Inside MedTech Innovation

When Oleg Yusim joined Baxter in 2016 as one of the first dedicated medical device security architects, the industry was just beginning to understand that shared PINs like "4444" across entire product fleets weren't acceptable security. Ten years later, as Chief Product Security Officer at Illumina, he's mastered something far more difficult than technical security: translating cybersecurity risks into language that CEOs, CFOs, and boards actually understand and act on.

In this conversation with Shannon Lantzy, Oleg breaks down why medical device cybersecurity fundamentally differs from enterprise IT (hint: confidentiality takes a backseat to integrity and availability when lives are at stake), how to use data-driven benchmarks to show executives where they stand against competitors, and why the question isn't "can we afford this security investment" but rather "does this help us survive and do good in the world, or does it push us toward failure?" He also shares pointed advice for cybersecurity startups trying to break into medtech: elegant technical solutions mean nothing if they don't solve the industry's actual pain points, and coming from a DoD environment often raises red flags because commercial companies won't accept the productivity hits that military mandates require.

Timestamps:

• [00:00:00] Introduction and Oleg's recent AI hackathon success

• [00:03:40] How coincidence and life-critical systems shaped his career path

• [00:06:25] The jump from military communications to medical devices at Baxter

• [00:09:30] What it was like being a security architect when the field barely existed

• [00:11:05] Why medical devices had rudimentary security before 2014

• [00:13:00] CIA triad differences: why confidentiality isn't king in medtech

• [00:16:00] Integrity attacks on infusion pumps and why "nobody would do that" isn't valid

• [00:18:25] Medical devices as perfect attack footholds for hospital networks

• [00:20:40] HIMSS data: 5-10% of hospital attacks start from compromised devices

• [00:22:20] Building product security teams and changing company culture

• [00:26:10] The CEO presentation: three slides with data, thirty slides in your pocket

• [00:28:15] How to quantify cybersecurity posture as percentage of requirements met

• [00:30:55] Using benchmarks: FDA guidance, customer requirements, and competitor analysis

• [00:33:20] Why better security means faster sales and integration

• [00:36:50] Headcount vs vendor costs in security budgets

• [00:40:20] Risk acceptance conversations when budgets get cut

• [00:42:20] The critical importance of data-driven decision making

• [00:44:25] Framing security investments as business survival, not just cost

• [00:47:30] Advice for cybersecurity startups targeting medtech

• [00:49:30] Why DoD-derived solutions often miss commercial pain points

• [00:52:20] Rapid fire questions

Follow Shannon and Oleg:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com/

Connect with Oleg: 

LinkedIn: https://www.linkedin.com/in/olegyusim

Website: https://www.illumina.com/

Remote surgery across continents exists today, so why isn't it widespread in the United States?

Dr. Omar Al-Kalaa spent 15 years at FDA's Office of Science, Engineering and Laboratories, where he became the bridge between telecom operators, medical device manufacturers, and regulators. His work on wireless coexistence and 5G connectivity shaped how next-generation networks intersect with medical device safety. He convened 70+ stakeholders to create the Landscape Analysis of 5G in Healthcare and developed new evaluation methods for connected medical systems.

In this conversation, Omar reveals why your continuous glucose monitor competes with Netflix for wireless spectrum, what's actually preventing telesurgery in the U.S., and how he's continuing to advance connectivity innovation through his company Inovectrum.

Timestamps:

• [00:00:30] Introduction to Dr. Omar Al-Kalaa

• [00:02:50] Remote surgery: Science fiction or reality?

• [00:08:10] The Lindbergh Operation: First transatlantic telesurgery

• [00:15:25] How Omar convened the 5G healthcare working group

• [00:16:15] FDA's Office of Science, Engineering and Laboratories: Future-proofing the agency

• [00:22:30] Building the Medical Device Innovation Consortium working group

• [00:26:10] The Landscape Analysis of 5G in Healthcare

• [00:34:30] Wireless coexistence: Why your glucose monitor competes with Netflix

• [00:42:55] Omar's journey from PhD to FDA to entrepreneurship

• [00:45:30] Launching ECTRA and the future of connectivity innovation

• [00:49:35] Rapid-fire questions

Follow Shannon and Omar:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com/

Connect with Omar: 

LinkedIn: https://www.linkedin.com/in/omar-al-kalaa/

Website: https://www.linkedin.com/company/inovectrum/

What does it take to transform cybersecurity from reactive patch management to proactive secure design? Adam Shostack, the world's leading expert on threat modeling, takes us inside Microsoft during its pivotal security transformation in the early 2000s and reveals how those lessons shaped FDA's approach to medical device cybersecurity today.

From the auto-run vulnerability that infected millions of computers monthly to creating the STRIDE methodology now used worldwide, Adam shares the origin stories behind fundamental cybersecurity practices. He explains how threat modeling evolved from expert-driven whiteboard sessions to systematic, scalable processes that any engineering team can implement.

Shannon and Adam explore the critical difference between risk management and threat modeling in design, why "pouring concrete and then wondering about properties" fails in cybersecurity, and how FDA's pre-market guidance ensures patient safety while fostering innovation. They dive deep into the four key questions every threat modeler must answer and why starting threat modeling with a simple napkin sketch can prevent costly architectural changes later.

Key Topics:

• Microsoft's trustworthy computing transformation and lessons learned

• The invention and evolution of STRIDE methodology for systematic threat analysis

• How FDA adopted threat modeling for medical device cybersecurity regulation

• The fundamental difference between threat modeling and risk management

• Why current approaches to software understanding and composition analysis fall short

• Practical advice for scaling threat modeling across organizations

• The future of threat modeling with AI assistance

Timestamps:

[00:00] Microsoft's security crisis and transformation

[07:03] The auto-run story and data-driven decision making

[14:10] Birth of scalable threat modeling and STRIDE methodology

[23:43] FDA's systematic approach to adopting threat modeling

[32:41] Engineering fundamentals vs. risk management in cybersecurity

[42:49] The software understanding problem and why it's so hard

[55:20] Innovation vs. regulation balance in different industries

[57:21] Rapid fire: Current projects, heroes, and startup advice

[1:02:05] Scaling threat modeling and AI integration

Connect with Shannon:

LinkedIn: https://www.linkedin.com/in/shannonlantzy/ Website: https://www.shannonlantzy.com/

Connect with Adam:

Website: shostack.org

Books: "Threat Modeling: Designing for Security" and "Threats: What Every Engineer Should Learn from Star Wars"

What if the LED lights and screens we rely on daily are causing neurological injuries we can't see? Dr. Jennifer Hackett, a molecular biologist who discovered her own sensitivity to LED flicker in 2018, takes us deep into the science and silence surrounding this invisible health threat. From her research background at Johns Hopkins and Harvard to becoming a patient advocate, Jenny shares how she used scientific methodology to investigate her own injury and what she discovered could change how we think about modern lighting. Shannon and Jenny explore the difference between visible and invisible flicker, why current safety standards may be inadequate, and what this means for public health as LED adoption accelerates worldwide.

Timestamps: 

[00:00] Personal injury from LED workplace lighting

[05:20] Jenny's scientific background and career transition

[14:45] The moment of LED injury recognition

[28:30] Testing the flicker hypothesis with scientific rigor

[42:15] Professional flicker measurement and data collection

[54:10] Current lighting industry standards and their limitations

[1:03:30] Population-level health correlations and research gaps

[1:21:00] Support resources and next steps for research

[1:34:00] Accessing medical care and basic needs with LED sensitivity

Connect with Shannon:

LinkedIn: https://www.linkedin.com/in/shannonlantzy/

Website: https://www.shannonlantzy.com/

Connect with Jenny: 

LinkedIn: https://www.linkedin.com/in/jennifer-hackett-molbio/

Website: flickersense.org & ledstrain.org

When Lane Desborough's 10-year-old son was diagnosed with type 1 diabetes in 2010, this chemical engineer did what came naturally: he applied industrial-scale automation principles to save his child's life. What followed sparked a movement that continues reshaping medical device innovation today. Lane's journey from creating Nightscout (one of GitHub's most-forked repositories) to founding the revolutionary "We Are Not Waiting" movement reveals how patient-driven innovation can outpace traditional development. Now, with support from the Helmsley Charitable Trust, Lane is building the Automated Insulin Delivery Interoperability Framework (AIDIF), an FAA-level simulator designed to accelerate innovation and expand access to life-saving diabetes technology for millions who can't "crawl through broken glass" to build their own solutions.

Timestamps: 

[00:00] Opening: Personal hero who sparked a movement 

[04:25] Why Lane entered medical technology 

[08:20] Cross-disciplinary innovation and "exclusionary language" 

[10:25] The "We Are Not Waiting" origin story 

[14:00] The burden of being your child's pancreas 

[21:40] From remote monitoring to open source revolution 

[24:35] Scaling beyond the most engaged 10,000 users 

[32:25] The Automated Insulin Delivery Interoperability Framework 

[38:45] Why clinical trials aren't enough: recruitment bias 

[41:20] Building FAA-level simulation for medical devices 

[46:15] Medical Device Development Tools and regulatory innovation 

[49:00] Heroes, help needed, and ecosystem engineering

Follow Shannon and Lane:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com

Connect with Lane: 

LinkedIn: https://www.linkedin.com/in/lanedesborough/

Website: http://www.nudgebg.com/

Obesity is one of the most complex and misunderstood chronic conditions in the world, affecting more than 60% of adults globally and 75% in the U.S. Yet, despite its prevalence, care systems continue to underdeliver, relying on one-size-fits-all advice, outdated stigma, and underutilized data.

In this episode of Inside MedTech Innovation, Elina Onitskansky, founder and CEO of Ilant Health, joins Shannon Lantzy to challenge the status quo. Ilant’s model integrates behavioral science, AI, human coaching, and comprehensive care pathways, from bariatric surgery to anti-obesity medications, to deliver truly personalized obesity care at scale.

Elina shares:

• Why obesity care has been treated differently from other chronic conditions and how stigma, bias, and lack of physician training keep it that way

• How evidence-based personalization can replace decades of fad diets and miracle cures

• Why “pizza night” matters: the importance of designing care that fits real lives

• The role of employers, health plans, and policy in making equitable obesity treatment available to all

Timestamps:

00:00 – Should we treat all patients with obesity the same?

01:00 – Shannon’s personal connection to the topic

02:46 – How Ilant Health blends AI, behavioral science, and human coaching

04:36 – Why personalization matters in obesity treatment

06:00 – The impact of stigma and bias in clinical care

07:22 – Elina’s personal and professional journey into obesity care

10:42 – From fad diets to evidence-based solutions

13:50 – Designing treatment that fits patients’ real lives

17:00 – Rethinking how medications are labeled and prescribed

20:18 – The role of patient preferences in regulatory decisions

22:25 – Why obesity should be coded with greater granularity

24:50 – Why Ilant partners only with employers and health plans

27:00 – What a patient’s journey with Ilant looks like

31:00 – Building trust through peer navigators and empathy

33:00 – The power of longitudinal care and evolving goals

Follow Shannon and Elina:

Shannon Lantzy

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com

Elina Onitskansky

LinkedIn: https://www.linkedin.com/in/elinaonitskansky

Website: https://www.ilanthealth.com

Shannon Lantzy sits down with Dr. Richard O'Neill, a regulatory innovator who spent 40 years working in energy markets at FERC and ARPA-E. Dr. O'Neill shares the development and implementation of market optimization software that now generates billions in annual cost savings for American consumers through more efficient electricity markets. The conversation covers the 18-year timeline from algorithm development to full adoption across Independent System Operators, the institutional challenges of innovation in critical infrastructure, and Dr. O'Neill's current work on next-generation market algorithms as AI drives increased energy demand. This discussion provides insights into how regulatory innovation happens, why proven technologies face adoption barriers, and the intersection of academic research with real-world policy implementation.

Key Timestamps:

• [00:01:00] Dr. O'Neill's background at FERC and ARPA-E

• [00:03:00] Development of market optimization algorithms

• [00:05:00] PJM's beta test results and cost savings

• [00:07:00] Market efficiency and participant benefits

• [00:11:00] 18-year adoption timeline across ISOs

• [00:15:00] AI energy demand and infrastructure challenges

• [00:16:00] Current work on algorithm improvements

• [00:18:00] Expected impact on power generation markets

• [00:21:00] Risk management in critical infrastructure

• [00:23:00] Resource allocation and implementation barriers

• [00:27:00] Case study of completed but unadopted beta test

• [00:29:00] Federal and state regulatory jurisdiction

  
  

Richard O’Neill: LinkedIn | Website

Shannon Lantzy: LinkedIn | Website

In this episode of Inside MedTech Innovation, Ed Gaudet, CEO and founder of Censinet, joins host Shannon Lantzy to examine how cybersecurity risk is becoming a direct factor in patient care.

Ed shares what he learned selling into hospitals where every deal required a different security assessment, and how those fragmented processes prompted him to build Censinet. The conversation explores why healthcare environments are particularly complex, how ransomware is affecting hospital operations, and what leaders can do to make better decisions across the vendor lifecycle.

For innovators, policymakers, and clinicians, this discussion offers a practical look at how health systems are starting to treat cybersecurity not just as an IT concern, but as part of their core clinical and operational strategy.Timestamps:

00:00 – What’s at stake in cybersecurity risk

03:00 – Ed’s background and founding Censinet

05:45 – Why risk assessments in healthcare are so fragmented

08:00 – What hospitals evaluate in third-party vendors

12:00 – When clinical urgency overrides risk protocols

14:00 – Ransomware’s impact on care delivery

16:45 – Managing risk across the vendor lifecycle

18:00 – Shifting from IT risk to business risk

20:00 – Change Healthcare as a case study

21:30 – How Ed built credibility with hospital partners

24:00 – Research linking ransomware to patient outcomes

28:00 – Creating a managed service to test Censinet internally

31:00 – Real-world results: 5X output, fewer staff

34:00 – Transparency as a business practice

37:00 – Overcoming resistance to better risk management

39:00 – What AI is (and isn’t) doing in risk ops today

41:00 – Peer benchmarking and open access to data

44:00 – Three changes Ed would make in markets and policy

47:00 – Leading a mission-driven business

53:00 – Final thoughts and personal drivers

Connect with Shannon:LinkedIn – Shannon LantzyWebsite

Connect with Ed:LinkedIn – Ed Gaudet Website – Censinet

FOLLOW SHANNON & ED:

What happens when a firmware bug brings a ventilator offline during a pandemic? For Ryan Torvik, it raised a question: Why are embedded medical systems still so fragile, and so hard to test?

In this episode of Inside MedTech Innovation, host Shannon Lantzy talks with Ryan Torvik, founder of Tulip Tree Tech and a former offensive cybersecurity engineer, about how decades-old assumptions about embedded software are colliding with modern needs for safety, speed, and resilience. With funding from ARPA-H, Ryan is now building Barnhill, an emulation framework that lets manufacturers test firmware in a virtual environment before it ever hits the device.

Together, they explore how digital twins, DevSecOps, and real-time behavioral testing can radically improve embedded medical systems, without breaking them in the process. Plus: what MedTech needs to learn from the automotive and defense industries, and why debugging a glucose monitor might have more in common with securing a microwave than you think.

00:00 – The Stakes: Firmware bugs during COVID and what they revealed

02:00 – Meet Ryan Torvik: From cybersecurity offense to medical emulation

05:00 – What “embedded” really means—and why these devices remain vulnerable

10:00 – Why firmware updates in MedTech aren’t like consumer tech

14:00 – Building Barnhill: A digital twin for real-time debugging

17:00 – How Barnhill differs from other emulators and digital twins

21:00 – A glucose monitor case study: translating voltage into clinical meaning

25:00 – MedTech’s friction points: regulation, reimbursement, and risk

30:00 – Why cybersecurity lessons aren’t translating to healthcare

34:00 – DevSecOps and SPDF: A new framework for firmware confidence

40:00 – The real barrier: MedTech’s “never touch it again” mindset

45:00 – Can AI help accelerate testing without adding new risks?

49:00 – How Barnhill aims to reduce false confidence and unknown vulnerabilities

52:00 – Ryan’s journey: from hacker to healthtech founder

55:00 – What he learned building large-scale emulation in defense

58:00 – Final thoughts: why trust, transparency, and humility matter most

Follow Shannon and Ryan:

Ryan Torvik

LinkedIn | Ryan Torvik

Company | Tulip Tree Technology

Shannon Lantzy

LinkedIn | Shannon Lantzy

Website | shannonlantzy.com

Health tech legend Matthew Holt joins host Shannon Lantzy to unpack the tangled evolution of healthcare technology, from paper records to AI, patient activism to regulatory standoffs.

Known for launching The Health Care Blog and co-founding the Health 2.0 conference, Matthew has spent over two decades critiquing, convening, and catalyzing the digital health ecosystem. He’s not here to sugarcoat progress, or the lack of it.

From the early days of medical computing to today’s explosive debate over data access and AI regulation, Matthew offers rare behind-the-scenes stories and no-BS takes on where we’ve been, and where we’re headed.

00:00 – Introduction to Matthew Holt

04:30 – British boarding schools, Marxism, and clueless career starts

11:45 – From London to Stanford: a detour that changed everything

17:30 – Discovering health tech through Japanese health systems

24:00 – From EMRs to Health 2.0: how a contrarian became a convenor

30:50 – SMACK vs. digital health: what the terminology misses

35:20 – The rise (and crash) of EHR adoption in the U.S.

42:00 – Patient portals, “MyChart,” and why consumer tech still lags

49:40 – Epic vs. Particle: a legal battle over who owns health data

56:00 – Should AI tools access all patient data—or be limited by design?

01:04:00 – Remote monitoring, real-world evidence, and research at scale

01:13:20 – Advice for founders: simplify, specify, and clarify

01:21:15 – Future gazing: what MedTech should fix next

Matthew Holt: LinkedIn | The Health Care Blog

Shannon Lantzy: LinkedIn | Website