a teaser.

Parallel to the AI-human build dialog, we need to conduct an AI-human attack dialog.

And not wait for the FDA to remind us about cybersecurity.

Outro

Ada Lovelace died in 1852. Her name lives on in the Ada programming language, designed in the 70’s for the U.S. DoD for safety-critical, embedded software.

It’s still used today in defense and aerospace where failure is not an option.

Every year on the second Tuesday in October, the contributions of women to science, technology, engineering, and mathematics (STEM) are celebrated on Ada Lovelace Day.

Let’s celebrate Ada Lovelace today for her incredible vision fusing human creativity with machine computation.

We’re still learning how to build that partnership.

It sounds like the beginning of a story - and it is.

Asta and Chris were my guests on the podcast recently.

They are based in Dubai and they are building a startup that provides imaging from radiology scans to train AI models.

Their twist ?

They provide the images as ‘infrastructure as a service ‘ for countries.

In the US, it’s almost impossible to get non-US data and outside the US, its almost impossible to get US data. Countries have their own privacy regulation and country level data security requirements.

And that’s where Medsyntra come in.

Chris is a radiology software veteran and Asta is a entrepreneur. And because they’re not locked into the US healthcare system mentality - they decided to develop a country level platform for AI developers.

In Episode 52 of Life Sciences Today, we sat down to talk about what it actually takes to build global medical imaging infrastructure for clinical AI.

Medsyntra aggregates and de-identifies millions of imaging studies across radiology, pathology, oncology, and women’s healthcare — ethically sourced, sovereignty-respecting, and annotation-ready. That’s harder than it sounds.

Chris and Asta don’t sugarcoat where the tradeoffs bite.

We covered the questions most AI teams avoid: Why do models trained on one population quietly degrade when deployed in another? What does data sovereignty actually cost you when you’re trying to build global intelligence? And is “ethical data” a real standard — or a marketing layer over bad practices?

One thread I kept coming back to: the difference between assembling a dataset and building infrastructure. Chris and Asta crossed that line early, and the decisions they made at that fork still shape how Medsyntra operates today.

We also got into annotation — the bottleneck nobody budgets for — and the anti-patterns Asta sees repeated across the medical AI ecosystem, often by teams that should know better.

If you’re building AI for clinical use, or advising companies that are, this episode will reframe where you put your attention.

🎧 Listen now

Visit Medsyntra here

About me

Entrepreneur. Writer. Podcast host. Father of 4.

Founder of OpenCRO — FDA cybersecurity threat modeling for MedTech.

42 companies. 14 clearances. 0 rework requests.

You shouldn’t be discovering cybersecurity gaps during FDA review. We find them first, document them the way reviewers expect, and deliver a prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

I originally wrote this piece 2 years ago. It was the design-pattern that closed my series on substack - “Bob and Alice - Anti-Design Patterns in Life, Love and Tech”.

The last chapter in Bob and Alice, was called Hezbollah is here - which is familiar to Israelis as we go into season 3 with Iran - or is it season 5? I’m not sure.

My substack series turned into a book on Amazon - Bob and Alice - an anti-love story.

I get a check every so often from Amazon from people who buy the book. Amazing.

Hint. Hint.

I did the cover graphic with ChatGPT 3.5. I kind of like it a lot.

Happy with what you know or overloaded by work?

Life, love and tech require constant learning, yet we are often happy with what we already know or overloaded by the work we already have - and left with no energy at the end of the day to learn new things.

This 10-part design pattern was inspired by my friends and co-workers - the people who served as the role models for characters in the series and in the book - Alice, Bob, Pesya, Yasmin, Mark and the rest of the team at Giganet. The names have been changed but the people are real.

My thanks to you all for teaching me how to learn.

10 things you should learn about learning

1. Your memory is not digital
   Fetching a memory strengthens and modifies that memory.
   
   When you try to remember something, activation energy spreads to all the connected pathways in your brain, like heat from a fire.
   
   Some of the activation energy leaves related pathways primed for more activation for hours.

2. Your memory is not continuous - it’s made of chunks
   Long-term memory is limitless, like a disk with an infinite amount of storage.
   Working memory serves general intelligence. It’s limited and can be trained like professional musicians who practice 10 hours/day.
   
   The brain works on information in chunks.
   
   Reduce your cognitive load by getting rid of irrelevant data and by organizing it in an easy-to-use format - like a table instead of wordy content.
   
   When you learn new things, you can improve your performance by chunking and reorganizing the task.
   
   This is really important when you’re learning a new skill or a new language.

3. Experts recognize, beginners reason
   Experts have seen it all before.
   
   They recognize and remember the patterns that helped them succeed in the past and the anti-patterns that led them to failure.
   
   This happens in less than a second.
   
   Experts can figure things out because they memorized the pattern from experience.
   
   This pattern-matching gives you superpowers in your field of expertise - be it code, marketing or whatever.
   
   Beginners need to see examples and figure things out.
   
   It’s a process that can take hours or days and beginners usually get it wrong.

4. When you learn, the brain flips back and forth from concrete to abstract
   Experts rely on generic and abstract patterns, and don’t need to worry about details.
   
   Beginners get stuck in details and have trouble connecting to the big picture.
   
   When you learn a new concept (like AI agents), your brain switches between an abstract idea (autonomy) with concrete examples (agents reading your email and filing supplier invoices).
   
   The more examples, the better. Mistakes are good. This process in the brain is called unpacking.
   
   You learn better when you flip back to examples from the abstract pattern. This is called repacking.
   
   The more you learn abstract patterns, the more concrete they become for you.

5. Spacing and repetition matters
   To learn something new and get really good at it (like playing the flute), you need to learn how to do it with a lot of repetitions and with breaks between each learning session.
   
   You cannot “just do it”. You are not Nike nor MJ
   
   Each little learning session, each little debug session helps you get better.
   
   Cramming for the test never worked in school and doesn’t work for any learning objective.

6. AI does not obsolete learning
   We learn by making connections between stuff in our brain.
   
   This creates a deep understanding of what stuff means and how to use it.
   
   Once memorized, you can retrieve a problem and the solution in a milli-second.
   
   With AI, you need to write a prompt, try it out a few times and then modify it for your needs.
   
   You won’t remember the solution because you didn’t learn it yourself; you copied and pasted.
   
   And it’s much slower than your brain

7. Problem-solving is not a generic skill
   Almost all of our generic skills are far worse than domain-specific problem solving.
   
   Our generic understanding of selling something is almost irrelevant for a specific domain like agentic AI.

8. Experts can sell you stuff but they can’t jack into your mind

It is almost impossible for an expert to jack into your mental model if you are a beginner.

You will probably fail if you buy a course online from a large account on social media.

9. Predictors of success in any given discipline are bad
   Success of learning a new discipline like copy-writing is a mix of your aptitude and your learning process.
   Some people believe that a natural gift is enough.
   Others say that practice and systems are enough.
   
   Both groups are wrong.
   
   It’s impossible to predict who will be a good programmer|copy-writer|marketer | salesman | manager.
   
   Smart people are not always good programmers. Good programmers are not always the smartest.

10. Your mindset matters to your success but not like you think
    There are people who believe in a growth mindset. Practice long enough and believe in your success and success, wealth and happiness will come.
    
    Other people believe in a fixed mindset and aptitude. If you struggle with success in developing Agentic AI apps, it means that you are not cut out for it.
    
    Both groups are wrong.
    
    For example - anyone can learn some basic physics but only 1 person/year out of 7.8 BN people gets the Nobel Prize in Physics.
    
    Rewarding a growth mindset for effort doesn’t work either
    
    People are not stupid - they know when they are working hard and not getting results.
    
    Rewards should be focused on achieving goals.

Summary

• Improve your learning skills all the time. Work with a person who keeps you accountable.

• There are no fixed rules about who is good at something be it leadership, music or marketing

• Read a lot of code to be a better programmer. Read a lot of copy to be a better copy-writer

• Experts are bad at training beginners

• Spending time away from a problem can help solve it.

• Using AI does not make you an expert. You still need to learn and develop the deep memories and patterns in your brain.

• Believe in your ability to change your abilities

• Seeking to succeed is better than seeking to avoid failure.

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber. After working with 42 MedTech companies and 14 FDA clearances on cyber and privacy projects - I decided to create boutique offer for medical device companies who care about their patients, their clinical data and their reputation.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

My guest this week on Life Sciences Today was Erez Lampert, founder and CEO of Pathkeeper Surgical. PathKeeper Surgical is changing spine surgery for 1M Americans

Erez Lampert already changed one field of medicine by leading development of Invisalign’s iTero 3D scanner. In this episode of Life Sciences Today, he explains how he’s now taking on spine surgery with Pathkeeper, a 3D imaging + AI navigation system designed to stop surgeons from “flying blind” in some of the most delicate procedures in medicine.

Erez breaks down the impossible choice spine surgeons face today: either low‑cost fluoroscopy with continuous radiation and guesswork in 2D, or ultra‑expensive robotics that slow workflow and demand huge capital and infrastructure. Pathkeeper offers a third option: optical 3D guidance with no radiation, no million‑dollar robot, and a workflow designed around how surgeons actually operate.

We dive into Pathkeeper’s business model and why the real leverage sits in the $10B US spine implant market, where navigation can be the “razor” that drives recurring “blade” revenue for implant partners. Erez also walks through the multi‑year grind behind two critical US deals: distribution via High Ridge Medical (Zimmer Biomet spine) and broad hospital access through Vizient.

Along the way, we puncture the myth that “Israelis don’t know how to sell in the US” and talk about the real anti‑patterns holding medtech back.

Listen to the show here

Visit PathKeeper Surgical here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber.
42 MedTech companies. 14 FDA clearances. 0 rework requests on threat model submissions.

You have threats to your patients, your clinical data, your reputation.

You shouldn’t be discovering your cybersecurity gaps during FDA review.

We find them first, document them the way FDA reviewers expect — and deliver to you a cost-effective, prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Not sure yet? Sign up for the 2026 CEO Audit — 60 minutes on your operation, unlimited access to my patterns library.

Subscribe now

Today is a landmark - episode 50 of Life Sciences Today! Less than 9 months in - the show is on fire. If you are TechBio founder, I’d love to host you on the show. Reply or DM me and we’ll make it happen.

My guest this week was Kiril Pevsner, CTO and co-founder of ProtAI.

In this Life Sciences Today episode, I spoke with Kiril, CTO and co-founder of ProtAI, an Israel-based biotech developing drugs for cancer and autoimmune disease. ProtAI’s AMES platform combines structural proteomics with AI, using experimental “geometrical clues” to refine protein structures down to subatomic resolution. That extra precision lets them design small molecules for targets that were previously considered “undruggable.”

Crucially, ProtAI is not a “tools” company. Like Dafna Koller’s Insitro, they chose to own the drug pipeline, not just sell the platform. Their lead program targets estrogen receptors–positive breast cancer. For a completely novel mechanism with little prior data, they reached a near–development candidate in under 12 months—vs ~3 years by industry standards—and plan to enter the clinic in 2026 in the US and Israel.

Kiril’s biggest “anti–design pattern” in AI drug discovery:

Overhyping the AI itself. Pharma doesn’t buy models; they buy de‑risked drugs backed by hard data. Trust comes from experimental validation, fast iteration cycles, and clinical results—not from glossy benchmarks.

Listen in to learn how ProtAI thinks about moats, data, trust, and why speed of learning is the real superpower in AI-driven drug discovery.

Visit ProAI here

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4 and founder of OpenCRO.

OpenCRO specializes in threat modeling for FDA Cyber. 42 MedTech companies. 14 FDA clearances. 0 rework requests on threat model submissions.

You have threats to your patients, your clinical data, your reputation, your commercial operation, and your engineering roadmap

You shouldn’t be discovering your cybersecurity gaps during FDA review.

We find them first, document them the way FDA reviewers expect — and deliver to you a cost-effective, prioritized countermeasure plan.

Fixed price. Fixed outcome.

Book a call to see if you’re a good fit for OpenCRO.

Courtesy of Pixabay

Intro

Today I’m launching OpenCRO — Real-world MedTech Cybersecurity,

OpenCRO is an expert-led, agent-operated company.

It’s been a journey. 20 years. 42 MedTech companies. 14 FDA clearances. 1 De Novo world speed record.

After conversations with many of you over the past 3 months about why MedTech companies die, I decided to do something about it.

• Fixed outcome. Fixed price.

• Not hours.

• In a post-management consulting world, that’s the new delivery standard.

  Why FDA Cyber first? And not an AI-agent story?

  Because the outcome is far more important than the buzz.

AI-agents are hot today. FDA Cyber is the gate to your commercialization tomorrow — and the robustness of your security countermeasures the day after.

Ransomware and supply-chain attacks shape how hospitals evaluate device vendors. FDA guidance is more explicit, documentation expectations are higher, review questions are deeper and more technical.

I built OpenCRO with my expertise in the security and privacy space in medical devices/software as a medical device/digital therapeutics/AI-based diagnostics and consumer digital health applications. I was inspired by Practical Threat Analysis, a Microsoft desktop tool that we used at Open Solutions, my security and privacy consultancy back in the day.

OpenCRO integrates a human workflow and an agentic-AI engine I call the Pattern Factory. Pattern Factory agents write reports, extract design patterns and anti-design patterns from content, reasoning over causal flows. Other agents generate threat models from user stories.

In this essay, I describe a debrief of the first mission that OpenCRO executed in January 2026.

Mission Objective

Deliver FDA Cyber threat analysis compliant with 2026 guidance, on time, without regulatory deficiency.

Outcome

Delivered on time. No known structural deficiencies. 11 iterations required.

Cost

1. 2 hours in workshop with customer writing cards

2. 4 hours of model iterations

3. 2 hours in RA/QA manager review

4. 3 hours in FDA reviewer simulation.

5. 9 hours of rework.

What happened (Facts/data)

1. A customer contracted with OpenCRO to perform an FDA Cyber threat analysis for their electrophysiology lab system.

2. We performed a IRL data collection workshop with the team, where they wrote down risk scenarios on paper cards

3. Paper cards were scanned and converted into a user story in markdown format.

4. The Pattern Factory agents generated a threat model from the story.

5. The process worked reliably and took about 30s to populate the threat master tables and relationships in an iteration.

6. I wrote a spec, and the Pattern Factory agents generated the reports (manually imported into Google sheets and linked into the google doc of the report).

7. I discovered a number of weaknesses in my process and in the code. The report went through 11 iterations with 3 iterations of review using 2 language models (chat and Claude) in simulated roles of FDA reviewers. The final report was released on time and is labeled V4.

We’re using Markdown to write stories like this to make it easy for the agents to generate the threat model entities in the PostgreSQL database.

Why did it happen? (Gap between planning and execution)

1. Not properly understanding of threats to patient and medical user safety, for example the ‘Preset configuration may be changed’ threat scenario. The threat was incorrectly classified as attacking patient safety, when in fact it’s an application function used to configure the device for procedures.

2. Not having integral attacker type support in the agent flow. My development decision to postpone implementation of attacker types (defined in the data model but not implemented in the agent flow) resulted in a lack of clarity regarding the classification of threats and in retrospect, I should have invested the 4 hours work to implement attacker types in flow.

3. Not reading the latest guidance thoroughly - relying on LLM interpretation resulted in unnecessary work on my side to figure out the latest guidance, for example residual risk without financial value, and vulnerability exploitability.

4. At one point I started fine tuning the model by surgical changes in the UI and (in 1 case) the PSQL command line which resulted in a lot of manual work that could have (and should have) been saved by creating a new card version and regenerating the threat model with the generate model flow.

Primary root cause

Starting the project before reading the device’s intended use.

Intended use defines safety domain, and safety domain defines asset classification. Without deep understanding of intended use, the threat model drifted.

What surprised me

1. An attack vector with a custom exploit in a software update package emerged late in the game.

2. The current device system architecture with its 21 security countermeasures mitigated 97% of the threats in the model.

3. The model generation pipeline was reliable during the pressure of iterations

4. The bottleneck in the process was not the agent model generation speed (30s) but modeling discipline.

Improvements must focus on modeling discipline (intended use, domain locking, attacker typing) rather than increasing agent complexity.

How can we improve OpenCRO for future missions?

Process improvements

1. Establish the ‘Category’ of the project model as part of the standard terms of conditions of the engagement (FDA Cyber, Business threat modeling, HIPAA, GDPR etc)

2. Understand intended use of the device before modeling in order to properly establish roles of safety, efficacy, data integrity and data privacy in the model.

   1. Phase 1 - manual reading to deepen understanding by analyst and discussion with customer RA/QA.

   2. Phase 2 - agent validates the card story for consistency and completeness vis-a-vis the intended use.

3. Classify attacker types as part of the workshop with the customer

4. After the initial generation of the model, validate the MD card story with the customer team. In particular - validate the DOMAIN tagging in the cards with the customer team, since this will help later on with sanity checks such as privacy threats not tagged in PRIVACY domain.

5. Mandatory meeting with CEO to review and sign off the final report version.

6. No manual DB edits after model generation. All changes must originate from a revised card story and model regeneration.

Code/AI agent improvements

1. Implement the attacker types and attacker_threat relationships in the MD card story, generate agent flow, and upsert procedure (they’re already in the data model)

2. Test if system properly supports multiple vulnerabilities per threat, if not fix bugs

3. Add dry run feature to generate model from story link (basically same agent flow as extract but stopping before calling the upsert procedure).

4. Improve model generation traceability:

   1. Alter column models.version from text to integer column incremented by the upsert procedure every time the model is re-gened.

   2. Add column models.story_link text - story_link used to generate the model entities

5. The edit model currently supports creating a duplicate new model functionality (which is convenient). Better to have a ‘Duplicate model assets’ function as well instead of having to manually re-enter the Model assets

6. Add delete entities before model generation to the upsert (did it manually this time which is a bit dangerous)

7. Use the model ‘Category’ to support different regulatory/business categories:

   1. Different report sets for different categories (FDA Cyber Pre-market guidance, HIPAA Security Rule, GDPR, Business threat modeling etc). The tacit assumption is that the analytical model is invariant across all categories but the reports may differ (for example - VaR in Business threat modeling and exploitability and residual risk in FDA Cyber)

   2. Parametrize binning of mode qualitative valuations (low, medium, high etc) instead of hard coding in the PG logical views.

   3. Implement view groups - this will enable use to have a unique group of views for each category (FDA Cyber, Business threat modeling, HIPAA, GDPR etc)

8. Use the system to log activities in order to perform time utilization analysis for customer-facing and back-office activities (Data collection, bug fixes and enhancements to Models, Cards, Assets, Views, Agents, UI, backend). Use the RULES in order to create views of time utilization.

Outro

OpenCRO delivered on time. More than speed, it delivered depth of analysis of residual risk and exploitability.

In 2026, OpenCRO provides discipline and depth that generalists can’t deliver.

Reply to this post and I’ll send you a free copy of my book “22 Anti-patterns that kill companies.”

If you, a colleague, or a client are submitting a device to FDA in the next 30-90 days — book a call and we’ll see if you’re a good fit.

Life Sciences Today This Week

My guest this week was Sagi Gidali from Rafa’s Moonshot.

Danny and Sagi discuss how Rafa’s Moonshot is turning a rare genetic disorder (STXBP1) into an investable, de‑risked therapeutic opportunity.

Sagi explains how his tech/entrepreneur background shapes a for‑profit mindset around fundraising, biopharma partnerships, and making rare disease indications attractive to industry. They cover building a global network, leveraging grants and consortia, working with academia/CROs, and planning the flip from nonprofit to for‑profit. They also dig into industry “anti‑patterns,” including copy‑paste development strategies, and explore a start from the drug label and work backwards approach.

Rafa’s Moonshot is building a full-stack engine to take an ultra‑rare genetic disorder, STXBP1, all the way from scattered case reports to real, clinic-ready therapies. They start by doing what traditional drug developers often ignore: systematically finding and organizing the global patient population (about 1,400 diagnosed so far), running natural history studies, and deeply understanding disease mechanisms.

On top of that data and insight, they assemble consortia of academic labs, CROs, and biotechs, then use philanthropic capital to unlock 3–4x leverage in non‑dilutive grants for their research partners. The long‑term play is to flip from a nonprofit hub into a for‑profit therapeutic company once there’s enough de‑risked biology, IP, and clinical direction.

Who needs what they’re building?

• Biopharma and biotech looking for de‑risked, ready‑to‑develop rare disease programs.

• Academic groups needing funding, infrastructure, and industry‑grade coordination.

• Investors hunting for high‑impact, capital‑efficient CNS/neurogenetic plays.

• Most importantly, families living with STXBP1 and similar CNS disorders, who need a path to actual treatments rather than yet another descriptive paper.

Sagi closes with his vision for a complete STXBP1 solution, a new CNS neurogenetic research center in Israel, and a stronger Israeli life sciences ecosystem.

You can see the episode here

In 2026, I’m helping 100 founders succeed more

About me

I’m an entrepreneur, writer, host of Life Sciences Today podcast, ex-pharmatech founder, father of 4.

I’ve been building in tech, cyber, privacy, and clinical data for 25+ years across Israeli medical device startups, Verily, Amgen, and the Fortune 1 company.

I work at the intersection of business, engineering, AI and clinical data.

If you love my writing — share it

Share

There’s a story the Israeli MedTech ecosystem tells itself.

1,400+ companies. $3.4 billion in exports. The Startup Nation. A country of 9 million people punching above its weight in medical innovation.

It’s a good story. Parts of it are even true.

But there’s a question the story never quite answers: who actually benefits?

What Israel keeps

Strip out the multinationals selling into Israel, strip out the companies already acquired and now reporting revenue under US or European parent companies, and the independent Israeli MedTech revenue base is remarkably thin.

Novocure: $605M. Israeli-founded, R&D in Haifa, headquartered in Switzerland.

InMode: ~$364M trailing. Declining. Discretionary aesthetics is getting crushed.

Brainsway: $41M. Growing fast but small.

Nano-X: $11M. Still burning cash.

That’s essentially it for publicly traded independent Israeli MedTech. Four companies. One real revenue generator.

The rest of the celebrated ecosystem either hasn’t commercialized, already got sold, or is running on government grants and investor optimism. Given Imaging — the capsule endoscopy pioneer that put Israeli MedTech on the map — was acquired by Covidien in 2014. The revenue now reports through Medtronic. Itamar Medical, Mazor Robotics, Lumenis — all acquired, all gone from the Israeli balance sheet.

The science advances. The commercial ecosystem stays stunted.

The compounding deficit

This is where the comparison to Israeli cyber becomes uncomfortable.

Check Point didn’t just build a great company. It built an ecosystem. The founders, the early employees, the capital they generated — all of it recycled back into Israeli tech. Marius Nacht co-founded aMoon with the proceeds. Unit 8200 alumni built Wiz, CrowdStrike, Armis. The exits compounded into the next generation of companies, which compounded into the next. Israeli cyber is a self-reinforcing engine.

Israeli MedTech isn’t — at least not yet. Given Imaging built and sold. The next generation of Israeli GI founders started from scratch, with another IIA grant, rather than from inside a platform company with commercial infrastructure, a US distribution network, and a CEO who’d already navigated FDA.

Wiz sold to Google for $32 billion. That’s an enormous exit, and the founders are Israeli. But the compounding value of Wiz — the patents, the customer relationships, the talent flywheel — now accretes inside Google, not inside Israel.

The question isn’t whether Israeli founders get rich. Many do. The question is whether Israel gets richer. And on that measure, the scorecard is mixed.

The curse of the subsidy

The Israel Innovation Authority has been subsidizing Israeli tech since 1965. Today that means roughly $300-400M per year in direct grants and indirect capital — including a new $1 billion Yozma 2.0 fund running through 2026.

This is genuinely smart industrial policy. The original Yozma Fund in 1993 created the Israeli VC industry from scratch. The IIA incubator program has produced real companies and real science.

But it also creates a structural dependency that the ecosystem rarely discusses openly. The IIA grant de-risks the early stage so effectively that companies get built that would never survive market selection alone. The grant covers losses while the company searches for a US strategic acquirer willing to pay for the IP.

The model: build with IIA grants → reach clinical proof-of-concept → sell to a US multinational → celebrate the exit.

Except it works for perhaps 20 companies out of 2,000. The rest either flatline at single-digit millions in revenue for years — enough to survive, not enough to matter — or become walking dead: too far along to pivot, too small to attract a serious acquirer, burning through the last of the grant money while the founders wait for a call that doesn’t come.

The IIA subsidies create a very large pool of companies with just enough runway to fail most of the time.

DayTwo is the clearest illustration of what happens when the acquirer doesn’t show up. $85M raised. Gut microbiome IP that was genuinely interesting. Real clinical data. Shut down. The IIA grant was spent. The VC capital was spent. No Israeli anchor tenant absorbed the technology, the team, or the institutional knowledge. It just evaporated.

That’s not a failure of the founders or the investors. It’s what happens when your value capture strategy depends on a single exit event to a foreign acquirer or on the local domestic market.

The reimbursement ceiling

There’s a structural reason this pattern repeats.

You can win FDA clearance from Tel Aviv. Talented regulatory teams, good engineering, and enough capital to run a clinical study — Israel has all of that. FDA regulatory pathways to clearance are hard but navigable from anywhere.

You cannot win US reimbursement from Tel Aviv. CMS decisions require deep relationships with US payers, US hospital systems, US clinical champions. That infrastructure requires physical presence, years of relationship building, and a US commercial organization that Israeli startups typically don’t have the capital to build before they need to sell.

So the commercial scaling — the part that actually generates the recurring revenue that justifies a large acquisition multiple — almost always happens after acquisition, under US ownership. The Israeli company sells at a proof-of-concept valuation. The US acquirer captures the upside of commercialization.

This isn’t a criticism of the ecosystem. It’s a description of where the value accretes in the medtech value chain. Israel is excellent at science.

The returns live downstream of the science.

The cyber contrast

Israeli cyber doesn’t have this problem because the value chain is inverted.

There’s no FDA equivalent gatekeeping US enterprise sales. No 7-year commercialization pathway consuming capital before first revenue. US companies pay real SaaS dollars, on annual contracts, sometimes within weeks of a proof-of-concept. The feedback loop is fast enough that Israeli companies can build US commercial infrastructure before they need to sell — which means they can choose whether to sell, and at what price.

RAD-Bynet stayed Israeli and scaled Israeli and became a $BN incubator for companies like Radware and Ceragon. The RAD-Bynet approach was unique in that it encouraged engineers to leave the mother company, start their own ventures, and receive backing, mentorship, and support from the Zisapel brothers. The RAD-Bynet Group, founded by Yehuda and Zohar Zisapel, is often described as a private incubator and a cornerstone of the Israeli “Silicon Wadi.”

Check Point stayed Israeli and scaled Israeli. Check Point Software Technologies is often referred to as a “mother ship” for Israeli cybersecurity startups, with its alumni founding over 40 successful companies including Palo Alto and Cato.

What this means in practice

For Israeli MedTech founders, the implication is that acquisition readiness is not the same as scientific readiness. The IIA got you to proof-of-concept. That’s the easy part. The hard part is convincing a US corporate development team that you’re a commercial asset, not a science project — that the FDA cybersecurity documentation is complete, the regulatory pathway is clear, and the regulatory risk is priced rather than hidden.

The acquirer’s DD team will find the gaps. Better to close them before the conversation starts than to negotiate around them during it.

For US strategics and mid-market device companies looking at the Israeli ecosystem — the analytical edge right now is understanding which companies have actually cleared the reimbursement and regulatory hurdles versus which ones are running on IIA grants and investor optimism. The ecosystem is deliberately opaque about this distinction. There are real gems in the 1,400+ company pipeline. They’re a small fraction. Finding them requires understanding the structure, not just reading the press releases.

A tool worth knowing

The data in this post came partly from Byte51, built by Matt Gibbs after the SVB collapse took down the life sciences analysis group and CipherBio with it. Matt had started CipherBio at SVB — the best source for life sciences transaction intelligence — and when it shut down he rebuilt it as Byte51. Same concept, same UI, weekly refresh on $2 trillion in life sciences transactions.

I first used CipherBio when I was working on an AI startup for oncology clinical trial risk. I needed to find the right investors. Matt’s advice was simple and exactly right: “Profile companies like yours and see who invested in them at seed stage — we’re the only ones who can do that precisely.” He was right.

If you’re mapping the Israeli MedTech landscape seriously, Byte51 is where I’d start.

If you’re an Israeli MedTech company preparing for a US acquisition conversation, or a corporate development team trying to separate signal from noise in the Israeli ecosystem, I’d like to talk. Reply to this email or find me at dannylieberman.com.

Danny was involved with 35+ Israeli MedTech companies, 13 FDA clearances/approvals, Amgen, Verily and the Fortune 1 company. He is the founder of OpenCRO — the AI Chief Risk Officer, providing FDA cybersecurity threat modeling to MedTech companies.

For $150, you’ll get a 60’ audit call, written evaluation and access to my pattern library.

That’s insane value.

Subscribe now

Zina Sarif, founder and CEO of Yendou, shares her journey from Morocco to Europe, where she pursued chemistry and a PhD in skin cancer research before moving into clinical operations at Parexel and AstraZeneca.

There she discovered the massive “white space” in drug development—up to four years of administrative delay between trial phases, largely driven by slow, repetitive site communication.

Yendou addresses this by acting as a sponsor–site communication platform with site‑centric data architecture and login‑free workflows for sites.

It structures all interactions, automates follow‑ups, and enables reuse of site data across studies, cutting feasibility timelines by 50%, reducing site selection by 13 weeks, and getting 91% of tasks completed within five days.

With 5,000+ sites and 62 site networks already onboard, Zina frames clinical operations as “agents of medical progress” and argues that the real moat is relentless usefulness and execution, not defensive barriers.

Watch this high-energy episode 48 - on how Zina Sarif and her team in Berlin are reducing clinical trial site selection by 13 weeks.

About me

My name is Danny Lieberman. I’m the host of Life Sciences Today.

Book a call with me if you’re innnovating at the intersection of technology and biology and you want the world to know what you’re doing!

For 25+ years I’ve worked across tech, cybersecurity, privacy, and clinical data — from Israeli MedTech startups to Verily, Amgen, and the Fortune 1 company.

Most MedTech companies run their business with 4 separate operating systems: an engineering OS, a regulatory OS, an operations OS, a commercial OS.

They don’t run their business on a single risk OS.

That’s how they get derailed and accumulate expensive mistakes like in today’s story.

If you want a clear view of what’s likely to break in your 2026 plan, book a CEO Audit.

The CEO Audit is a discrete 60’ call with me where we’ll talk about team, capital, reimbursement, regulatory, and operational risk - quietly growing up to bite you.

You’ll get a written post-call summary with action and watch items, and unlimited access to my Pattern Library.

Subscribe now

Photo by Andrea Piacquadio

I wrote a story called “Yasmin” 2 years ago. It’s now a chapter in my book - “Bob and Alice - an anti-love story” - available on Amazon.

It was the first time I wrote about anti-patterns after I discovered a killer anti-pattern called WYSIATI that was afflicting me personally.

Humans are very visual and we tend to draw conclusions based on the appearance of a person or a system.

These conclusions are often wrong.

WYSIATI

Introduction

In this episode of Bob and Alice, we meet Yasmin.

Bob and Alice play a guessing game.

We introduce the WYSIATI anti-design pattern.

Mountainview

There are two people in the reception area. Yael walks over to the broad-shouldered man, with a brightly-colored shirt. “Allan ? I’m Yael from People Operations, I’ll take you over to Mark for your interview.”

Mark speaks little and speaks politely. This frightens people so much that they never question him.

Mark asks Allan - “Tell me about yourself.” Allan is overweight, fidgety, sweaty-palmed and nervous.

“I graduated from Stanford in June and I want to find a job as a software developer. I have a number of projects I worked on. Let me show you examples of my work.”.

Mark says “Show me one.” Allan pulls out his tablet and demos an application for peer-to-peer communications app. It looks like Figma. Mark is thinking WTF. Mark says “What protocol did you use?” Allan says: “TCP”.

Mark says: “Unfortunately, we are doing work in UDP. We will be in touch”.

Yael escorts Allan back to the reception area and tells him: “We’ll be in touch”. Allan knows that the official reason might be one reason or another, but he knows he failed his interview with Mark. He’s still shaking. Mark was one scary dude, he thought.

The second person was tall, slim and very beautiful.

“Yasmin ? I’m Yael from People Operations. I’ll take you over to Mark for your interview.”

Mark speaks little and speaks politely. This frightens people so much that they never question him.

Yasmin sits down in front of Mark’s desk.

Mark asks Allan - “Tell me about yourself.”

“I’m Yasmin, I’ve been working the past 3 years at Tail Scale on the central management and tools for network administrators.”.

“Explain WireGuard to me”.

Yasmin, “Tail Scale uses WireGuard for VPN. WireGuard uses UDP to create secure P2P tunnels. It’s simpler and faster than IPSec and OpenVPN.

“Do you think Wireguard is more secure than IPSec?”

Yasmin, “I don’t know what the marketing people say. I can think of 2 reasons why Wireguard is more secure. First of all, WireGuard is simpler: You can do the work with less code.”

“Why is less code good?”

“Less code makes a smaller attack surface with less vulnerabilities”.

“What else?”

“Wireguard doesn’t store connection state information on the server. This means that attackers cannot exploit the protocol from the server side.

They talked for a few more minutes. Mark paged Yael.

Yael came in and told Yasmin - “I’ll take you over to your next interview with Bob. Bob is the infrastructure group manager.”

Bob, Yael and Yasmin

Yael brought Yasmin into Bob’s office. The 3 of them sat around a small round table.

Bob introduced himself. He was looking at Yasmin - seeing a slim, tall, very beautiful woman. Wearing a white designer t-shirt, expensive-looking slacks, and Mizuno women’s running shoes. Moving like a professional athlete.

Long purple nails. Not the stereotype of a kernel driver software developer.

Bob asked: “Lena speaks very highly of you. How do the 2 of you know each other?”

Yasmin: “We were classmates at San Jose State in the computer science department. We became close friends. At the beginning I helped her with English, and she helped me with the computer science courses. I found some of them challenging. I was on the women’ s track team and we trained a lot. I didn’t always have enough time or energy to hack the homework problems myself. Lena was a big help.

My twin brother, Amir went to Stanford. He is the smart and really successful one. After graduation, he co-founded a startup with a classmate. They sold the company after 2 years. He’s a venture partner at Mayfield and working with a dozen different cybersecurity startups in the Mayfield portfolio. He has this easy charm and ability to succeed. I have to work hard. I’m not successful like Amir”.

“Why do you want to leave Tail Scale and come to work for Google? You know that the founders worked at Google. I’m friendly with Brad Fitzpatrick. He’s a genius”.

Yasmin: “I’ve been there since the beginning and I need a change. The company is doing very well. Brad is a very special guy and I learned a lot from him. Now is a good time for me to move on”.

Bob said - “Yasmin, we will be in touch in the next few days. Yael will escort you out”.

Yael comes back to Bobs’ office.

“What do you think?” Bob asks.

“About what?” “About that story about her brother? I don’t get it”.

Yael is doing her PhD at Stanford in psychology. She’s working on AI in education with Noah Goodman.

“Bob - it’s common for a twin like Yasmin to feel overshadowed by her sibling. Amir’s achievements are impressive. She grew up in an Iranian family with parents who are very competitive. It’s not surprising that she talks more about Amir than about herself. Now listen to this: I did a little background research on Yasmin. She ran a sub 4’ 40s mile at San Jose in her sophomore year. She would have made the women’ s Olympic team if she had not gotten an achilles tendon injury in her junior year. I had a conversation with her after the phone screen. She’s still an active runner and she’s super competitive”.

Bob, “So how do you assess her? Is she an IC (Individual contributor) or EM (Engineering manager)”?

Yael, “It’s hard to say, but I’m willing to bet that 15 years from now, she’ll be VP Engineering at a major tech company. She has the technical chops, people skills and competitiveness”.

5 years later

Venice

Bob, Lena and Iris are at the studio apartment facing the beach, working on the next release of the software for gig workers hour reporting. Barry is at a sales meeting in Marina Del Rey.

Bob is sitting across a desk from Iris, looking at Iris bent over a stack of papers.

Iris is wearing a sleeveless blouse, designer-ripped jeans and stillettos. Reading glasses perched on her nose.

Power look, Bob is thinking, but not saying.

Bob, “We need a kernel driver programmer to support integrating phones and watches”.

Iris, “How long would it take? We’re about to sign a contract with that feature. Barry is meeting with them right now.”.

Bob, “I estimate 3 months of work for someone who knows what they’re doing. There’s a lot of talent out there right now with all tech layoffs, but it will take time to find someone we can trust. I don’t want to go to Upwork. I want someone local, I can trust”.

Lena is listening to the conversation. “Call Yasmin. She’s back in LA. You know, she was laid off from Google. We talk all the time”.

Bob - “I didn’t know that. I lost touch with all the excitement. Let’s call her up now”.

“Hi Yasmin - it’s Bob. How are you? I hear you’re back in LA. Do you have time for a coffee with me? - I might have something interesting for you if you’re available”.

Yasmin - “Hi Bob, I’m great. There is life after Google. Where do you want to meet? I can meet tomorrow morning”.

Bob, “How about Intelligentsia off Venice beach, tomorrow at 10:00?”

“Done. See you”.

Intelligentsia Cafe. Bob is looking at Yasmin. Still tall and very beautiful.

Looks a bit more athletic or maybe it’s his imagination.

Bob, “What brings you to LA?”.

Yasmin, “After I was fired from Google, my parents started pressuring me to come back to LA and find a husband. I had just broken up with my boyfriend in Palo Alto. I don’t mind. The Koreans on Pico do a fine job on nail manicures. I signed up for a Persian dating website. Makes my mom happy. It’s fun meeting rich Persian dudes. They spend money on me. I’m lifting weights, and running a lot, now that I don’t have a day job. What’s up? Lena says you’re working together on a startup out of a studio in Venice”.

Bob, “Yep. I’ll get to the point. We’re developing and selling a cloud service that enables gig workers to report hours using their watch or phone. We need to integrate data flows and develop a management layer. Right up your alley”.

Yasmin, “I can do that. Sounds like fun. What are you paying?”. Bob names a number.

Yasmin, “OK, I can start today. Do you have a contract?”.

Bob, “Just so happens, I do. In my backpack. You wanna sign now?”

Tuesdays with Alice

Bob is back in the Venice gym doing circuit training.

It’s Tuesdays with Alice.

Alice is working on a treadmill when he comes in and parks his bike by the ping pong table.

He finishes the circuit and they take a water break.

Alice is leaning against a pillar in the gym. The old USC sweatshirt and tennis shoes are her trademark. Drinking from a generic water bottle.

Bob smiles and says, “So Alice, what do you do for a living?”.

She smiles back. “Why don’t you guess”.

He takes a stab. “You’re an investment manager at Merrill Lynch”.

“Are you kidding me? Do I look like a baby-raper? Try again”.

“You’re a professor of economics at USC?”

She smiles back. “Keep on guessing. Not even warm, listen, I’m jumping into a shower, I have a meeting downtown. You can walk me to my car”.

After the shower, she comes out - wearing a black pants suit, white shirt, flats.

Alice, “You want another guess?”

Bob, walking her to her car - “Special CIA agent?”

“Not even close. Ciao Bob, I have to roll.”

They both smile at each other, as she gets into her car.

WYSIATI - the anti-design pattern

A design pattern is a template for creating solutions in different situations.

For example, an IKEA cabinet with its little tools and instructions for assembling the table is a design pattern.

An anti-design-pattern is a pattern that guarantees failure in different situations.

For example, not reading the IKEA papers and losing the little tools.

Anti-design pattern WYSATI - What You See Is All There Is

We tend to judge people by their appearances.

In the context of software development, WYSIATI can be jumping to a conclusion regarding the root cause of a bug. After the bug resurfaces 5 months later, you lost context and have to start from scratch.

What does it look like?

You meet a person.

You see a slim, tall, very beautiful woman.

You see that she’s wearing a white designer t-shirt, straight-leg jeans outfit from L’Agence on Rodeo Drive.

It does not occur to you that this person is a talented software engineer who develops kernel drivers with a sense of fashion.

Solving “WYSIATI”

1. Be curious: Be curious without being creepy. Ask what they do for a living.

2. Wipe your disk: Put your first assumption aside and consider other alternatives.

3. Debrief users: Ask your users what they think about the source of the bug. You will be surprised - users are surprisingly intuitive about these things.

4. Take ownership: If an engineer gets stuck in WYSIATI, it’s the leaders fault and leader’s responsibility to fix. This means - it’s the team leader’s responsibility to train the engineers and make sure they have all the tools they need including the capacity to step back and wipe their disk.

“WYISATI” can be challenging, but with extreme ownership and an open mind - you can achieve outstanding results.

Continue reading

A wrong turn based on what you heard and what you saw can result in a catastrophic failure and loss of your optionality in your journey to commercialization of your medical technology.

Stranger in a Strange Land is based on a true story of lose of optionalilty

About me

For 25+ years I’ve worked across tech, cybersecurity, privacy, and clinical data — from Israeli MedTech startups to Verily, Amgen, and the Fortune 1 company.

Most MedTech companies run their business with 4 separate operating systems: an engineering OS, a regulatory OS, an operations OS, a commercial OS.

They don’t run their business on a single risk OS.

That’s how they get derailed and accumulate expensive mistakes like in today’s story.

If you want a clear view of what’s likely to break in your 2026 plan, book a CEO Audit.

The CEO Audit is a discrete 60’ call with me where we’ll talk about team, capital, reimbursement, regulatory, and operational risk - quietly growing up to bite you.

You’ll get written post-call summary with action and watch items, and unlimited access to my Pattern Library.

Subscribe now