Cyberbiosecurity Implementation in Laboratory Settings: A Scoping Review

Introduction

In the last decade, cyberbiosecurity has emerged as an interdisciplinary field addressing unique vulnerabilities at the intersection of biological and cyber systems. An early definition of cyberbiosecurity, from 2018, characterized the field as the identification and assessment of risks within or at the interface of cybersecurity, cyberphysical security, biosecurity, and biosafety. ¹ A 2024 definition describes the field more succinctly as the discipline dedicated to the study of biological risks in combination with cybersecurity risks, ² while another definition frames it as a discipline that safeguards biological material, tools, and systems integrated in the cyber domain. ³ In laboratory contexts, cyberbiosecurity encompasses risks associated with using both digital and engineered biological systems, creating cyber-biological interfaces where digital information controls or monitors biological processes. ⁴ Modern laboratories increasingly resemble smart labs with networked building automation systems (BAS), Internet of Things (IoT) devices, and cyber-connected laboratory equipment, making traditional biosecurity measures insufficient for addressing these convergent risks. ⁵ Low-resource laboratory settings are increasingly a concern, as they transition to more complex electronic laboratory information management systems (LIMS) while often lacking the infrastructure and expertise to implement robust cybersecurity measures during this digital transformation.

The cyberbiosecurity threat landscape encompasses multiple attack vectors that exploit the digitization of biological research. First, the increase in digitally linked technologies in infectious disease and diagnostic laboratories has outpaced cyberbiosecurity frameworks for data security. Key vulnerabilities include artificial intelligence misuse in handling sensitive data and the inclusion of unencrypted confidential data within large-language model weightings and datasets. ⁶ The value of genomic data itself—to which international agreements like the Nagoya Protocol have attempted to safely share and protect—has the potential to be misused, particularly if annotated with information about pathogenicity, virulence, and other data characteristics. High-containment laboratories face particular risks of device vulnerabilities, including BAS that control containment functions, ventilation, and pressurization parameters. ² Without proper network and systems administration, there are also increasing vulnerabilities within cyber cloud laboratories and LIMS, where unmonitored remote access can grant unauthorized access to sensitive data. ⁷ Biomanufacturing laboratories, specialized facilities that use biological systems, such as microorganisms, animal cells, or plant cells, to produce high-value commercial products (e.g., pharmaceuticals, vaccines, biofuels, etc.) also risk potential breaches of manufacturing data. ⁸

Due to the increased prominence of dual-use research of concern (DURC) across the world, the risk of lab security breaches—intentional or unintentional—is an immediate concern for policymakers. Emerging threats include cyber-bio crime, bioterrorism, and bio-malware—where computer malware is inserted into physical genetic material that compromises sequencing computers. ⁹ The increasing use of DNA sequencing and synthetic biology for gain-of-function research provides more attack surfaces for information security breaches, with a consequent risk of the proliferation of modified agents outside of the secure environment. If laboratory safety and security are compromised, there is an increased risk of accidental or deliberate release. Within biopharmaceutical and synthetic biology laboratories, there also exists the potential of genetic manipulation of information during cell line development and vulnerabilities in analytical technologies used for real-time drug testing. ⁸

A semiadjacent threat area exists around cybersecurity device vulnerabilities in biological settings, particularly with the integration of IoT medical technologies into clinical spaces. Medtech laboratories include any specialized facility equipped with technology and advanced instruments that analyze clinical and biological specimens, such as blood, tissues, and fluids, to assist physicians in diagnosing, treating, and preventing diseases. Critical to the medtech sector are medical technologies and devices used for surgical, implant, and suture treatment. A broad spectrum of IoT health devices—including medical imaging systems, wearable biometric sensors, implantable devices, and virtual home assistants—has been shown to harbor exploitable vulnerabilities. ¹⁰ These weaknesses expose patient data to threats, such as data tampering and ransomware of medical images or sensor outputs—all of which carry direct implications for clinical safety and patient trust. Mobile devices themselves are also at the center of the cyberbiosecurity debate, where aging devices both in clinical and laboratory settings run the risk of being unable to upgrade to new security software, allowing for insecure access and unencrypted data transfer. ¹¹

Above all, it is evident that cyberbiosecurity poses growing risks and implications for national security. The reliance of the biomedical research sector on interconnected digital systems means that cyberattacks could interfere with public disease surveillance platforms, disable emergency medical response networks, or compromise vaccine production and distribution.^4,12 Aside from the potential for public health emergencies, cyberbiosecurity vulnerabilities could lead to intellectual property theft, with examples like 2017’s NotPetya attack costing Merck nearly $1 billion and 2021’s Tardigrade advanced persistent threat in U.S. biomanufacturing facilities.^3,13 Most importantly, advances in biotechnology have lowered barriers to bioterrorism, with concerns ranging from illicit acquisition of biological materials on darknet markets to the use of malware for misinformation. ¹⁴

Although a relatively new field, the cyberbiosecurity literature has grown substantially since 2017, with a 2024 systematic review identifying 52 relevant studies and highlighting a year-over-year increase in publications up to 2017. However, the evidence base for policy implementation remains limited. ³ Crawford et al. note that while widely used biorisk management frameworks exist—such as the CDC’s Biosafety in Microbiological and Biomedical Laboratories, Africa CDC’s Regulatory and Certification Framework for Institutions Handling High Risk Pathogens, and WHO’s Laboratory Biosafety Manual, cyber vulnerabilities are not covered in these national, regional, and international frameworks. ² Like the others, Africa’s CDC framework discusses risk assessments and implementing biorisk management programs in place, but lacks mention of information security at all—let alone cyberbiosecurity. ¹⁵

This scoping review examines cyberbiosecurity implementation in laboratories—a priority due to increased risks stemming from the ease of access to sensitive genetic and diagnostic data in laboratories handling high-consequence pathogens. This review aims to identify laboratory-specific cyber risk mitigation and prevention strategies. Our research questions were: 1.

How is cyberbiosecurity defined in the context of biological and biomedical laboratories?

The motives for this scoping review were so that the Georgetown Center for Global Health Science and Security (CGHSS) team could inform the development of a laboratory-specific cyberbiosecurity mitigation component to the Laboratory Self-Assessment Tool (S-LAT). ¹⁶

Methods

A systematic search was conducted across five academic and gray literature databases: PubMed, Web of Science, EBSCO, Google Scholar, and ArXiv. We chose to include preprints (mostly from ArXiv), as cyberbiosecurity is a relatively novel field, and thus, we wanted to capture the most recent literature in the process of being peer-reviewed. We used a standardized set of search terms to capture the breadth of the topic, including cyberbiosecurity, biocybersecurity, cyberbiosafety, digital biosecurity, information biosecurity, risk, implementation, and/or policy (see Supplemental Data “Search Strategies”). The search focused on identifying literature relevant to the implementation of cyberbiosecurity policies in laboratory contexts.

All retrieved records were imported into the reference manager Zotero for deduplication, which removed 49 duplicate entries. On Rayyan software, a total of 47 unique records were screened in two stages by two blinded reviewers: (1) title and abstract screening and (2) full-text review for those deemed potentially relevant. Reviewers discussed any discrepancies in their screening before proceeding to the next screening stage. Articles were screened using predetermined inclusion and exclusion criteria (Table 1) and screening followed the PRISMA 2020 guidelines (Figure 1).

OPEN IN VIEWER

Figure 1.

PRISMA article screening flowchart. Of the 47 records screened, seven were excluded at the title and abstract stage. Forty records were assessed for eligibility via full-text review, with 10 excluded for the following reasons: 3 excluded due to their sole focus on national security issues as opposed to cyberbiosecurity-specific implementation; another 5 excluded for their article type as nonempirical perspectives (wrong study design and publication type); and lastly, 2 excluded for being outside our time range of interest (before 2010). Ultimately, 30 articles were included in the final analysis.

OPEN IN VIEWER

Table 1.

Inclusion and exclusion criteria

Inclusion	Exclusion
2010 to present Peer-reviewed, preprint, conference papers English, French, Portuguese, Spanish publications Articles relevant to cyberbiosecurity and implementation of laboratory cyberbiosecurity policies	Before 2010 Commentaries, perspectives, editorials, and other nonempirical article types

Of the 47 records screened, seven were excluded at the title and abstract stage. Forty records were assessed for eligibility via full-text review, with 10 excluded for the following reasons: 3 excluded due to their sole focus on national security issues as opposed to cyberbiosecurity-specific implementation; another 5 excluded for their article type as nonempirical perspectives; and lastly, 2 excluded for being outside our time range of interest (before 2010). Ultimately, 30 articles were included in the final analysis.

For each included article, we extracted the following information in Table 2. This structured data extraction allowed for the synthesis of trends in the literature and identification of major gaps, particularly regarding the lack of detailed implementation guidance for low-resource laboratory settings in LMICs.

OPEN IN VIEWER

Table 2.

Data extraction criteria

Section	Subsection
Publication and article type	Literature/systematic/scoping review Conference/policy paper Preprint Book chapter Thesis Primary study Other
Funding source	Internal External Not mentioned No funding
Country focus	Case specific
Geographic focus	MENA South America North America Europe Africa Asia No specific focus
Private or public sector laboratory	Private Public Both Not mentioned/not focused on one specifically
Mention of high-containment laboratory (BSL-3 or BSL-4)	Yes No
Laboratory sector focus	Infectious disease Medtech/biomanufacturing Diagnostic/public health Research/academic
Topic covered (focus of article)	DNA synthetic biology Next-generation sequencing Zoonosis Policy Implementation Risk mitigation solutions/assessment National security
Type of cyberware attack	Passive protection Network and systems administration Attack vectors and phishing Ransomware/malware Data breaches and stewardship Automation Cloud laboratories AI and machine learning “Networked pathogen inventory systems” Laboratory information management systems (LIMS) Physical–digital interface Software supply chain compromises Remote access portals Mobile devices

AI, artificial intelligence; BSL, biosafety level.

Results

Out of 30 articles, 17 were literature/systematic/scoping reviews (57%) and eight were conference/policy papers (20%) (Figure 2C). Ten studies (33%) were funded by external sources, and 5 studies (17%) were funded by internal sources, with the other 14 (46%) declaring either no funding or no mention of a source. Seven articles (23%) focused on North America, and as seen in Figure 2D, just under two-thirds (63%) included risks to or in high-income countries and facilities. There was no difference between the sample articles and their focus on private or public laboratories, with 12 out of 30 articles (40%) focusing on both. Only 8 out of 30 articles (2.6%) mentioned the terms “high-containment lab” or biosafety levels (BSL-4/BSL-3). Three-quarters (77%) of articles mentioned risks stemming from dual-use research, biotechnology, bioeconomy, and biomanufacturing laboratory sectors. National security concerns were included in just under half of all articles (47%) as compared with articles that did not include national security as a primary theme of their analysis (53%, listed in Figure 2 as “Other foci”).

OPEN IN VIEWER

Figure 2.

Data extraction results. (A) The proportion of articles within the scoping review that focused their cyberbiosecurity study on either the Medtech/Biomanufacturing laboratory sector or “Other lab sector” foci, which include infectious disease, diagnostic/public health, and research/academic laboratory sectors. (B) The proportion of articles that centered their focus on either national security concerns in cyberbiosecurity or “other foci,” which included foci on DNA synthetic biology, next-generation sequencing, zoonosis, policy, implementation, and risk mitigation solutions/assessment. (C) The proportion of articles with different publication styles (“Other” included one article that was a cyberbiosecurity certification training guide). (D) shows the proportion of articles whose cyberbiosecurity focus was on a certain country.

Within these 30 articles on cyberbiosecurity implementation in high-consequence laboratory, the scoping review exemplified major gaps in the cyberbiosecurity literature. There was an absence of primary studies, with only 2 out of 30 articles (6.7%) focused on cyberbiosecurity implementation approaches for laboratories. This, combined with the lack of mention of “high-containment lab” and BSLs, demonstrated that there was no gold standard approach to assessing or implementing cyberbiosecurity capacities in laboratory facilities. Apart from lacking direct cyberbiosecurity implementation studies, the literature is also missing guidance for clinical and diagnostic laboratories (23%) and for the chain of risk in these settings. With over 77% of the articles focusing on biomanufacturing and MedTech cybersecurity risks, the review portrayed a general theme of cyberbiosecurity being reliant on broad, top-down enterprise approaches. Lastly, that 63% of articles focused on cyberbiosecurity threats in high-income countries of the Global North suggests the unequal focus of cyber laboratory threats in LMICs.

Discussion

This review demonstrated that existing cyberbiosecurity policies and frameworks are not tailored to laboratory settings and, by extension, emerging technologies. While 20% of the articles took the form of conference or policy papers (Figure 2C), accentuating the current literature landscape concerned about cyberbiosecurity, only 7% were primary studies implementing some cyberbiosecurity standard at a localized facility level (Figure 2C). With merely 2.6% of the articles mentioning the term “high-containment lab,” and 77% of articles focused on cyberbiosecurity risks in med-tech and biomanufacturing research facilities, it is clear that there are scarce direct implementation studies with guidance for clinical and diagnostic laboratories and the chain of risk in these settings. Assessment frameworks are being developed, with governments like the United States issuing a “Government Policy for Oversight of Dual Use Research of Concern (DURC) and Pathogens with Enhanced Pandemic (PEP)” in May 2024 (with updated guidance released in May 2025) and launching a project on “Cybersecurity of Genomic Data” through their National Cybersecurity Center of Excellence.^17,18 However, the enforcement of laboratories and all types of research facilities complying with these policies is overlooked. For instance, the European Union Agency for Cybersecurity has only recently identified cyberbiosecurity as an “urgent” issue that “may have implications for life itself.” ¹⁹ Several studies highlight that current laboratory equipment has not been adapted to reflect recent developments in synthetic biology and cyberwarfare, creating significant policy gaps. ²⁰ The regulatory gaps of cyber technologies are further exposed by existing international agreements, such as the Biological Weapons Convention (BWC) and the Nagoya Protocol on Access and Benefit-Sharing, which call for data security among a range of other concerns that fall under cyberbiosecurity but neglect to enforce explicit implementation or mechanisms at the national and global levels. ¹⁹ The emergence of cyberbiosecurity requires new policy approaches that address the convergence of cyber and biological domains at the laboratory-specific level and systematically monitor compliance.

Second, the review reveals that cyberbiosecurity implementation literature is rare and almost nonexistent for lower-resource countries. Figure 2D reveals the blatant unequal focus of cyberbiosecurity research in LMICs, even when several countries in the Global South contribute extensively to global health research. Qatar and South Africa, for instance, have expanded research infrastructure through initiatives such as the Qatar National Research Fund and the South African Research Chairs Initiative, reflecting commitments to building resilient research systems less dependent on Global North funding.^21,22 In addition, the Indian life sciences research industry, both private and public, has strategically invested in its bioeconomy—in other words, its revenue-generating biotechnology and healthcare research industry. ⁶ In fact, in 2021, India was the second-highest (7.7%) nation with total cyberattacks on healthcare industries, of which China, Pakistan, and North Korea share blame as cyberattackers. ⁶ That 63% of the articles in the review (Figure 2D) focused on cyberbiological risks to or in high-income countries and facilities only reinforces past literature and its concern of epistemic privilege concentrated in Global North science, where developed nations benefit from access to sophisticated laboratory facilities and funding. ¹⁹

As with all scoping reviews, a limitation of the current study was the lack of quality or bias assessment in the methodology; however, given we only identified two empirical studies, it is unlikely that bias assessment would have dramatically changed our findings. Future research could also seek to include gray literature and technical reports, outside of the academic peer-reviewed literature.

We suggest three recommendations based on this review: 1.

Norms and standards: Policymakers like government agencies have the authority to mandate cyberbiosecurity protocols as part of the criteria for laboratory certification and research or grant approval. This review encourages these entities to prioritize and spearhead the development of norms and standards for implementation efforts on cyberbiosecurity in low-resource laboratory settings. An excellent start to specific cyberbiosecurity policies is outlined by Elgabry et al. ³ Institutional review boards and institutional biosafety committees can then work to integrate these requirements into institutional approval processes.Apart from the USG DURC and PEP 2024 policy, laboratory cyberbiosecurity standards in low-resource laboratories can also pull inspiration from existing models of national cyber standards. The USG’s cyber infrastructure survey tool, developed by Department of Homeland Security (DHS) and Cybersecurity and Infrastructure Security Agency (CISA), offers individual organizations, such as research facilities, an effective assessment of their cybersecurity incident response capabilities. ²³ The NIST Cybersecurity Framework is also particularly noteworthy because it is risk-based and tiered, allowing organizations with varying resource levels to adopt proportional safeguards rather than a one-size-fits-all mandate. ¹⁸ This flexibility is a feature that could be meaningfully adapted for LMIC laboratory contexts, where resource constraints are a persistent reality. However, adaptation and diffusion of existing HIC standards for LMIC contexts will require careful deliberation and further analyses, which falls outside the scope of this paper. Australia’s 2023–2030 Cyber Security Strategy represents another national framework with potential lessons for Global South cyberbiosecurity. ²⁴ Its emphasis on voluntary-first but escalation-ready standards offers an accessible starting point for settings where mandatory enforcement may not yet be feasible. It identifies certain research and health infrastructure as critical sectors worthy of heightened protection, which offers a template for governments in the Indo-Pacific region—where the Australian Government prioritizes its international engagement—to begin designating their own priority laboratory environments. ²⁵ In addition, its “cyber health-check program” offers a free, tailored assessment of cybersecurity maturity to small and medium businesses. This model of cybersecurity self-assessments—which are consistent with the S-LAT motives of this scoping review—could serve as an accessible starting point for low-constrained laboratories in the Indo-Pacific region.

While these recommendations provide a pathway for strengthening cyberbiosecurity, several challenges remain. Establishing globally standardized norms and safeguards is difficult given the heterogeneity of regulatory environments, resource availability, and laboratory capacities across regions, though funders like the USG’s National Institutes of Health and National Security Agency could encourage compliance with standards as a condition of support. Compliance with international frameworks may also be uneven, as many guidelines remain voluntary and lack enforcement mechanisms, particularly in low- and middle-income countries. Furthermore, integrating enforceable cyberbiosecurity provisions into funding and institutional policies may face resistance due to added administrative burden, costs of implementation, and limited technical expertise. Past cybersecurity policy models from the United States, EU, and Australia have also been developed with well-resourced institutions in mind, assuming baseline levels of technical infrastructure and staffing that may not exist in Global South settings. Sustained investment in training and certification is essential, yet uptake could be constrained by financial, infrastructural, and institutional barriers. Nonetheless, these challenges also present opportunities for global collaboration, policy harmonization, and universal standards to safeguard cyberbiosecurity worldwide.

Overcoming these barriers will require capacity-building investments, regional knowledge exchange, and the codevelopment of implementation tools that reflect local realities. A strategy to seriously consider is the development of regional cyberbiosecurity norms and policies tailored to shared geographic, economic, and epidemiological contexts. The Oyuchua et al. scoping review represents a pioneering effort to research regional norms on biosecurity, concluding that biorepositories for high-consequence veterinary and one health pathogens in Southeast Asia need to be regulated. ²⁸ Countries in Southeast Asia, for instance, have also collaborated through frameworks such as the EU BIOSEC (Enhanced Biosecurity) and ASEAN Biosafety and Biosecurity Working Group to develop tripartite biosafety, biosecurity, and biorisk management policies across the region.^29,30 Through forums such as the Pacific Islands Law Officers’ Network and ASEAN Senior Officials Meeting on Transnational Crime, Australia has played a pivotal role in building regional capabilities to fight cybercrime in the Pacific and Southeast Asia. ²⁴ These regionally negotiated standards can potentially spread to adjacent countries, with locally developed solutions proving more durable and contextually appropriate than externally imposed ones.

Conclusion

At present, there is no gold standard approach to assessing or implementing cyberbiosecurity capacities in laboratory facilities around the world. The absence of detailed examinations of cyberbiosecurity risks at both the laboratory and implementation levels represents a significant gap in cyberbiosecurity preparedness across the world. While the policy landscape for cyberbiosecurity in biomedical laboratories is rapidly evolving, it remains fragmented. Besides the concentrated Global North research industry, many countries in the Global South, such as South Africa, India, and Malaysia, invest in life science research and have both public and private laboratories that handle high-consequence pathogens—a key source of potential risk. Cyberbiosecurity threats must be addressed in low-resource laboratories, and future research should investigate this gap.

Ethical Considerations

Ethical approval was not required for this scoping review.

Data Availability Statement

Relevant Supplementary Data has been made available.

Authors’ Contributions

A.C. is responsible for the data curation, investigation, methodology, and writing (original draft and editing) of this study. M.O. and C.J.S. conceptualized and designed the methodology as well as provided supervision and reviewed manuscript writing. M.O. was responsible for project administration. L.S. aided in data curation and review/editing and writing.