No Wasted Years, No Wasted Cycles
Jet lag makes me more emotional. It also makes me more honest.

The takeaways
- 01Prioritize early cybersecurity integration in MedTech to prevent delays and ensure compliance, avoiding last-minute "fire drills."
- 02Implement threat modeling, SBOM gathering, and security requirement definition proactively, rather than reactively, to optimize MedTech security.
- 03Adopt an engineering discipline approach to MedTech cybersecurity, focusing on foundational elements early to achieve long-term efficiency and effectiveness.
- 04Recognize that MedTech cybersecurity failures often stem from preventable delays in implementing security measures, rather than from external attacks.
- 05Apply principles of early, disciplined effort, like in race car driving, to MedTech cybersecurity to build strong systems and avoid wasted time and resources.
This year so far: San Francisco, Austin, Dubai, London. Starting Sunday: Australia, then Singapore, then Korea.
I'm grateful. I'm also feeling the miles.
When you're running this hard, the noise drops out and you're left with one question:
What's worth it?
For me, it's Blue Goat Cyber's mission. Medical devices aren't "tech products." They're the thing someone's mom, dad, kid, or spouse is depending on to save their life or improve it.
That's the lens I try to keep when the schedule gets crazy.
The Pattern Behind The Pain
Here's the thought I keep coming back to as a founder in this space:
Most cybersecurity pain in MedTech isn't caused by attackers. It's caused by waiting.
Waiting to threat model until late.
Waiting to gather SBOM details until the deadline.
Waiting to define security requirements until architecture is already locked.
Waiting until a submission is in motion to figure out what "good" looks like.
That's how teams lose months. That's how "compliance" becomes churn. That's how you end up doing security as a fire drill instead of an engineering discipline.
The interesting part is that waiting almost never feels like a decision. It feels like prioritization. The threat model gets pushed because there is a customer demo. The SBOM gets pushed because there is a release. The security requirements get pushed because the architects need another week. Every individual deferral is reasonable. The compounded cost of all of them is the project that ships six months late and rewrites half its documentation in the final quarter.
No wasted years. No wasted cycles. Build it right early is not a slogan. It is the only way the math works.
The Austin Reset
Austin was a reset for me. We did a leadership offsite and I walked away proud of our team. They show up with discipline and care every day, and I don't take that for granted.
Offsites are easy to do badly. The good ones do one specific thing well; they get the people who carry the company out of the operating cadence long enough to remember why they signed up. We did not solve every problem on the agenda. We solved enough of them to walk back into the week with the right argument in our heads about which problems were actually worth solving.
Also in Austin, I took Skip Barber Racing School's Advanced Formula Car class. I'm now greenlighted to race F4, and I'm hoping to do that this year.
Same principle: you don't earn speed by panicking late. You earn it with fundamentals early.
The drivers who are fastest on race day are the ones who put in the unglamorous reps; the threshold braking, the weight transfer, the looking-three-corners-ahead drill; long before there was a trophy on the line. The teams that ship cleanest are doing the same thing with threat models and SBOMs while the rest of the field is still arguing about the deadline.
The Music And The Mile Marker
And because I'm a heavy metal fan, life handed me a couple moments that felt unreal.
I ran into Rob Halford at LHR. He was on my flight and we ended up chatting quite a bit. This year I've got tickets to Wacken. Lifelong goal. I'll see him there. 🤘
And Metallica is playing at the Sphere in Vegas, where I got married to Melissa. That one hits different.
Iron Maiden's "Wasted Years" has been on repeat for me lately. Not as regret. As a reminder.
The song is the older musician telling the younger one not to spend the present mourning the past or worshipping the future. That hits harder at 50 than it did at 20. The years are not wasted because they were imperfect. They are wasted when you spend them somewhere your attention is not.
No wasted years. No wasted cycles. Build it right early.
Up the irons.
“No wasted years. No wasted cycles. Build it right early.”
Keep reading
-
Total Product Lifecycle: The Framing That Fixes Most Submissions
The lifecycle frame is the antidote to waiting; security as engineering, not as a fire drill.
Read essay → -
Threat Modeling Is the Work. Everything Else Is the Receipt.
The most expensive thing to do late. Worth doing early for exactly the reasons in this post.
Read essay → -
Speed Is Easy. Control Is Hard.
The same fundamentals-early principle from the track side of my year.
Read essay → -
Intentional Reflection: A Practice for Leaders Who Want to Grow
The deliberate, structured practice underneath every honest course correction in these essays.
Read essay →