--- title: "No Wasted Years, No Wasted Cycles" description: "Optimize MedTech cybersecurity by implementing proactive strategies, integrating security early, and adopting an engineering discipline to avoid costly…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "No Wasted Years, No Wasted Cycles | Christian Espinosa", "description": "Optimize MedTech cybersecurity by implementing proactive strategies, integrating security early, and adopting an engineering discipline to avoid costly…", "image": "https://christianespinosa.com/__l5e/assets-v1/b257ccf2-bdb9-45b6-8d0b-a9b4c5c5631c/no-wasted-years-no-wasted-cycles-card.png", "datePublished": "2026-03-08T06:00:00Z", "dateModified": "2026-03-08T06:00:00Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/no-wasted-years-no-wasted-cycles" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the core idea behind \"No Wasted Years, No Wasted Cycles\"?", "acceptedAnswer": { "@type": "Answer", "text": "Jet lag makes me more emotional. It also makes me more honest" } }, { "@type": "Question", "name": "Who is this post for?", "acceptedAnswer": { "@type": "Answer", "text": "Honestly, leaders, founders, and anyone running a team who is tired of the sanitized version of leadership advice. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading." } }, { "@type": "Question", "name": "How do I actually apply this, not just nod along?", "acceptedAnswer": { "@type": "Answer", "text": "Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch." } }, { "@type": "Question", "name": "How does this connect to Build it right early?", "acceptedAnswer": { "@type": "Answer", "text": "Blue Goat Cyber helps medical device teams start cybersecurity engineering when the architecture is still soft; threat modeling, security requirements, SBOM management, and FDA-ready evidence from the beginning, not the deadline. If the post landed, that is the natural next step; the talk to blue goat cyber link at the bottom of the page goes straight there." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Leadership](/blog/category/leadership) # No Wasted Years, No Wasted Cycles March 8, 2026 3 min read 681 words Jet lag makes me more emotional. It also makes me more honest ![](/__l5e/assets-v1/58f29684-59a9-4b7b-980f-381d072726d2/wasted-years-shadow-horns.jpg) Published March 8, 2026 Read time 3 min In this essay 1. [01 The Pattern Behind The Pain ](#the-pattern-behind-the-pain) 2. [02 The Austin Reset ](#the-austin-reset) 3. [03 The Music And The Mile Marker ](#the-music-and-the-mile-marker) Jump to 1. [01 The Pattern Behind The Pain ](#the-pattern-behind-the-pain) 2. [02 The Austin Reset ](#the-austin-reset) 3. [03 The Music And The Mile Marker ](#the-music-and-the-mile-marker) The takeaways 1. 01 Prioritize early cybersecurity integration in MedTech to prevent delays and ensure compliance, avoiding last-minute "fire drills." What to do next Block 30 minutes this week to audit how compliance is showing up on your team, then decide one thing to change. 2. 02 Implement threat modeling, SBOM gathering, and security requirement definition proactively, rather than reactively, to optimize MedTech security. What to do next Have one direct conversation about threat with the person on your team who most needs to hear it. 3. 03 Adopt an engineering discipline approach to MedTech cybersecurity, focusing on foundational elements early to achieve long-term efficiency and effectiveness. What to do next Have one direct conversation about adopt with the person on your team who most needs to hear it. 4. 04 Recognize that MedTech cybersecurity failures often stem from preventable delays in implementing security measures, rather than from external attacks. What to do next Block 30 minutes this week to audit how attacks is showing up on your team, then decide one thing to change. 5. 05 Apply principles of early, disciplined effort, like in race car driving, to MedTech cybersecurity to build strong systems and avoid wasted time and resources. What to do next Block 30 minutes this week to audit how apply is showing up on your team, then decide one thing to change. Editor's note The pattern I see across 250+ FDA submissions: the teams that struggle aren't the ones with the hardest devices. They're the ones who treated cybersecurity as something to bolt on after the design freeze. By the time they call us, threat modeling means rewriting assumptions, not documenting them. Wasted cycles is the polite name for it. This year so far: San Francisco, Austin, Dubai, London. Starting Sunday: Australia, then Singapore, then Korea. I'm grateful. I'm also feeling the miles. When I'm running this hard, the noise drops out and the honest thing surfaces: the years I regret aren't the hard ones, they're the ones I spent waiting. Which leaves me with one question: What's worth it? For me, it's Blue Goat Cyber's mission. Medical devices aren't "tech products." They're the thing someone's mom, dad, kid, or spouse is depending on to save their life or improve it. That's the lens I try to keep when the schedule gets crazy. ## The Pattern Behind The Pain Here's the thought I keep coming back to as a founder in this space: Most cybersecurity pain in MedTech isn't caused by attackers. It's caused by waiting. Waiting to [threat model](/blog/threat-modeling-is-the-work-everything-else-is-the-receipt) until late. Waiting to gather [SBOM details](/blog/what-a-good-sbom-actually-looks-like) until the deadline. Waiting to define security requirements until architecture is already locked. Waiting until a submission is in motion to figure out what "good" looks like. That's how teams lose months. That's how "compliance" becomes churn. That's how you end up doing security as a fire drill instead of an [engineering discipline](/blog/total-product-lifecycle-the-framing-that-fixes-most-submissions). The interesting part is that waiting almost never feels like a decision. It feels like prioritization. The threat model gets pushed because there is a customer demo. The SBOM gets pushed because there is a release. The security requirements get pushed because the architects need another week. Every individual deferral is reasonable. The compounded cost of all of them is the project that ships six months late and rewrites half its documentation in the final quarter. No wasted years. No wasted cycles. Build it right early is not a slogan. It is the only way the math works. ## The Austin Reset Austin was a reset for me. We did a leadership offsite and I walked away proud of our team. They show up with discipline and care every day, and I don't take that for granted. Offsites are easy to do badly. The good ones do one specific thing well; they get the people who carry the company out of the operating cadence long enough to remember why they signed up. We did not solve every problem on the agenda. We solved enough of them to walk back into the week with the right argument in our heads about which problems were actually worth solving. Also in Austin, I took Skip Barber Racing School's Advanced Formula Car class. I'm now greenlighted to race F4, and I'm hoping to do that this year. Same principle: you don't earn speed by panicking late. You earn it with fundamentals early. The drivers who are fastest on race day are the ones who put in the unglamorous reps; the threshold braking, the weight transfer, the looking-three-corners-ahead drill; long before there was a trophy on the line. The teams that ship cleanest are doing the same thing with threat models and SBOMs while the rest of the field is still arguing about the deadline. ## The Music And The Mile Marker And because I'm a heavy metal fan, life handed me a couple moments that felt unreal. I ran into Rob Halford at LHR. He was on my flight and we ended up chatting quite a bit. This year I've got tickets to Wacken. Lifelong goal. I'll see him there. 🤘 And Metallica is playing at the Sphere in Vegas, where I got married to Melissa. That one hits different. Iron Maiden's "Wasted Years" has been on repeat for me lately. Not as regret. As a reminder. The song is the older musician telling the younger one not to spend the present mourning the past or worshipping the future. That hits harder at 50 than it did at 20. The years are not wasted because they were imperfect. They are wasted when you spend them somewhere your attention is not. No wasted years. No wasted cycles. Build it right early. Up the irons. > “No wasted years. No wasted cycles. Build it right early.” Frequently asked ### What is the core idea behind "No Wasted Years, No Wasted Cycles"? ### Who is this post for? ### How do I actually apply this, not just nod along? ### How does this connect to Build it right early? ### Build it right early Blue Goat Cyber helps medical device teams start cybersecurity engineering when the architecture is still soft; threat modeling, security requirements, SBOM management, and FDA-ready evidence from the beginning, not the deadline. [Talk to Blue Goat Cyber](https://bluegoatcyber.com/contact) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fno-wasted-years-no-wasted-cycles&text=No%20Wasted%20Years%2C%20No%20Wasted%20Cycles) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fno-wasted-years-no-wasted-cycles) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fno-wasted-years-no-wasted-cycles) [Email](mailto:?subject=No%20Wasted%20Years%2C%20No%20Wasted%20Cycles&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fno-wasted-years-no-wasted-cycles)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founder & CEO, Blue Goat Cyber I'm the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm where my team has supported 250+ FDA submissions with zero failing to clear on cybersecurity. I previously founded and sold Alpine Security. I host The Med Device Cyber Podcast and wrote The Smartest Person in the Room and The In-Between: Life in the Micro, with Medical Device Cybersecurity: An In-Depth Guide out in 2026. Air Force Academy grad, 24x Ironman, climber of two of the Seven Summits. Keep reading - [ ### Total Product Lifecycle: The Framing That Fixes Most Submissions The lifecycle frame is the antidote to waiting; security as engineering, not as a fire drill. Read essay → ](/blog/total-product-lifecycle-the-framing-that-fixes-most-submissions) - [ ### Threat Modeling Is the Work. Everything Else Is the Receipt. The most expensive thing to do late. Worth doing early for exactly the reasons in this post. Read essay → ](/blog/threat-modeling-is-the-work-everything-else-is-the-receipt) - [ ### Speed Is Easy. Control Is Hard. The same fundamentals-early principle from the track side of my year. Read essay → ](/blog/speed-is-easy-control-is-hard) - [ ### Intentional Reflection: A Practice for Leaders Who Want to Grow The deliberate, structured practice underneath every honest course correction in these essays. Read essay → ](/blog/reflection-is-part-of-the-messy-and-uncomfortable-growth-process) [← Previous essay Fade To Black And The Loneliness Of Leadership | Christian Espinosa ](/blog/fade-to-black-and-the-loneliness-of-leadership)[Next essay → Wet Tires At COTA: When The Conditions Change | Christian Espinosa ](/blog/wet-tires-at-cota-when-the-conditions-change) Related, Cybersecurity ### Need medical-device or offensive security expertise? Blue Goat Cyber, Christian's firm, runs FDA-aligned premarket submissions, penetration testing, and SBOM/SOUP analysis for medtech and high-stakes industries. [Explore Blue Goat Cyber](/cybersecurity) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)