Defending the Basket: Why Security Is Built Into Everything We Do at Viedoc

When I played basketball, I was always the defensive player. My job was to stop the attack, get in the way, and not let anyone get to the basket. Today I do the same thing, only the opponent is anyone trying to get into Viedoc's systems and our customers' data.

At Viedoc, I have overall responsibility for information security. That covers compliance, our information security policies, cybersecurity, and physical security. Since October is Cybersecurity Awareness Month, it felt like the right time to share what that work looks like, why it matters so much in clinical research, and what I see coming next.

Why security matters so much in clinical data

Viedoc handles personal health information on behalf of our customers. Sponsors, CROs, and sites enter some of the most sensitive data there is into our platform, and they trust us to protect it.

That trust is not something we earn with a single audit or certificate. We earn it by building security in from the start. Security by design and privacy by design are part of every stage of how we work: product design, development, release and post-release. Security is not a step we add at the end. It shapes decisions from the first line of a requirement to the moment a new version reaches customers.

The work customers don't see

When security is done well, it is mostly invisible. Users log in, enter data, and run their studies. Behind that, a lot is happening:

• Infrastructure security: hardening and monitoring the environments the platform runs on
• Data protection: keeping customer data safe at rest and in transit
• Penetration testing: inviting experts to attack our systems so we find weaknesses before anyone else does
• Vulnerability monitoring and remediation: tracking new threats continuously and fixing issues quickly
• Compliance: meeting international security standards and industry baselines

Technology is only part of it. People are just as important. For Cybersecurity Awareness Month this year, we ran a live hacking session with our partner Outpost24. They walked our employees through a full attack on a web application: stealing credentials, hijacking a session, escalating privileges, manipulating data, and finally taking over the server completely.

The goal was simple. We wanted people to see why security practices matter, not just read about it on our awareness trainings. Watching an attack unfold step by step makes it very clear how one small gap can lead to something much bigger.

How customer expectations have shifted

The questions customers ask in security audits have changed a lot in a short time.

Three or four years ago, audits focused on policies, documentation, and whether we followed our processes. Those things still matter. But today the questions are squarely about cybersecurity: How do you secure your cloud environment? How do you manage software vulnerabilities? How often do you run penetration tests? And how fast do you fix what you find?

The whole industry has moved from a process and compliance view of security to a cybersecurity view. I think that is the right direction. A well-written policy does not stop an attacker. Strong, tested defenses do.

AI: the next big security challenge

AI is quickly becoming a standard tool in software development. That raises a real question for anyone who builds software: how do you know the code you ship can be trusted, if part of it was written by an AI?

The bigger concern is AI on the attacking side. AI agents have enormous potential to run sophisticated attacks at high volume. And attackers tend to adopt new technology faster than defenders, because they have no compliance requirements or governance processes slowing them down. That keeps them a step ahead, and it means defenders have to work even harder to keep up.

Playing defense, every day

Security is a team sport, and most of the game happens where no one is watching. As I like to put it: "Stopping the attack, obstructing the attack, don't letting them go to the basket. That's what I'm doing now."

Our customers trust us with their data, and protecting it is a responsibility we take on every single day, not just in October. This is the first in a series of articles on security at Viedoc. Next time, I'll look at compliance and the international regulations that shape how we protect clinical data.