Clinical.ly ’s CEO, Henry Kravchenko, joined the Essential Cybersecurity: Defending Your Site in a Digital World panel at the SCRS Global Site Solutions Summit 2025 alongside David Vulcano, Vice President of Research Compliance & Integrity at HCA Healthcare and SCRS Board Member; Nelly Nauman, Chief Information Security Officer at Parexel; Anders Lindquist, Senior Manager of Research Site Enablement at Labcorp; and Chris Prater, President of RPM Technologies.
Together, the panelists brought perspectives spanning site operations, clinical technology, and enterprise security—offering a unified call for stronger cyber resilience across clinical research sites. As cyberattacks become increasingly advanced, automated, and relentless, the clinical research industry finds itself at a critical crossroads. Their message was unequivocal: cybersecurity is no longer optional but imperative for research sites.
AI: The New Weapon in Cybercrime
AI is rapidly reshaping the threat landscape, and its impact is impossible to ignore. Since the launch of ChatGPT, phishing attacks have surged; as a result, what was once a growing concern has now escalated into a global cybersecurity crisis. What previously required a human scammer now happens at an industrial scale: automated spear-phishing campaigns target thousands of people per hour. Even more concerning, uncensored AI attack tools are openly sold on the dark web for a very low price. Consequently, they enable virtually anyone with malicious intent to script and launch sophisticated attacks with alarming ease.
Where Attacks Land Most
The numbers are stark: 90% of breaches involve business email; 68% strike cloud environments. Yet across every vector, one weakness remains constant—human behavior. Training, culture, and vigilance continue to define the thin line between resilience and disaster.
Expert Insights: Security is Personal
-
Henry Kravchenko, CEO of Clinical.ly and former hedge fund CTO, underscored that high-value targets require high-value security cultures. His Wall Street experience reinforced how lapses can cost billions—and in research, the stakes include lives.
-
Nelly Nauman, CISO at Parexel, described defending against 12–15 site-level cyberattacks annually. She stressed that invoice fraud and email compromise are daily battles.
-
Chris Prater of RPM Technologies, who has worked in managed IT services for thirty years, pushed for trusted device policies as the new frontier, arguing that multi-factor authentication (MFA) is no longer enough.
Small Sites, Big Targets
Financial protection has become a top priority for smaller clinical sites, which are increasingly being targeted by cybercriminals. Verification calls on known numbers, vendor codes for account changes, and close payment monitoring are non-negotiable. The panel was unanimous on email security: don’t cut corners. A proper business license with phishing protection, multi-factor authentication (MFA) blocks 99.9% of automated attacks, and password managers form the essential baseline.
In addition to these fundamentals, sites must also shore up infrastructure. Specifically, they should avoid public Wi-Fi by using $15/month hotspots, isolate accounting systems from everyday computers, and install strong web protections to prevent malware downloads. By layering these precautions, sites can drastically reduce their cyberattack exposure and minimize financial risk.
Insider Risks and Vendor Weak Links
Perhaps the most unsettling reality is that the most significant threats often come from the inside. A single disgruntled employee siphoning off small amounts or gaming invoices can quietly drain resources. Therefore, immediate access termination upon departure was a universal recommendation.
In addition, vendors introduce vulnerabilities, often becoming unintended entry points for attackers through insecure connections and weak security practices. Panelists pointed to infamous breaches—from retail to healthcare—caused by poorly secured connected devices. As a result, sites should demand cyber insurance, review penetration test results, and push vendors for clear proof of their security culture.
Locking Down Access
Access control emerged as a frontline defense:
-
Geofencing and IP whitelisting to block suspicious traffic.
-
Single Sign-On (SSO) to streamline access and allow instant deactivation.
-
Always-on VPNs for mobile staff, paired with conditional access rules based on device and location.
Panelists argued that this layered approach is how clinical research can stay ahead of relentless attacks.
A Call to Culture
Cybersecurity in clinical research isn’t about tools or technology alone—it’s about people, process, and purpose. Proper protection comes not from the firewalls we build, but from the discipline and culture we cultivate daily.
The panel’s message was unmistakable: the most significant threat isn’t the hacker outside the organization; it’s the complacency within.
As clinical trials become increasingly digital and interconnected, safeguarding research integrity demands vigilance at every level—from endpoints and inboxes to leadership and vendor ecosystems. For sites and sponsors alike, the moment to act is now. The industry’s digital transformation can either expose its vulnerabilities or showcase its strengths. The difference lies in one thing: a culture committed to resilience.