'80, 85% of the Way': The Limit of the One-Platform Approach | Executive Interview with Jay Stewart

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

'80, 85% of the Way': The Limit of the One-Platform Approach

[00:00:06] Drex: Everyone, welcome to the show. Today, I have Jay Stewart, the chief revenue officer from Meditology on the show. Welcome, Jay.

[00:00:13] Jay: Hey, Drex. Thanks for having me.

[00:00:14] Drex: Yeah, first time being on with me. Tell me a little bit about yourself. Tell me a little bit about Meditology.

[00:00:22] Jay: Sure, I'll start with Meditology. So, Meditology helps health care organizations from your largest IDNs to kind of your pre-market medical device companies. Really operationalize their governance risk and compliance functions.

[00:00:44] Jay: From a people process and yes, technology perspective. As you all know, health care organizations, they're not short on audits, assessments, testing.

[00:00:59] Jay: But when I'm speaking with CISOs and security leaders, they really struggle with making sense of all of these assessments and all of these audits and actually getting value in kind of the long term out of these assessments. And we help kind of make that possible.

[00:01:23] Jay: And we do that through kind of our three-phase approach, kind of our aim model where we can advise, so think of kind of like a three-year investment roadmap from a cybersecurity perspective to implement, where we might actually help kind of take that strategy into action,

[00:01:45] Jay: and then into manage where we can offer kind of managed services actually help the program run. And so we call that our aim model and help in organizations since 2010.

[00:01:59] Drex: Tell me a little bit about you. You come at this interestingly from a third-party risk management kind of background, too.

[00:02:06] Jay: Sure. So kind of cut my teeth in the medical display sales world and sold diagnostic imaging to radiologists. And then had an opportunity to work with a small startup, CORL Technologies.

[00:02:30] Jay: Kind of that's where I cut my teeth in kind of the third-party space. And then over the years, morphed into the Meditology role, and back in 2025, Meditology officially brought in CORL under its umbrella. And so it's been an interesting ride,

[00:02:53] Jay: kind of seeing third-party risk management kind of grow in importance. And now we're at a really interesting inflection point, which I'm sure we'll talk about in more detail today.

[00:03:32] Drex: Yeah, there is so much happening in the industry right now. Even this morning got a call, early morning call from a friend who's suffering through what feels like some pretty chronic layoff cycles that are going on right now, depending on the size of the organization. So the financial pressure is really clear. It's very heavy for a lot of folks right now. How's that affecting cybersecurity?

[00:03:57] Drex: What are you seeing out there as you visit with customers and some of the other folks you talk to?

[00:04:03] Jay: Sure. Yeah, I'm kind of seeing it in two different lenses. Kind of the top-end, the larger IDNs and health systems. Certainly, you know, under some budget pressure, but we're actually seeing kind of budget stabilize a little bit there. When you go into kind of the smaller market,

[00:04:25] Jay: everything is scrutinized, you know, and if folks are really looking at, hey, how do we get? How do we do more with less? And speaking with a lot of our clients, we're starting to see new procurement processes kind of pop up where, you know, contracts of a certain size, where they weren't usually kind of reviewed by the CFO level.

[00:04:50] Jay: They're certainly being reviewed now. And, you know, I think that puts some significant pressure on our leadership in the healthcare space, where, you know, everyone is being asked to do more with less. There's a lot more scrutiny on the business plan.

[00:05:10] Jay: How does the business plan help the organization grow or make it safer?

[00:05:16] Drex: Like more specifically, you're seeing that same kind of thing. Like as you, as you sell into organizations, you're helping them build business plans that sort of make the case.

[00:05:28] Jay: Yeah, you definitely have to have a sound business case. And, you know, understanding, you know, are we looking to reduce costs, reduce risk? What is that outcome that not only is the CFO looking for, but the business? What is the business really looking for?

[00:05:50] Jay: And being able to explain that in a couple of different languages and kind of that CFO language that I mentioned, to the clinical,

[00:06:00] Jay: kind of the clinical discussions that are going kind of behind the scenes at the IT level. How is that going to integrate into my system? What are some of those kind of integration risks, you know, and then back to kind of this security world as well? So you definitely have to be multilingual.

[00:06:19] Drex: Yes, as you get into this. Given all of that, and I'm sure a lot more what's your current priorities, what's Meditology's, current priorities, and challenges as you look at this? What are the things that you think you're going to focus on?

[00:06:36] Jay: Yeah, from a focus perspective, certainly, you know, working with our clients in the market in general,

[00:06:48] Jay: around that GRC space and getting efficiency out of that GRC function.

[00:06:57] Drex: Is anybody doing this well? It feels like there's a lot of folks who are challenging GRC.

[00:07:02] Jay: Yeah, I would say there's probably a couple in my network, but I would say at large, you know, I'm seeing larger providers kind of shift towards this one platform approach, where, you know, that platform may solve their problems 80, 85% of the way, but then you've got to go customize it.

[00:07:26] Jay: And once you do that, you really start to lose a lot of the efficiency.

[00:07:31] Jay: And, you know, I would say the technology is just one piece of that puzzle. If you don't have a good foundation set up, you know, just automating things isn't really going to help you. And so getting that kind of people and process piece nailed down first is critical. And that's where we're seeing a lot of organizations needing help.

[00:07:57] Drex: We had talked very briefly before this about some of the other conferences and meetings that you've been in. Talk to me about resilience and third party risk management given your background and how those things seem to kind of be tied together right now.

[00:08:14] Jay: Yeah, absolutely. You know, it seems like resiliency is kind of the new buzzword, right? But I think it's imperative that it's being presented as kind of the new path forward. Because at the end of the day, organizations we're going to see breaches, we're going to see ransomware.

[00:08:37] Jay: And so how do you build that resilient program, that resilient organization? And, you know, where I'm seeing them kind of really come together is, you know, maybe even five years ago, third party risk management was, hey, I've got a thousand vendors, I've got capacity

[00:08:56] Jay: to go assess 500 of those vendors. Let me go send questionnaires out, get the questionnaires back, do that whole process. Well, now if you look at a health system, that list is probably grown four or five times. And it's really a scale issue. And so where I'm seeing kind of organization shift

[00:09:19] Jay: to is yes, we still need to kind of do the blocking and tackling from a third party risk assessment perspective. But how can I look at it a bit differently? How can I look at it from kind of a critical business process, a critical business system? And so one of the recent conferences I was at

[00:09:44] Jay: one CISO is looking at kind of their lab services, right? And so they're kind of breaking it down into these building blocks of saying, hey, what is this like minimal viable state of care where I don't, if if if I can stay up, I can still deliver care, I'm not going to have to divert patients.

[00:10:09] Jay: Well, if you don't have lab services, you can't do a whole heck of a lot to service those patients. And so they're taking those kind of that lab service, they're looking at it through that resiliency lens. And what they're seeing is there might be a concentration of five or 10 vendors that support

[00:10:29] Jay: this function. And then looking at those vendors continually through that resiliency lens and saying, okay, hey, what what do we need to do to kind of understand the risk at this level? If this vendor goes down, what's my plan B? If vendor C goes down, what's my plan D? And so really starting to

[00:10:54] Jay: see it kind of bubble up into that kind of resiliency picture. I mean, I think it helps you focus

[00:10:59] Drex: right? It helps you focus on the things that are probably the most important versus TPRM has felt like for a long time. It's just like a check box. It's the thing I have to go through. I got to ask the 500 questions. I got to get the answers back. They go on a file. I don't necessarily do much about it because I'm on to the next big, you know, thing. Hey, I want to ask you another

[00:11:22] Drex: thing too. We can't have a conversation while I'm talking about AI. What are you what are you hearing

[00:11:26] Jay: about the AI space? What are we not hearing? It's I would say where I'm seeing folks concerned is it seems like most organizations kind of have that first layer of AI governance. Like should we

[00:11:51] Jay: bring this in or should we not? But if you ask any CIO, CISO, what is that AI tool technology doing once it becomes ingrained in your network in your systems? That is a very hard question to answer.

[00:12:14] Jay: I think where we're going to really see the next pressure test is, I was talking to a couple of CISOs. They've launched 90% of the Epic AI agents. Every vendor is delivering their application,

[00:12:37] Jay: their services with some flavor of AI. How do you wrap your arms around that? I know. And sometimes

[00:12:44] Drex: it's turned on on Thursday. You logged in. Exactly. And there's AI capability now. Exactly. And if

[00:12:52] Jay: that's built on, you know, some model that that vendor doesn't control, well, now, now how do you look at that? It's a third and fourth party risk. Exactly. Exactly. And so, you know, it's definitely seeing concerns around that. We are seeing some wins in the space as well.

[00:13:13] Jay: But I would say kind of the governance component of that be kind of that next layer down of governance is something that a lot of organizations are still struggling to kind of wrap their arms around.

[00:13:24] Drex: Yeah. Definitely. We see the same thing. We hear a lot of the same things. When we're out doing regional staff rounds, tables or summits or city tour dinners, one last thing I want to ask, I don't know, you might need to think about this. What do you want other healthcare leaders to kind of hear about cybersecurity? What's your vision for the future of healthcare and

[00:13:49] Drex: cybersecurity? You got any encouraging words for us that could be helpful?

[00:13:55] Jay: Yeah. I think I think where we see some some good things happening is we're starting to see some legislation go through that will help drive, you know, it'll increase some costs. Don't get me wrong. But it will help drive the maturity of organizations in the right way.

[00:14:21] Jay: You know, I don't think HIPAA 2.0 ever gets passed. I think it's too cost prohibitive, but we are starting to see some things pass the Senate. And I think, you know, if I were kind of a glass half full person, which some folks say I may, I may be, I may not be. But I think that

[00:14:42] Jay: legislation actually does help us at the end of the day because it gives us a new bar to kind of raise ourselves to, whereas kind of HIPAA today and some of the other state regulations, like there's just too much ambiguity that we're kind of seeing. And I think that is really where,

[00:15:03] Jay: we'll see some kind of improvements in the healthcare industry.

[00:15:09] Drex: Yeah. No, I think that's, I think that's right on. There's going to be something's going to happen. I don't know when exactly. And you know, you don't know what it is, but you see the momentum there on Capitol Hill. One of the things I want the last thing, this is really the last thing. You're a Tottenham fan.

[00:15:30] Jay: Yeah, I like, I like suffering. So, you know, it's been a tough couple of seasons for us. Yeah, come on, you spurs. Exactly, exactly. So we'll see how the season unfolds. But

[00:15:49] Jay: I think this against Maine United last weekend was our first Premier League goal. So

[00:15:57] Jay: which, you know, we're a couple of weeks into the season. So that's, that's not good. But we're, we're starting to see our way out of it.

[00:16:05] Drex: North London Derby's December 5th, one of my friends told me, and how do you think that's going to go?

[00:16:14] Jay: I'll stick to the glass half full mantra here. I'll go for a draw. I'll go for a 2-2 draw.

[00:16:20] Drex: I love it. Yeah. Hey, Jay is really great to have you on today. I appreciate you being a partner of ours. And I hope our paths cross in person sometime soon.

[00:16:31] Jay: Awesome. Thanks, Drex. Appreciate you having me on.