This is Part 4 of a five-part series on cybersecurity, AI governance, and the future of biological research. Part 1 laid out the governance gap and its history, Part 2 put documented cases and numbers behind it, and Part 3 looked at where the technology is headed next. This part examines what a research organization can actually build in response. Part 5 closes the series with how Senserva helps close the gap at the infrastructure layer.
Previously in this series: Part 1 introduced the three-layer governance gap and its history. Part 2 documented the cases: biosecurity misuse, patient-privacy failures, and clinical AI models like IBM Watson for Oncology and the Epic Sepsis Model that broke down outside the setting that trained them. Part 3 looked at where the technology is headed next, more autonomous research agents, a new agentic attack surface, and regulators facing biological outcomes with no precedent to compare them against.
Govern the data before it enters the pipeline, not after
The Global Biodefense analysis is explicit: the digital infrastructure of biological research, cloud-based genomic databases, automated sequencing platforms, bioinformatics pipelines, represents a new frontier for biosecurity oversight that most regulatory frameworks do not yet address. Malicious access to these systems could enable theft of pathogen data, tampering with experimental processes, or circumvention of DNA synthesis screening.
The most concrete answer currently on the table for how to govern that boundary is the tiered Biosecurity Data Level (BDL) framework proposed by the Johns Hopkins Center for Health Security. It sorts biological data into four tiers, from BDL-0/1, low-risk public data with minimal governance overhead, up to BDL-3/4, high-consequence data requiring Trusted Research Environments, audited access, and export controls (Berke, 2026). The framework's underlying premise is one every research organization can apply today, even informally and without waiting for federal rulemaking: govern the data before it enters the AI model training pipeline, not after the model shows a concerning capability or a privacy leak.
That tiering sits inside a broader distinction the governance literature draws between "hard law" and "soft law," and it clarifies what kind of instrument an organization is actually choosing when it writes an internal policy. Hard law is binding: national legislation and international treaties such as the Biological Weapons Convention or FDA biotechnology oversight, with formal sanctions for noncompliance, but slow to negotiate and difficult to amend. Amending the BWC requires consensus among 183 state parties, a timeline nowhere close to the pace at which AI-enabled biotechnology moves (Trump et al., 2026). Soft law is voluntary: industry standards such as the International Gene Synthesis Consortium's DNA screening protocols, which can be revised quickly and have already been updated to include machine-learning-based sequence screening that catches threats older homology-based methods miss, but which carry no binding enforcement and no guarantee of comprehensive coverage across every actor in the field (Trump et al., 2026). Most of what a single research organization can actually build internally, an access-tiering scheme like BDL, an internal review board, a data governance policy, functions as a form of soft law. It is faster to stand up than waiting on hard law, and it beats having no governance at all while that regulation catches up.
Toxicology already built a validation discipline biology can borrow
Toxicology, which has spent decades validating whether a test method's results can be trusted before it is used to make a regulatory decision, has already run into the exact same question biological AI is running into now: how do you validate a model that keeps learning and changing, when your validation tradition assumes a method gets frozen and tested once? Hartung and Luechtefeld argue that the old validation model, "rooted in ring trials, protocol freezing, and one-to-one concordance with animal models," cannot accommodate a model that is dynamic by design (Luechtefeld and Hartung, 2025). This is not a toxicology-specific puzzle: validating a model that keeps changing after deployment is an AI governance question wherever it comes up, and biological research is only the latest field running into it.
Their answer is a framework called e-validation, built around five principles they call TREAT: Trustworthiness, Reproducibility, Explainability, Applicability, and Transparency. In practice, it has five components an organization can actually run. Smart reference compound selection uses clustering methods to pick a structurally and mechanistically diverse test set instead of the same overused historical benchmarks, the biological equivalent of making sure a validation set is not quietly a rerun of the training set. Simulated validation studies use virtual modeling to pre-test a study design before committing to expensive wet-lab work, catching design flaws early. Mechanistic cross-validation uses large language models and literature mining to check whether a model's predictions line up with known biological mechanisms rather than just historical outcomes, an automated sanity check against the actual science. AI-enhanced training dashboards standardize how a method is taught and applied across different labs so results stay consistent. Companion agents continuously monitor a deployed model's real-world performance after launch and flag when it needs to be retrained, which is the toxicology field's version of watching for the concept drift described in Part 2 of this series. The authors are explicit that the goal is a shift from "validate and forget" to "validate, monitor, and evolve." None of these five components are specific to biologic research; any organization managing a model that keeps learning after deployment, in whatever industry, can and should run the same validate-monitor-evolve cycle.
The same paper is candid about a second issue that gets less attention: data quality itself. The old mantra of "trash in, trash out" still holds in AI-driven toxicology, except now it is not humans sorting through the trash data, it is machines, which means bad data can get automated into a model's foundations faster and with less human scrutiny than before. Their recommended countermeasure is equity-aware data governance: explicitly auditing training data for demographic and geographic representativeness, and closing gaps with targeted data collection rather than assuming a large dataset is automatically a representative one. For the hallucinated-but-plausible outputs that literature-mining and lab-automation agents can produce, the same paper recommends retrieval-augmented generation grounded in real sources, ensemble verification across multiple methods, and a mandatory human-in-the-loop review before any high-impact conclusion is adopted.
Securing the agent itself: TRiSM and Violet Teaming
The agentic AI literature converges on a small set of practical countermeasures that map directly onto standard security hygiene, just applied to a newer kind of workload: sandboxing agents so they cannot touch the underlying operating system or sensitive data directly, enforcing the principle of least privilege so an agent only has access to the tools and data its specific task requires, requiring authentication between agents rather than assuming an internal message is trustworthy, and continuously monitoring agent behavior rather than only reviewing final outputs (Peykani et al., 2026). A framework called TRiSM, for Trust, Risk, Security, and Management, organizes this into four pillars: security, privacy, governance, and explainability, and proposes concrete metrics for how safely agents and tools are interacting with each other, not just whether the final answer looked right (Raza et al., 2026, as cited in Peykani et al., 2026).
A related approach called Violet Teaming pushes further than sandboxing and least privilege by folding real user behavior into the security model itself, rather than testing the system in isolation from how it is actually used (Titus and Russell, 2023). Where a red team asks how an adversary could break a tool, Violet Teaming asks how the tool behaves once ordinary users interact with it in their normal workflow, which is often where governance gaps in agentic systems first show up in practice, well before an actual attacker finds them. If a research assistant agent can execute code, call APIs, or hand tasks off to another agent, it needs both of these passes, not a one-time review before it was turned on. ISO/IEC 42001 formalizes a similar two-pass structure for AI systems generally: Annex Control A.6.2.4 requires verifying that a system was built to its technical specification and separately validating that it performs its intended purpose under real conditions, and Annex Control A.6.2.6 carries that discipline past deployment into ongoing operational monitoring. Red-teaming and Violet Teaming map onto that same verification/validation split for agentic tools specifically, one testing whether the system can be broken, the other testing how it behaves once real users are actually running it (International Organization for Standardization, 2023). Epic's own security practice now matches that same pattern: at its 2026 Users Group Meeting, the company disclosed using Anthropic's restricted-access "Mythos" model, available only through the controlled Glasswing program, to search its several-hundred-million-line codebase for vulnerabilities its own developers had missed, rather than granting that access broadly (Diaz, 2026). That is least privilege and controlled access working exactly as intended, on the same kind of high-stakes, high-access agentic task this section is describing.
Building trust into the model itself
Treat federated learning and differential privacy as standard infrastructure, not optional extras, whenever data is pooled across institutions. Jiang et al. call for "developing privacy-preserving technologies like differential privacy and federated learning, along with establishing ethical review procedures and compliant data governance frameworks" as essential for responsible AI deployment in bioinformatics. Wu et al. echo this from the drug-development side, describing "modern encryption approaches and federated learning frameworks [that] allow collaborative model training without compromising data privacy." The larger the pool of contributing sites, the larger the attack surface, and the more this shifts from a nice-to-have to a baseline requirement.
Build explainability into the pipeline, not into the paper's discussion section. Methods like SHAP, LIME, Grad-CAM++, and attention-based attribution should be part of how a model is developed, so a flagged biomarker or drug target can be traced back to a biologically plausible mechanism before anyone acts on it. Where the option exists, a biologically-constrained architecture, one that can only wire its internal connections along a curated map of known biological pathways drawn from resources like Reactome or the Gene Ontology, is a stronger guarantee than a post-hoc explanation layered onto a black box after the fact (Saha et al., 2026, describing architectures such as P-NET). Post-hoc tools describe what a black-box model paid attention to after the fact; a biologically-constrained architecture cannot form a connection that has no basis in known biology in the first place. Ask a vendor's "explainable AI" claim which one it is actually getting.
Check for batch effects and dataset shift before trusting cross-site results. If a model trained at one institution or on one platform is going to be used anywhere else, run the correction methods, empirical-Bayes approaches like ComBat for structured omics data such as gene expression or methylation arrays, and adversarial domain-adaptation methods for imaging or pathology slides, and report the diagnostics alongside performance numbers, not instead of them.
Ask whether a model's output changes a decision for the better, not just whether it scores well. Standard accuracy and AUC-ROC numbers can look impressive while being clinically meaningless in exactly the situations where the stakes are highest, such as detecting a rare mutation or an early-stage cancer where the positive cases might be one percent of the dataset or less. A model that predicts "negative" for everyone can still score 99 percent accuracy while providing zero clinical value. Decision Curve Analysis addresses this by asking a more direct question: across a realistic range of decision thresholds, does using this model's output actually produce a better outcome than either treating everyone or treating no one?
The checklist
Put together, this is what an internal governance program actually looks like in practice:
- Audit the digital chain of custody: who has access to what, when was it last reviewed, and are there stale service accounts or app integrations, inside the tenant and on the lab instruments connected to it.
- Do not rely on de-identification alone. Test for PII replay and re-identification risk in longitudinal, multi-omics profiles rather than assuming it away.
- Treat federated learning and differential privacy as baseline infrastructure whenever data is pooled across institutions.
- Build explainability into the pipeline itself, not just into the paper's discussion section. ISO/IEC 42001's own verification-and-validation guidance ties this same expectation, that a system's outputs be adequately interpretable, directly to Annex Control A.6.2.4, not just to how the results get written up.
- Watch for proxy variables that quietly encode bias, not just underrepresented groups in the training set.
- Treat model validation as a lifecycle, not a one-time gate: monitor for drift the way the toxicology field's companion agents do. This is exactly what ISO/IEC 42001's Annex Control A.6.2.6 operational-monitoring requirement asks for, not an optional best practice layered on top of it.
- Check for batch effects and both covariate and concept shift before trusting a model across sites.
- Ask whether a model's output changes a decision for the better, not just whether it scores well.
- Apply the same sandboxing, least-privilege, and authenticated-communication controls to agentic AI tools that you already apply to service accounts, and run a Violet Teaming pass alongside standard red-teaming.
- Verify, don't assume, that audit logging is healthy and retained long enough to investigate an incident.
- Categorize data by consequence, not convenience, using a simple internal version of BDL tiering.
- Never let AI output substitute for domain-expert review.
- Do not mistake a vendor's published AI ethics guidelines for your own governance program. A vendor's voluntary ethics statement is not an audited management system, which is exactly the gap a certification like ISO/IEC 42001 exists to close.
- Extend governance structures you already have, IRBs, broader impact statements, funding-body disclosure requirements, rather than inventing new ones from scratch.
- Know which regulatory clock you are on if your roadmap spans multiple jurisdictions; the FDA, EU, and India are handling continuous model updates differently, and that is a design constraint, not a footnote.
The chain of custody extends into the cloud, and into the model
Biological researchers already understand why data integrity matters. The chain of custody that protects a clinical sample does not end at the lab door. It extends into every system that stores, processes, and analyzes that data, now into every model trained on it, and into every agent acting on that model's behalf. A model's outputs are only as trustworthy as the pipeline behind them, and that pipeline includes the cloud tenant, the access controls, the de-identification process, the privacy-preserving training method, and the benchmarking and explainability discipline used to confirm the model learned real biology rather than its own training set or a bias in the cohort that produced it.
Oncology showed, in Part 2 of this series, what it looks like when that discipline is skipped: models that score well internally and then fail, sometimes publicly, once they meet a different hospital, a different patient population, or a different point in time. Toxicology has shown what the alternative looks like: validation treated as a lifecycle rather than a one-time gate, with explicit mechanisms for catching drift and checking a model's output against actual biological mechanism rather than historical pattern-matching alone. Neither field got there by accident, and neither shortcut is available to biological AI research that wants to be trusted.
Cybersecurity, cloud security, and AI governance are not three separate checkboxes. They are one integrated system of trust, and the biology coming out of it is only as credible as the pipeline that produced it. Securing that pipeline is not an IT problem that someone else handles. It is part of doing science that can be trusted.
Part 1 covered the problem and its history. Part 2 put documented cases and numbers behind it. Part 3 looked at where the technology, and the risk, is headed next. This part laid out what to build now, and none of it requires waiting for regulation to catch up. Part 5 closes the series by looking at how Senserva helps a research organization close the gap at the infrastructure layer specifically. That layer is not a substitute for the data and AI governance practices this part just laid out; it is the access and audit trail record both of those depend on to be verifiable in the first place.
About Senserva: Who We Are and What We Do
Senserva is a Microsoft-focused security posture management company based in St. Paul, Minnesota. Its platform continuously scans an organization's Microsoft 365, Intune, Defender, and Entra ID environment, running several hundred built-in checks across identity, privileged access, applications and service principals, endpoint and device compliance, email, logging, and Azure subscription roles.
For every finding, Senserva provides step-by-step remediation guidance, including validated PowerShell scripts and rollback notes, and maps results to recognized compliance frameworks such as the Microsoft Cloud Security Benchmark, CISA's SCuBA baselines, NIST 800-171, CIS, ISO 27001, SOC 2, HIPAA, and PCI-DSS. Senserva is a member of the Microsoft Intelligent Security Association (MISA) and a Microsoft Security Excellence Awards finalist.
Senserva also offers Three Free Unlimited Audits covering every tenant, user, and patch: one to Find, one to Fix, and one to Prove, using the same 650+ checks described above. Registration takes only a work email, with no cost and no obligation to buy. Request an evaluation key at senserva.com/request-key.html.
Senserva also runs Senserva Watch, a free membership that tracks CVEs and Microsoft patches on an organization's behalf and sends an alert only when something being tracked changes, including a same-day notice when Microsoft's Patch Tuesday updates ship. Signing up needs no tenant connection, agent, or call, just an email address, at senserva.com/senserva-watch.html.
Already a Senserva Watch member, or ready to join? Sign up at senserva.com/when-the-lab-meets-the-cloud.html to get the complete five-part series sent to your inbox, plus everything else membership includes: alerts when a CVE or KB you follow changes, a fresh audit credit every quarter, and 20% off when you buy.
Learn more at senserva.com.
Sources cited in this part
- Berke, Allison. Risk-Based Categorization and Governance of Biological Data in AI Systems. Johns Hopkins Center for Health Security, March 2026.
- Trump, Benjamin D., et al. "Governing the AI-biotech convergence." EMBO Reports 27 (2026): 259-264.
- Luechtefeld, Thomas, and Thomas Hartung. "Navigating the AI Frontier in Toxicology: Trends, Trust, and Transformation." Current Environmental Health Reports 12 (2025): 51.
- Peykani, Pejman, Sanly Ghanidel, Iman Javadi-Sisi, Vaclav Snasel, and Seyedali Mirjalili. "A Holistic Review of Agentic AI Frameworks, Applications, and Research Trajectories." Archives of Computational Methods in Engineering (2026).
- Raza, S., R. Sapkota, M. Karkee, and C. Emmanouilidis. "TRiSM for agentic AI: a review of trust, risk, and security management in LLM-based agentic multi-agent systems." AI Open 7 (2026): 71-95.
- Titus, Alexander J., and Adam H. Russell. "The promise and peril of artificial intelligence, violet teaming offers a balanced path forward." Preprint at arXiv, 2023.
- International Organization for Standardization. ISO/IEC 42001:2023, Information Technology, Artificial Intelligence, Management System. 2023.
- Diaz, Naomi. "Epic's Roadmap: 12 Takeaways From Judy Faulkner." Becker's Hospital Review, August 18, 2026.
- Jiang, J. et al. "Artificial intelligence in bioinformatics: a survey." Briefings in Bioinformatics (2025).
- Wu, X. et al. "Reimagining human-centric drug development with new approach methodologies." Science (2026).
- Saha, Shalini, et al. "Navigating AI and machine learning in cancer research: an end-to-end translational framework." Journal of Translational Medicine 24 (2026): 827.