The Secret to Drug Security and Why Some Risks Must Stay Classified

Millions of people unknowingly rely on hidden security measures to protect them from unseen threats. At airports, the Transportation Security Administration quietly employs classified measures like behavioral-detection protocols and risk-assessment algorithms, while travelers experience only the visible screening procedures. This deliberate opacity helps to prevent terrorists from learning how to circumvent critical safety systems. Similarly, banks secure their systems against cybercriminals without publicly revealing which defenses are most vulnerable to hacking. Water treatment plants and electrical grids undergo constant security reviews to ensure that a single point of failure cannot be exploited, yet these vulnerabilities remain confidential to prevent sabotage.

Drug shortages, particularly among generic sterile injectables, have become alarmingly frequent, delaying treatments and forcing reliance on less-effective alternatives. The use of less-familiar alternatives also increases the risk of medication errors in dosing, administration, or monitoring. Generic drug manufacturers, which compete primarily on price, are especially vulnerable to economic pressures that discourage long-term investments in supply-chain resilience. This dynamic creates a race to the bottom, where cost cutting becomes the dominant strategy, leading companies to minimize expenditures on quality control, redundant production capacity, and modernization efforts. With razor-thin profit margins, many manufacturers forgo the safeguards necessary to prevent disruptions, leaving the entire system fragile and increasingly prone to shortages.

These vulnerabilities present opportunities for strategic exploitation by adversaries, making pharmaceutical security a national imperative. Securing the U.S. pharmaceutical supply chain requires identifying weak points — without making them public — to prevent bad actors from exploiting them.

The CRV framework: A strategic approach to securing drug manufacturing

The Criticality-Reach-Vulnerability (CRV) framework, published in a Health Affairs blog by Marta Wosinska and colleagues, offers a systematic approach for prioritizing pharmaceutical products based on three key factors:

1. Criticality: How essential a drug is to patient survival and health outcomes, considering the severity of the condition it treats and the availability of effective alternatives. Special consideration is given to drugs critical for vulnerable subgroups.
2. Reach: The broader impact of a drug beyond individual patients, including population-health effects and systemwide impacts, such as preventing the spread of disease or reducing burdens on healthcare systems.
3. Vulnerability: The likelihood of supply disruptions because of concentration of a product in a single location, quality issues, reliance on offshore suppliers, and/or susceptibility to geopolitical or environmental shocks.

Extending this framework to assess manufacturing facilities would help federal policymakers identify high-risk production sites and bolster supply-chain resilience. By prioritizing the potential risk to manufacturing facilities, the federal government could strategically direct investments, ensure diversified sourcing, and take proactive steps to mitigate the risk of shortages before they arise.

Preventing the next crisis: Why CRV facility scoring is essential

Drug shortages are not just an economic inconvenience; they represent a significant national security risk. A disruption — whether due to natural disasters, economic instability, or deliberate sabotage — could cripple access to life-saving medications. Developing CRV scores for drug manufacturing facilities would allow the government to:

• Identify high-risk production sites where disruptions could lead to catastrophic shortages
• Assess the redundancy and resilience of supply chains to ensure that critical drugs are not overly reliant on a single source
• Prioritize investments in domestic manufacturing by directing subsidies, tax incentives, and regulatory support to facilities producing high-CRV drugs
• Revise national stockpiling strategies by ensuring that drugs sourced from vulnerable facilities are included in strategic reserves
• Inform emergency-response planning by understanding which facilities require rapid intervention in a crisis
• Provide technical guidance to manufacturers to help secure facilities

Protecting critical facilities is a common national security practice

The need to safeguard critical manufacturing facilities is not unique to pharmaceuticals. Across multiple industries, the federal government has recognized that revealing vulnerabilities in the production of sensitive products can pose a significant security risk. As a result, certain facilities receive heightened protection to prevent adversarial disruptions.

One example is the semiconductor industry, particularly the production of advanced artificial intelligence (AI) chips. These chips are crucial for everything from military applications to economic competitiveness, and their production is highly concentrated in a few fabrication plants (also known as “fabs”), mainly in Taiwan, South Korea, and the United States. Recognizing the strategic importance of semiconductor supply chains, the federal government has pushed to onshore production, strengthen export controls, and provide subsidies to secure domestic manufacturing. Disclosing weak points in these facilities could expose them to cyberattacks or physical threats from geopolitical adversaries.

Defense and aerospace manufacturing presents another case where facility protection is paramount. The production of fighter jets, missile systems, and classified military technology occurs in highly secure environments, with strict controls to prevent espionage, sabotage, or supply chain infiltration. The federal government often designates these manufacturers as part of its critical infrastructure, ensuring that their operations remain protected from foreign interference.

Similarly, the extraction and processing of rare earth materials — essential for military technology, renewable energy, and consumer electronics — has become a national security priority. China dominates the global supply of rare earth elements, raising concerns about supply-chain vulnerabilities. To mitigate these risks, the United States has invested in securing domestic rare earth mining and refining capabilities. Publicly identifying the weakest links in these supply chains could invite targeted disruptions that would compromise national security.

The cost of transparency: When information becomes a threat

While the logic behind CRV scoring is clear, public disclosure of facility-specific vulnerabilities would create a roadmap for adversaries.

1. Enabling targeted attacks: High-CRV production sites — particularly those producing chemotherapy agents, crash-cart drugs, and essential antibiotics — could become targets for cyberattacks, contamination, sabotage, or even physical destruction. When manufacturing is concentrated in a limited number of facilities, an attack on a single site could trigger widespread shortages with devastating consequences.
2. Exploiting supply-chain weaknesses: Many drugs depend on active pharmaceutical ingredients (APIs) or precursor chemicals sourced from a handful of international suppliers. Adversaries that know which facilities are most vulnerable due to reliance on specific suppliers could disrupt upstream supply chains through cyberattacks on API producers, logistical interference at key shipping ports, or trade restrictions — crippling drug production long before shortages became visible.
3. Undermining public confidence: If healthcare providers and informed consumers became aware that certain drugs were produced in highly vulnerable facilities, it could erode public trust in the pharmaceutical supply chain. Hospitals might hoard medications, insurance companies could adjust coverage based on perceived supply risks, and panic buying could accelerate shortages. Managing the flow of critical information is critical to preventing unnecessary market disruptions and ensuring the orderly distribution of pharmaceuticals.

Balancing transparency and security in drug manufacturing

Policymakers face the challenge of striking the right balance between ensuring supply chain resilience and safeguarding national security. While some level of transparency — such as sharing general best practices and risk-mitigation strategies — can help to strengthen supply chains, disclosing detailed CRV assessments would expose critical infrastructure vulnerabilities.

A tiered approach to CRV assessment access could help mitigate risks:

• Public reporting: Sharing high-level information on CRV methodologies and general best practices without revealing specific facility vulnerabilities.
• Restricted industry access: Providing manufacturers with facility-specific risk assessments relevant to their operations while limiting exposure of broader security vulnerabilities.
• Classified assessments: Retaining the most sensitive CRV data within the Department of Health and Human Services, the Food and Drug Administration, and national security agencies to enable proactive intervention without exposing critical infrastructure to threats.

A strategic imperative

The development of CRV scores for drug manufacturing facilities is a crucial next step in securing the U.S. pharmaceutical supply chain. By assessing criticality, reach, and vulnerability at the facility level, policymakers can make data-driven recommendations to prevent and mitigate drug shortages. However, secrecy remains essential — overdisclosure would hand adversaries an attack plan for disruption. A carefully balanced approach that integrates strategic classification with informed decision making will help ensure the resilience of the nation’s drug supply without compromising security.