Business Risk Profile: Pharmaceuticals

Companies in the innovation-driven pharmaceutical industry are no strangers to risk. Operational risk is an inherent aspect of pharmaceutical research and development, with 4.9 percent of new drugs making it from first toxicity dose to final market approval. Pharmaceutical companies also face financial and strategic risks when bringing new drugs to market, as well as compliance risks from navigating the ever-changing regulatory landscape.

In addition to risks related to core business activity, pharmaceutical companies must also pay consideration to malicious threats, including, but not limited to:

Intellectual Property Theft and Cyber Espionage

On average, pharmaceutical companies spend $2.6 billion USD developing each new drug that is brought to market through an exhaustive, five-stage process that often takes longer than 10 years to complete. The lengthy, capital-intensive nature of developing new drugs makes intellectual property (IP) protection crucial to a pharmaceutical company’s ability to fund its R&D efforts and sustain a competitive advantage.

Given its high intrinsic value and strategic importance, pharmaceutical companies’ IP, research, and other commercially sensitive information may attract the interest of a diverse range of threat actors, ranging from rival corporations to nation states. In an industry where competitors engage in decades-long races to bring new drugs to market, corporate espionage is a legitimate threat. Meanwhile, certain nation states have even been known to conduct cyber espionage to gain an economic advantage over other countries at the forefront of technological and medical advancement. To avoid law enforcement detection, IP theft and cyber espionage schemes are often hatched within the encrypted forums of the Deep & Dark Web (DDW).

Underground Drug Trafficking

The DDW also serves as a platform for multiple underground drug marketplaces, where a wide variety of prescription drugs ranging from opioids to inhalers are illegally bought and sold. In addition to diverting revenue from pharmaceutical companies, these illicit DDW pharmacies can fuel addiction and abuse. DDW drug marketplaces also attract customers who lack health insurance and are seeking affordable treatment for legitimate reasons. However, these customers are putting their health at risk by purchasing medications without regulatory oversight or the involvement of a physician. In some cases, DDW vendors have been known to sell placebos, or worse, pills containing harmful substances.

Insider Threat

Many companies devote the majority of their security resources to defending against external threats, which is why it can be easy to overlook the ever-present risk of rogue employees abusing their privileges for personal gain at the expense of the company. Pharmaceutical companies are particularly susceptible to insider threat activity due to the astronomical value of the IP they hold and strong black-market demand for prescription drugs. Insider threat actors often operate primarily within the forums and marketplaces of the DDW when advertising stolen intellectual property, diverted drugs, network credentials, or other resources.

—

Threat actors who possess the level of sophistication needed to pose a legitimate threat to pharmaceutical companies will likely take considerable measures to evade detection. Without visibility into the DDW, pharmaceutical companies may be unable to proactively anticipate and mitigate threats originating from the encrypted communities of the cybercriminal underground.

Flashpoint combines extensive monitoring of DDW activity with the specialized subject-matter expertise of our analyst team to deliver Business Risk Intelligence (BRI), equipping our customers with a decision advantage over the threats and adversaries that matter to them the most.

To learn more about how pharmaceutical companies are leveraging BRI, download our Business Risk Intelligence (BRI) for Pharmaceuticals use cases.