What Life Sciences Leaders Learned From a Live Cyber Crisis Tabletop and FBI Briefing

On October 13, executives and directors from across the life sciences community spent a morning inside a cyber crisis that hadn’t happened yet. centrexIT co-hosted Leading Through a Cyber Crisis: An Executive Workshop with Biocom, the Cyber Center of Excellence (CCOE) and Coalition. The morning paired a live IRGame tabletop exercise with an FBI cyber briefing and a practitioner panel.

The full Day After Report is free to download at the end of this post. Here’s the short version.

The scenario: an AI assistant that worked a little too well

The room played the leadership team of a fictional clinical-stage oncology biotech with about 350 employees, a lead candidate in trials and a partnership deal mid-negotiation.

Nothing looked broken on Monday morning. The company’s internal AI research assistant was performing unusually well. A contract manufacturer seemed oddly fluent in internal formulation details. An overnight spike in assistant traffic was written off as a batch job.

Behind all three was one stolen login. A researcher’s session tokens, captured through a personal AI tool used because it was faster than the approved one, let an outsider act as that researcher and quietly query the internal assistant for weeks. By Friday the team was facing an anonymous tip to its partner, employees contacted directly on social media by the attacker, and a $2.5 million extortion demand on a 72-hour clock.

The attacker never broke in. They logged in.

What the room surfaced

Seven points came up at the tables again and again:

• Have an AI policy, and train people on AI and cybersecurity together. A rule nobody has been taught isn’t a control.
• Put tools in place to detect shadow AI. Know which outside tools touch company data before an incident tells you.
• Keep a documented incident response plan. List every contact, and name a primary and a backup for every role.
• Build a relationship with your cyber insurer early. Know exactly what to do and whom to call when it’s time to give notice.
• Treat phishing-resistant MFA, advanced email protection, EDR and MDR as the baseline. These are what make a stolen login harder to use.
• Follow least privilege. Keep admin accounts separate from the accounts people use for email and browsing.
• Agree on a communication plan in advance. Decide what gets said internally, to the board and externally, and who approves it.

The hardest moment of the week wasn’t technical. Capable leaders waited on each other because the plan named a response team but not who had the final word on containment, disclosure and spending.

What the FBI and the panel said

After the exercise, FBI Supervisory Intelligence Analyst Daniel Kunz briefed the room, followed by a panel with Jess Stainer of Coalition Incident Response, Bill Reid of CCOE and National University, Vidya Murthy of MedCrypt, and centrexIT’s Josh Hohbein, who facilitated the exercise. The points that landed hardest:

Report early. The FBI investigates cyber criminals and works to impose consequences on them. It isn’t an incident response firm and won’t tell you how to secure your network, but reports still feed its intelligence even if nobody calls you back. File through the Internet Crime Complaint Center (IC3) or contact the FBI San Diego field office.

If money was wired, hours matter. The speaker said IC3 can try to recover wired funds, and that after 24 to 48 hours the money is usually gone. Call your bank and IC3 right away, before you have the full picture.

The ransom decision belongs to your board, counsel and insurer. The FBI won’t tell you whether to pay. Paying isn’t itself a federal crime, but paying a sanctioned party is a serious problem, so check the OFAC sanctions list and call the FBI before any payment.

MFA isn’t finished. Session tokens can be stolen even when MFA is on, which is exactly how the scenario’s attacker acted as a real employee. Move toward phishing-resistant MFA and pair it with managed detection and response that flags logins from unusual places or devices.

AI agents inherit their user’s access. An agent can reach whatever the employee using it can reach. Classify your data, archive stale files and lock down overshared document libraries before you roll agents out.

In the first hour, disconnect. Don’t wipe. Take affected machines off the network so the evidence survives, and don’t rush to restore. Your backups may predate the attacker’s entry.

Intellectual property can’t be restored once it leaves. Immutable backups protect you from encryption, not theft. Know where your crown jewels live, who can reach them and whether those systems keep logs someone actually reads.

For public life sciences companies, scrutiny is also rising: the FDA and SEC have entered an agreement to share information about the companies they both regulate, as Debevoise explains. Have counsel look at how an incident and its disclosure would read to both agencies.

Five things to do in the next 30 days

These come straight from the report’s 0 to 30 day action list:

1. Find out what your internal AI tools can reach today, and who would notice if that changed.
2. Check that your incident response plan lists every contact with a working number, and a named primary and backup for every role. Print the who-to-call list.
3. Find your cyber insurance policy, confirm the notice window and business interruption terms, and book time with your broker.
4. Turn on the Microsoft Purview unified audit log if it isn’t on already.
5. Write down who has the final word during an incident, and share it with your leadership team.

Download the full Day After Report

The full report covers the scenario’s critical decision points, everything the FBI and panel shared, a checklist for cleaning up a compromised Microsoft 365 account, a who-to-call list for your plan, and a 0 to 90 day action plan with metrics.

Download the Day After Report (PDF)

Thank you to Biocom, CCOE and Coalition for co-sponsoring, to our speakers, and to everyone who sat at the table.

Bring this exercise to your own leadership team

If the morning raised questions about your own plan, your AI tools or your insurance terms, book a 30-minute cybersecurity assessment. We’ll walk through your incident response plan, your who-to-call list and your baseline controls, and you’ll leave with a short list of what to fix first.

We can also run this tabletop privately for your executives, built around your own structure and your actual plan. Contact us to set it up.

centrexIT is a San Diego managed IT and cybersecurity company serving organizations since 2002, and a Biocom Endorsed Partner.