With Moderna, Pfizer, and more recently Johnson & Johnson vaccines receiving emergency use authorization from the U.S. Food and Drug Administration (FDA), AstraZeneca also plans to submit its vaccine for review to the agency soon. This means multiple vaccines will advance in parallel, each with its own supply chain and global distribution network, ultimately reaching diverse vaccination sites.

Simon Geale, Senior Vice President of Client Solutions at procurement specialist Proxima, noted: "In isolation, we are not dealing with extremely complex problems. But when you layer all the elements together, it forms an unprecedented complex operational system, and each country's situation is different." This complexity has forced the pharmaceutical industry to adopt a "whack-a-mole" strategy to deal with hacker attacks and counterfeiting risks. Last summer, the U.S. Department of Justice accused Chinese and Russian hackers of attempting to steal COVID-19 vaccine research data.

Geale added: "We are laying the tracks in front of the train." Because the supply chain is being built so quickly, the industry currently focuses on monitoring rather than prevention. "We are in uncharted territory, and vulnerabilities are everywhere." The U.S. has a mature vaccine supply chain, but the COVID-19 vaccine supply chain is different; its participants—including vaccine manufacturers, distributors, federal, state, and county governments, and vaccination sites—may not have worked together before.

Technologies such as artificial intelligence, automation, collaboration tools, and blockchain can address these challenges by building trust, providing a single source of truth, enhancing security, and reducing the possibility of fraud.

Four tools for cybersecurity and anti-counterfeiting

Geale said the COVID-19 vaccine has become the world's most valuable commodity. Duncan Greatwood, CEO of IoT security company Xage Security, said that so far, vaccine research and early production stages have been the primary targets for intellectual property theft by governments and independent attackers. He also worries about cybercriminals launching ransomware attacks or sabotaging vaccines by altering storage temperatures. Geale believes that vaccine security protection is not fundamentally different from other industries: "At the highest level, the basic principles are the same." This means building secure-by-design systems, adopting cloud strategies, protecting system management tools, and strengthening identity and access management.

1. Zero Trust Strategy

Xage employs a zero-trust approach, which means not trusting any entity or individual by default unless they have appropriate permissions and pass authentication. Greatwood said that pharmaceutical company employees or laboratory personnel should not have full access to the entire system. "You must prove your identity and confirm that you belong to an authorized group." This principle also applies to distribution systems. Typically, production data is encrypted and signed at the point of production; Xage provides access control via APIs and uses them for verification and electronic signature cross-checking, such as ensuring that signatures match temperature sensor software components. A zero-trust system requires policies that define which people or machines can access specific data.

Previously, in a production environment, a machine might be allowed to communicate with any other machine; if hacked, that machine could infect other devices. With restrictive policies, unauthorized machine or personnel access attempts trigger alerts, thereby preventing the spread of attacks and helping to mitigate issues on the production floor. Transitioning from implicit trust to a zero-trust model may require multiple steps, adding software or hardware, and adjusting policies and processes. Greatwood said: "When you give everyone access to everything, you don't need policies."

2. Real-Time Visibility and Tracking

David Parker, Chief Evangelist at Cloudleaf, pointed out that data loggers are old technology; they can tell a company where a truck is, but not where the cargo is. Real-time data trackers are like giving each shipment a mobile device; the device and stakeholders share the product's location on a software platform, ensuring quality insights. Meanwhile, sensors continuously provide temperature readings, which is crucial for vaccine logistics that require specific temperatures. Some sensors can also share information on shock, vibration, and ambient light detection. If a trailer door opens at an unexpected time, sensors can share information in real time, send email or SMS alerts, and even notify law enforcement to intercept the shipment according to preset rules. Parker said that due to the COVID-19 pandemic, the adoption of advanced tracking devices that can be placed on pallets, boxes, or individual vaccine vials has been accelerated by two to three years. "Everyone was talking about digital transformation, but it was still in the ideation and discovery phase; now design and implementation have been fast-tracked."

Algorithms determine the best route based on shipment criticality and customer preferences, and the cargo is tracked from origin to destination, including routes and waypoints. If a carrier deviates from the designated route, or doors open or close at unexpected times, the system sends alerts. Cloudleaf or the customer may question the carrier about the anomaly and may suggest suspending future shipments until the situation is clarified, which helps prevent issues like theft. Visibility and alert systems can also save other costs. Parker mentioned that last year, a client with shipments valued at $8-10 million per batch used to send an empty trailer following the main truck to guard against breakdowns. "Given the technology we deployed for them, they no longer need the second trailer because they have full visibility." Tracking data is not 100% available; if wireless communication or cloud uploads are interrupted, sensors can store information and transmit it later, but they may face challenges in low-connectivity areas.

3. No Single Point of Access

Xage recommends a distributed ledger approach to collect and store information, including passwords. If someone or software attempts to use false data, thousands of other nodes will reject it. Greatwood said: "Distributed ledgers are a powerful data structure for handling multi-party interactions." IBM has launched two blockchain-based products: the Vaccine Accountability Network and the Digital Health Pass. The former is a supply chain platform connecting manufacturers to vaccination sites. Vaccinators can scan a vial to see the production date, supply chain temperature, and verify storage temperature at the vaccination site. If the vaccine is fine, a green checkmark appears. This information can be transmitted to a health pass app on a smartphone, providing proof of vaccination to the recipient. Jonathan Wright, Global Leader for Supply Chain at IBM Business Transformation Services, said that blockchain technology aids recalls by identifying where affected vaccine batches went. "This underlying technology manages risk, ensures no counterfeits, builds trust, and creates a platform where all parties use data simultaneously." The data already exists; the platform provides a single version of the truth. The Vaccine Accountability Network was tested on other pharmaceuticals in a collaboration involving IBM, KPMG, Walmart, and Merck, and IBM is ready to pilot it for COVID-19 vaccines. Wright said that in the first round of vaccine distribution, there was no time to deploy such solutions; the goal was to vaccinate as quickly as possible. The next phase will focus more on the recipient experience, ensuring the process is more comfortable, and then efforts will be made to add value.

4. Digital Authentication and Serialization

Greatwood said that falsified data is a common component of cyberattacks and counterfeiting. "Attackers want victims to believe everything is normal," for example, providing false temperatures or replacing vaccine information. "Data integrity is critical at every stage of the vaccine system." When implementing security and execution systems, Xage inserts software code at production points, such as temperature sensors, so that data can be signed with digital certificates and mapped to fixed values. Pharmaceutical companies include batch and lot number identifiers when serializing products, and this information is encoded on smart labels or sensors. If someone tampers with a vial or serialization information, it indicates the product may be counterfeit. Parker noted that serialization alone is not a complete solution because genuine serial numbers can be used on counterfeit products; digital authentication and chain-of-custody viewing help address this issue.

Greatwood said that most pharmaceutical companies already have some security measures in place; "few are taking chances," but most still have implicit trust issues, where people are granted more access than necessary. New security measures are typically rolled out in phases across the supply chain, for example, first on the production floor, then in laboratories, and then in the distribution chain, depending on company priorities and existing security investments, involving the formulation or understanding of current security policies.