 | Life Sciences organisations are innovating faster than ever, adopting AI, moving to the cloud, and connecting operations across increasingly complex ecosystems. But with that pace of change comes a growing question: how do you keep patients, products and data safe, when disruption is not a matter of ‘if’, but ‘when’? Seph Van de Beek, Cybersecurity Lead & Project Manager Life Sciences at Sopra Steria, explains why cyber resilience has become a strategic priority, and what organisations need to get right. |
From prevention to resilience
Ask Seph what ‘Cyber Resilience’ means in a Life Sciences context, and the answer goes well beyond firewalls and threat detection. “It’s about protecting everything from the plant floor to patient data,” she explains. Cyber resilience combines cybersecurity, operational resilience and regulatory compliance to keep critical systems, products and services secure, available and auditable, even when incidents occur. These systems can be anything from manufacturing systems on the production floor to an electronic case report form (eCRF), the digital form used to record information on patients' health, treatment, side effects, and outcomes during a clinical trial.
That distinction matters. In a sector where disruption can affect patient safety, product supply and regulatory compliance, the old goal of simply keeping attackers out no longer covers the risk. “It's no longer just about preventing attacks,” she says. “It's about maintaining trust, continuity and business performance.”
A sector under pressure to innovate
Life Sciences companies today need to innovate faster, and at the same time protect some of the most sensitive assets in the world. The rapid adoption of SaaS platforms, AI and connected ecosystems is creating new opportunities, but also new risks. All the while, companies remain responsible for safeguarding patient data, clinical research, manufacturing operations and intellectual property, within an increasingly demanding regulatory landscape.
Seph points to five forces reshaping the sector at once: the rapid adoption of AI, the move to cloud and SaaS platforms, growing importance of protecting sensitive patient and research data, the convergence of IT and operational technology, and an increasingly demanding regulatory landscape. “Together, these trends are creating enormous opportunities for innovation, but they are also raising expectations around security, resilience and compliance,” she notes. Organisations that can balance innovation with trust and operational continuity will be best positioned to compete in the years ahead.
The Life Sciences sector today is caught between the speed of technological change and the slower pace of governance catching up with it. “AI capabilities are advancing almost daily, cloud and SaaS adoption continues to accelerate, and operational environments are becoming increasingly connected,” she explains. “At the same time, governance frameworks and legislation are often struggling to keep pace with technological change.”
There’s also a dimension beyond technology and regulation: geopolitics. “We see growing concerns around geopolitical uncertainty and digital sovereignty. Organisations increasingly want assurance over where their data resides, who can access it, and how they maintain control over critical digital capabilities and third-party dependencies.” This concern cuts especially deep in a sector entrusted with highly sensitive patient data, clinical trial information, research results and intellectual property.
Building resilience without slowing down
This is where Sopra Steria's approach comes in: helping clients innovate with confidence. Seph: “We help them adopt AI, cloud and SaaS technologies while protecting patient and research data, strengthening cyber and operational resilience, and navigating evolving regulatory requirements.” The approach combines strategy, governance and risk management with practical implementation, testing and validation, enabling organisations to accelerate digital transformation while maintaining security, compliance, operational continuity and trust.
What makes this approach distinctive, is refusing to treat these as separate problems. “Cyber resilience is no longer just a cybersecurity topic; it intersects with data, AI, cloud, operational technology, regulatory compliance and business transformation.” In practice, that means bringing together experts across business lines, combining deep Life Sciences knowledge with expertise in cybersecurity, AI, data, cloud, OT and compliance. “This allows us to deliver end-to-end solutions that balance innovation, compliance and resilience, helping clients solve complex challenges from multiple perspectives rather than addressing them in isolation.”
"Cyber resilience is no longer just a cybersecurity topic; it intersects with data, AI, cloud, operational technology, regulatory compliance and business transformation."
One recent engagement illustrates the point. A client undergoing major digital transformation — increasing its adoption of cloud services, SaaS platforms and new digital technologies — found itself lacking a consistent view of its cyber risks, and with it, confidence in its ability to withstand and recover from disruption. Rather than treating this as a narrow security fix, Sopra Steria helped the client assess its resilience posture and build a more structured approach to governance, risk management and security. The focus was not only on security, but on ensuring the organisation could continue operating effectively through change or disruption. The result: clearer understanding of its risk landscape, improved governance and decision-making, strengthened resilience capabilities, and greater confidence in its digital transformation journey.
The misconception that holds organisations back
If there's one myth Seph wants to put to rest, it's that cyber resilience belongs to the cybersecurity team. “It doesn’t. Resilience is a business capability, not a technical capability.” In Life Sciences specifically, everyone plays a role, from leadership and operations to quality, compliance and individual employees.
Phishing emails are her go-to example: no cybersecurity department can stop them on its own. Preventing them depends on staying alert, reporting suspicious emails through the right tools, and making sure people are trained to recognise them in the first place. The organisations that succeed, she says, are those that move beyond prevention and build resilience into their people, processes and technology from the outset, enabling them to innovate securely while protecting sensitive data and maintaining trust.
What comes next
Looking ahead, Seph sees one combination defining the next few years above all others: AI and cloud-based operating models. “AI is advancing at an unprecedented pace, while SaaS and cloud technologies are becoming the foundation of modern organisations. The opportunity is enormous, but so is the challenge: how do you innovate quickly while protecting sensitive patient and research data, maintaining compliance, and ensuring resilience?” That balance, she believes, will define the next generation of Life Sciences leaders.
Her advice to organisations preparing for what's ahead is refreshingly pragmatic: don't chase the elimination of every risk. “Focus on governance, adaptability, and informed risk-taking,” she says. “Rather than trying to eliminate every risk, build the governance, resilience and decision-making capabilities needed to manage risk intelligently.” In a world shaped by AI, SaaS, geopolitical uncertainty and rapidly evolving regulations, she adds, “the ability to adapt quickly may become the most important resilience capability of all.
"The opportunity is enormous, but so is the challenge: how do you innovate quickly while protecting sensitive patient and research data, maintaining compliance, and ensuring resilience?"