Building Resilience Through Technology with Tech Execs from GSK and Gates Corp | Technovation 854

Thanks Chris, thanks for having us.

Thanks. First, thanks for having me, Chris, and Peter. It's really good to be here and some amazing panelists and super interesting discussions as well. I think as you said, GSK is a 300-year-old company. We've always had to innovate in science, in life sciences. It's either innovate or die, or worse, you become mediocre if you don't innovate. So scientific innovation is an underpinning of everything we do. And for that, you know, some of the conversations—I've been with the company for about five years—and some of the conversations that we've had as we transform our pipeline and bring new medicines and transformational medicines and vaccines, and our ambition is to reach 2.5 billion people on the planet and positively impact their health, you can't just sort of do that by playing not to lose. You've got to play to win. And so we use the language around playing not to lose versus playing to win, which means taking smart risks and all of that quite a bit in our culture and in our company. And as part of that, this concept of playing offense versus defense sort of came from that. And we have sort of put technology at the core of our company strategy by saying our purpose as a company—why we exist as a company—is to unite science, technology, and talent to get ahead of disease together. And for that, we know that we need to really be playing to win in certain elements, and that's what we call the concept of playing offense with technology and digital and data and all of that. And then the part about playing defense comes from ensuring that we are doing AI responsibly, thinking about the cybersecurity implications of some of this, the risk to working in a highly regulated industry where patient safety is critical. Like I like to say, you don't want to move fast and break things in this industry. You want to move fast but not break things, because the consequences are very, very real in our industry. So just the importance of playing defense in service of the offense becomes very important. And we think about organizational resilience, the capability building that Neo and Barry talked about earlier, all in the context of what do we need to play offense and what do we need to play defense. And for me, that phrase came up when I was going to the audit committee and the board and updating them on cybersecurity and really making sure that we are having as robust a plan as we can. And then the chairman called me and said, 'I know Shobie, that you're really under a lot of pressure to ensure that we are playing defense, but please don't forget to play offense in service of the science and the innovation and patients.' And that's sort of the genesis of the word for me, and I shared it with you in our conversation. But that's the framework we use to talk about what we do.

Yeah, I think this is super important, super important. I did want to say one thing as I heard Diego talk about the downturn bit, and this is so poignant. I think this is really, as he said, counterintuitive. But I had an airline CIO who I really admire tell me she never had a moment to fix her systems when a plane's not in the air ever. But during COVID, when the planes were all grounded, she said, 'I could not think of a better time to go invest in technology.' And then when they came back—and I can assure you I'm a frequent traveler on this airline—they were a much stronger digital enterprise than when they went into COVID, and that sort of set people apart in a dramatic way. So I think, Diego, it really, really resonated with me what you said. So your question about the board and how to engage the board—I think the luckiest situation is if the board gets it right. In our case, as I said, the chairman gets it, they're passionate about it, they understand it, the audit committee understands their responsibility but understand that there's also a responsibility as part of the main board. The one thing we can say is after COVID, which forced a level of digital adoption, and then the AI pivots that have happened, this is a boardroom conversation almost in most companies now. So we don't have to do the level of pushing that we had to do. So in some way, both COVID and GenAI have been more effective chief digital officers than some of us have been able to do ourselves. That said, I think we have an enormous responsibility to frame these things, and I use that lens of offense and defense. But actually, if you think about it, one of the responsibilities that I have as a board member in my case is to make sure that we are playing to win. By not adopting technology at a time when it's such a differentiator—whether it's productivity or new services or creativity or better customer service or whatever it is—that is such a big amplifier and accelerator. Not adopting it at pace is actually a risk from an overall perspective if you really understand your role as a member of the board. So I think helping frame the conversation in terms that help them do their roles well and effectively is a really important skill to continue to practice. You don't have to be perfect at all. You just have to understand that it's your responsibility to have those conversations, and it's equally important for us to have those conversations in a way in which we are able to be honest about where we are and where we need to go, and where we are ahead and where we are behind, and keep it real as much as possible. Because one of the—many times some of these board members outlive CIOs, so they see through like three CIOs and how is your story different than your predecessor's story or your successor's story? So keeping it as real as possible to the current context of what is important right now has been another source of really valuable engagement and getting more board engagement as well and excitement. Because in our case, for example, many of our non-executive directors are UK-based, but many of them are scientists. So how do you have this conversation in the realm of science and patient care and things like that that they deeply care about and understand? I think bringing a level of empathy that you would bring to any stakeholder at your executive table—bringing that is important. So that's sort of how I think about it. And I also, when I sit at the table as a non-executive director, really try to have both conversations. When I'm in the audit committee I try to have the conversation around governance, but when I'm in the main board I try to have the more balanced conversation about strategy, people, talent—all those things.

I think on the—cybersecurity, it would be ridiculous for any company not to be prioritizing that. And you know, as I look at any enterprise risk assessment that comes up, whether you're on a board or you're looking at it as a company, it goes to the right and increasing. That's just the nature of it. I think the principle that we try to follow is really thinking about what does cyber defense mean for us. What are the threat vectors that we are most worried about? We have probably some common threat vectors like everybody else—the human vector, the ransomware, et cetera—which everybody in the world is going to be impacted by. And then there are probably things that are unique to, for example, Diego's industry and mine. For us, operating technology resilience is super important, versus probably not so much for a software technology company or somebody who doesn't have that. So I think just being really thoughtful about what are the threat vectors that you care about, and holding yourself accountable to improve not just the maturity—but one of the easy distractions is 'oh I'm here on NIST and I'm going here on NIST'—but really the controls effectiveness. So you've deployed all these controls, how effective are they truly? And then having the courage to constantly red team yourself and test. Not just talk about it, but really test to see where your strengths are. I really do want to be careful about getting too confident on this. This is really hard stuff, and none of us can be absolutely sure that we've done everything right. But being very thoughtful and intentional about the cool stuff but also the traditional things like good BCPs and good backups, like the things that Diego just talked about, is really important. And we are again back to our principles about keeping it real. We spend a lot of time thinking about it, we invest responsibly, hold ourselves accountable with external measurements, and then really make sure also that we're building the capabilities up internally and in our partners to be ready for what's coming, not just what's here already. And one of the wonderful things about cybersecurity is you're not alone. There's so many places to go for collective defense and learning from each other. And I like to tell my team when the Uber incident happened or the Microsoft incident happened, just use them to test our defenses—it's the same attack patterns that we have to defend against. So really the ability to learn from the collective consciousness is super important, because that's the only way we can take on the adversaries. In terms of other defense mechanisms, I think everyone does this as well, but thinking about AI very responsibly. We've done AI for a while, especially using AI in drug discovery including generative AI, large—we have custom large language models, et cetera—because we've invested in scientific innovation for quite a bit. But all along we've had AI policy. We established an AI policy and ethics organization five years ago, and we really, once we decided that we are scaling AI across the company, we have put an AI policy in place, we've set up an AI governance council. And probably the interesting thing that I've come to realize as I set up the AI governance council for us is to recognize how important it is to not have AI become its own thing in the company. Whether it's defense or offense or whatever, it needs to feed into existing risk mechanisms, risk tracking mechanisms, go to existing risk boards. So thereby you ensure that all your risk management frameworks are thinking about this additional risk. If you think about patient safety, what is the additional patient safety risk from adoption of AI? If you're already thinking about procurement risk, what's the additional risk? So I think leveraging the existing defense of the company and recruiting it to protect yourself against this new technology we're adopting has been a very interesting learning, and it would not have been intuitive, because everybody wants to set up a separate council and publish papers and all of that. Like we are really activating the defenses of the company, but where we need we also put expertise in. So those would be the two things I'll share. I think supply chain—Diego talked about quite a bit of it.

Thank you.