Independent security research for genomic infrastructure
We test the instruments, lab software and pipelines that produce genomic data, and publish what disclosure allows.
Why genomic infrastructure.
A genomics lab is a network of computers. Sequencers are controlled by ordinary hosts, often with vendor remote-support paths. Lab software tracks samples and results. Workflow engines pull code, containers and reference data at run time. The output is data about a person, and their relatives, that cannot be reissued after it leaks.
Genome privacy has an academic literature. The systems around it have very little. Only a few independent groups publish instrument security research. NVD lists one CVE for Nextflow and none for Snakemake or Cromwell; Galaxy, a web platform, has more.
Since 2023 the record includes: CISA medical advisories for sequencers and genetic analyzers, a consumer genetics breach followed by the sale of the company’s assets, customer genetic data included, and a U.S. rule that restricts covered transactions giving countries of concern or covered persons access to bulk genomic data, with bulk starting above 100 U.S. persons. The public record is on our homepage, with sources.
What we do.
- Security assessments for sequencing labs, biobanks, clinical genomics labs and genomic data platforms.
- Data-flow mapping for the U.S. DOJ Data Security Program (28 CFR Part 202), as technical input for your counsel.
- Research partnerships with vendors, open-source maintainers and academic groups.
- GENOMIX, a technique matrix for genomic infrastructure: 58 techniques and 143 sub-techniques across 10 tactics. Currently a v1.0 release candidate; most techniques are not yet linked to an observed public event. Public machine-readable release in preparation.
What we publish, and what we don't.
We publish analysis of public advisories and incidents. We will publish GENOMIX, and our own findings once coordinated disclosure is complete. Public writing cites primary sources. Where a figure is reported but we could not verify it, we say so.
We do not publish client findings or exploit detail for unpatched systems. Our engagements cover digital systems: we do no wet-lab work and publish nothing that helps misuse biological material.
Run genomic infrastructure, or build it?
Labs, data platforms, vendors and researchers: tell us what you are working on. We reply to every substantive request.