Genomic infrastructure security
Security research for the systems that turn DNA into data.
ThreatFight is an independent security research practice. We offer security assessments of sequencing instruments, lab software, bioinformatics pipelines and genomic data platforms, and genomic data-flow mapping for organizations subject to the U.S. DOJ Data Security Program.
Scope
Four layers between a sample and a result.
- 01
Sequencing instruments
Instrument control workstations, onboard services, baseboard management controllers, firmware and vendor remote-support paths.
Questions we askWhat listens on the lab network? What can the vendor service account reach? Which patches and field safety notices are actually applied?
- 02
Lab software
LIMS, instrument control and data collection software, analysis suites and the result files they write.
Questions we askCan a result file be altered without detection? Who can change a run between the instrument and the signed report?
- 03
Bioinformatics pipelines
Workflow engines (Nextflow, Snakemake, Galaxy, Cromwell), community pipelines and modules such as nf-core, container images, reference data and configuration.
Questions we askWhat code does a pipeline fetch at run time, from where, and pinned to what? Which configuration layers can change what executes?
- 04
Genomic data platforms
Cloud genomics workspaces, biobank and research access environments, data-sharing agreements and export paths.
Questions we askWho can export in bulk? Where do derived datasets end up? Which vendors and jurisdictions touch the data?
Why now
The public record since 2023.
Sequencers and lab software now appear in CISA medical advisories, genomic data holders have been breached and sold, and U.S. rules treat genomic data as a national-security category.
Every entry below is a public advisory, filing, notice or regulation published by others. ThreatFight did not discover or report any of these issues.
These advisories credit a small number of reporters, and several of the Thermo Fisher CVEs name none. Workflow engines have barely been looked at: in NVD, as of October 2026, Nextflow has one CVE and Snakemake and Cromwell have none; Galaxy, a web platform, has more (keyword and CPE search, so a lower bound). We read that as limited scrutiny, not as evidence the code is sound.
Engagements
Assessments, data-flow mapping, research.
- 01
Security assessments
Sequencing labs, biobanks, clinical genomics labs, genomic data platforms
Instruments, lab software, pipelines and the networks between them, scoped to your instruments, run schedule and validated workflows. You get a findings report with reproduction steps, risk ratings and a remediation plan. Vulnerabilities in vendor products go through coordinated disclosure on terms set in the statement of work.
- 02
DOJ Data Security Program data-flow mapping
U.S. organizations whose transactions with countries of concern or covered persons may involve bulk genomic data (more than 100 U.S. persons)
We trace where genomic data is generated, stored, processed and sent, including sequencing vendors, cloud regions, contractors and data-sharing agreements, and flag flows your counsel should review under 28 CFR Part 202. This is technical mapping, not legal advice: we do not decide whether a transaction is prohibited or restricted, and we work alongside your counsel.
- 03
Research partnerships
Instrument vendors, open-source maintainers, academic groups, data holders
Joint security research on instruments, lab software and workflow engines, with coordinated disclosure and co-authored publication where both sides agree.
Research
GENOMIX: a technique matrix for genomic infrastructure.
GENOMIX catalogs how genomic infrastructure can be attacked, in the tactic, technique and sub-technique structure security teams already use with MITRE ATT&CK. Where a public advisory or incident exists, it is attached as a procedure example.
Engagement findings are classified with GENOMIX technique IDs. Client-identifying data never leaves the engagement; any cross-lab comparison will use aggregate statistics, published only with written permission.
Statusv1.0 release candidate. Most techniques are not yet linked to an observed public event. A public machine-readable release is in preparation.
- Tactics
- 10
- Techniques
- 58
- Sub-techniques
- 143
How we work
Rules we hold ourselves to.
- Coordinated disclosure
- Vulnerabilities in a vendor or open-source product found during an engagement go to the vendor PSIRT or the maintainers, and to CISA where medical devices are involved. Timing is agreed with the client in the statement of work before testing starts. Publication waits for a fix or the disclosure deadline, typically 90 days, adjusted with the vendor and CISA.
- Client findings stay with the client
- Findings are classified with GENOMIX technique IDs. Client-specific configuration findings stay confidential, and client-identifying data is never shared, published or reused. Aggregate statistics are published only with written permission.
- Sources over assertions
- Public writing links primary sources and marks figures we could not verify.
- Digital systems, no wet lab
- Our engagements cover digital systems: we do no wet-lab work and publish nothing that helps misuse biological material.
Running sequencers, lab software or genomic pipelines?
Tell us what you operate and what concerns you. We reply to every substantive request.