🔍 Intelligence Synthesis JP/EN
Ethics · Regulation · Technology — Pharma Practice Notes

Special ── 2026-10-23

RAND Proposes 9-Layer Biosecurity Defense for the AI Era

RAND explains how to layer nine mitigations against harm 10 times COVID-19's scale

What changes

RAND's Steph Guerra says no single intervention is bulletproof. Mitigations therefore have to be designed as layers, not as one measure.

She also says the right defense differs for a lone individual, an insider and a nation state. Access controls such as gene synthesis screening are necessary, but they are not sufficient.

Why it matters

On RAND's podcast Policy Minded, host Deanna Lee noted that scientists showed this year that trained AI models can design entirely new viruses. These viruses infect bacteria, not humans. Lee described the result as a warning sign about the potential risks AI could pose.

Guerra is concerned that the convergence of AI and biotechnology will let more people reach the expertise needed to create such viruses. She said the worry is no longer only nature, but also nefarious actors.

What the report says

Guerra groups the risks at the AI-bio intersection into three buckets. The first is "bioweapons uplift," where AI lowers technical, operational or motivational barriers. The second is circumventing biosecurity controls. The third is "bioweapons novelty," meaning designs that cannot be found in nature.

The core of the strategy is defense-in-depth, which layers several mitigations to detect, disrupt or deter a threat actor. According to Guerra, the report lays out nine mitigations. Each alone can be circumvented, so barriers are placed along the whole risk pathway.

Her example is gene synthesis screening, in which providers screen DNA and RNA orders and check their customers. Guerra called it critically necessary but not sufficient. A state weapons program may synthesize in-house, and an actor may split orders across many companies to avoid triggering a signal.

Who and what scope

The report comes from RAND, a US think tank, through its Center on AI, Security, and Technology. Guerra is Senior Biosecurity Research Resident and Head of AI x Bio at the center. She is the lead author of the report.

The report focuses on worst-case events at least 10 times the scale of the COVID-19 pandemic. Guerra cited about 7 million confirmed COVID-19 deaths. She said the 1918 H1N1 influenza infected roughly one-third of the world's population and killed an estimated 50 to 100 million people in less than two years.

Why this report

The question is how to protect against worst-case scenarios while still allowing legitimate scientific progress. Lee presented this as the question the report tackles.

Guerra said AI could speed up therapeutic discovery, including for cancer and Alzheimer's disease. She also said biology is a dual-use field, meaning the same capabilities can serve good or harmful ends. AI co-scientists that assist with laboratory tasks could improve efficiency, but in the wrong hands they could lower barriers to dangerous experiments.

How they studied it

The RAND podcast transcript does not describe the report's research method or data. It states only that the report focuses on worst-case scenarios and lays out nine mitigations. Guerra also cites historical cases in the conversation.

One example is the Amerithrax attacks of the early 2000s. Guerra said the alleged perpetrator had legitimate access to anthrax through his work, so he was an insider. She said access controls are less likely to stop an insider who already has access. The transcript ends partway, and it does not cover all nine mitigations.

Key points

  1. Guerra divides AI-bio risk into three buckets: bioweapons uplift, circumvention of biosecurity controls and bioweapons novelty.
  2. RAND's report targets events at least 10 times COVID-19's scale and lays out a strategy of nine layered mitigations.
  3. Guerra says gene synthesis screening is necessary but not sufficient, and effective defenses differ by type of threat actor.

Conclusion

RAND's Guerra is concerned that the convergence of AI and biotechnology widens the path to a large-scale pandemic. She says no single measure is bulletproof, so nine mitigations must be layered.

Threat actors differ: individuals, insiders and nation states. Guerra said any actor can be disrupted or deterred, but it is often hard to do both to the same actor.

Quotes and sources

“no single intervention is going to be bulletproof. So, this strategy lays out nine different mitigations that, when layered on top of each other, provide meaningful friction across the entire risk pathway”
── RAND, Policy Minded, 2026-10-22
“it's a great example of the fact that this is a very important and critically necessary mitigation, but it won't be sufficient.”
── RAND, Policy Minded, 2026-10-22
“we really think about the risks at the AI-bio intersection in three primary buckets.”
── RAND, Policy Minded, 2026-10-22
“all actors can either be disrupted in some way or deterred in some way, but oftentimes it's hard to do both to the same actor”
── RAND, Policy Minded, 2026-10-22

Source articles

Written by AI (Claude) from the report and its coverage, then checked by Jev (TypeSafe's judgement model), a Gemini fact-check and a verbatim check of every quote.