Historically, the U.S. government has taken the lead on proposals for additions to and removals from the SATL. Since 2002, during each review of the SARs, HHS and USDA have considered the subject matter expertise of the Intragovernmental Select Agents and Toxins Technical Advisory Committee (ISATTAC), a group of experts spanning a broad swath of agencies of the U.S. government (CRS, 2025). In addition, notices of proposed rulemaking and proposed rules solicit the input of stakeholders via the public commenting process. These deliberations have historically been minimally forthcoming to the public eye, albeit recent publications detailing statistical decision frameworks are an important step in demystifying the process, if adopted long-term (Pillai et al., 2023; Pillai et al., 2022a; Pillai et al., 2022b).

It is important and difficult work to balance addressing the appropriate BSAT safety and security concerns with attempting to avoid overbearing restrictions that dissuade important scientific progress. This is made even more challenging by the fact that there is no mechanism for the evaluation of the efficacy of these policies in reducing biosecurity risk (Franz, 2015). So, while the SARs establish heightened biosafety and biosecurity standards for work with particularly dangerous agents and toxins, they may dissuade laboratories from undertaking work with BSAT because groups cannot justify incurring the additional burdens as compared to simply studying another organism (Gaudioso and Salerno, 1979; Casadevall and Relman, 2010; Dias et al., 2010; Wurtz et al., 2014; Centers for Disease Control and Prevention and United States Department of Agriculture, 2023; Centers for Disease Control and Prevention and United States Department of Agriculture, 2024; Kalra and Parker, 2022). On the government’s part these outcomes are at the very least expected, and at most a desired function.

Historically, there have been only vague criteria for how agents are considered for listing as BSAT, and no publicly disclosed decision-making process for removal or de-tiering of agents or toxins. This largely explains why BSAT may remain listed longer than justified by reasonable perceived risk analysis. Furthermore, much of the hard data on BSAT is either dated (often derived from now disbanded weapons research of the mid-20th century) or slowly evolving because of the stricture of regulation, so the addition and removal deliberations often rely strongly on inference of subject matter experts, which is subject to human biases and heuristics (Koblentz, 2011). Historically, the outcome is long-term residence of an agent or toxin on the SATL that in turn creates stagnant risk, where BSAT risk is bound within a range where the top end represents decreased overall risk (via less access and use) and the bottom end represents limitation on de-risking research. Such stagnation then positively feeds into a loop of continued residence on the SATL. Indeed, this is likely the case for some agents or toxins for which there have been previous weaponization efforts, but for which sanitation, medical countermeasures, etc. are today very effective (e.g., Yersinia pestis, Supplementary Table S1). It is notable that this issue correlates with the perceived risk of an agent or toxin and is thus particularly relevant for Tier 1 BSAT. Importantly, in the most recent biennial update (Department of Health and Human Services, 2024), improved clarity on criteria was provided, and this innovation is a welcome change that will lead to significant improvement in the process of listing/de-listing if maintained in the future.

The current situation that biases toward long-term residence of agents or toxins on the SATL is deleterious in multiple ways. Cost barriers to studying select agents may inhibit laboratories from engaging with de-risking research on these BSAT, and those laboratories that do conduct this research will be met with strict standards that decrease productivity. It follows that in the event of a BSAT public health crisis, it is likely that we will discover a reduced pool of expertise (Wurtz et al., 2014), resources, and preparedness for the BSAT, and thus a less effective public health response. We surmise that collectively, a lack of a methodology for de-tiering and de-listing BSAT is reducing public health security.

Two other government stratification scales are informative examples for this discussion. Similar to the SATL, the classifications of drugs by the Drug Enforcement Agency (DEA), called drug scheduling, stratifies substances into classes based on eight factors that collectively assess a drug’s potential for abuse as well as its medical value (United States Drug Enforcement Administration, 2025). This process involves posting proposed rules to the Federal Register to solicit public comments, followed by eventual final rules when it is determined that the drug will be scheduled in one of five categories. Importantly, once a drug is scheduled, it is difficult to change its schedule level, including de-scheduling. This is due to a variety of factors, including the variable application of the term “abuse”, international law, the need for large clinical trials to back up schedule decisions, etc. It is widely believed that the static nature of drug scheduling can be problematic, as it inhibits the ability to reassess drugs based on newly developed or discovered understanding of abuse likelihood and medical value (Lopez, 2016). However, changes to schedule (and de-scheduling) have both been accomplished through significant effort (Department of Justice, 2014; Department of Justice, 2022), primarily because of the clarity of the stated criteria for scheduling decisions.

The Fish and Wildlife Service (FWS) approach to the endangered species list is perhaps a more compelling example of adaptable list-based policy. Species are considered for listing as endangered (in danger of extinction in all or much of its natural range) or threatened (likely to soon become endangered) either by government proposal or stakeholder petition. After considering initial data, the FWS posts a proposed rule (or series of them) to the Federal Register to solicit additional biological data. If the data received in whole is compelling, then a final rule will be posted adding that species to the appropriate list (U.S. Fish and Wildlife Service, 2016). FWS describes their process to de-list species as an evaluation of achievements in eliminating or reducing threats, providing a clear two-way street (U.S. Fish and Wildlife Service, 2011). These clear criteria for de-listing (which are the same as those considered for initial listing) paired with consideration of public feedback ultimately guides the FWS’ de-listing decisions. On the whole, it is evident that the combination of clear criteria and de-listing processes bring efficiency to initial evaluation as well as reevaluation, and that the listing of a species is a call to action for the government and public to take steps to protect organism(s) and to participate in risk reduction.

Collectively, the adaptability of the SATL is slightly greater than that of drug scheduling but markedly less than that of the endangered species list. Sparse SATL criteria make for uneven and confusing implementation; government control enables listing and de-listing but in practice effectuates more of the former than the latter. The public’s feedback is taken into consideration via the Federal Register’s public commenting process but seems to be given less weight than opinions of government insiders, and inclusion on the SATL inhibits research rather than providing initiative for taking steps toward de-risking. While the SATL is intended to promote biosafety and biosecurity by limiting the scope and breadth of experiments on the most dangerous agents and toxins, the effect is instead somewhat paradoxical. By dampening feasibility and motivation to study BSAT, the SARs fix BSAT risk at heightened levels. This begs the question: If the most dangerous agents and toxins are defined, would it be useful to prioritize efforts key to reducing their overall threat, rather than inhibiting them?

To address this point, we contend that there is untapped potential in the SARs; it would be useful to flip the approach to use the BSAT and Tier 1 designations as a mechanism to prioritize specific types of research to better understand biological properties in support of risk assessments and decisions. This type of approach already exists in the U.S. government via the Probabilistic Analysis for National Threats Hazards and Risks (PANTHR) program (Department of Homeland Security, 2025), which endeavors to fill knowledge gaps on threat agent characteristics and the effects of technological advance. To better enable synergy between the SARs, PANTHR, and other gap analysis methods in the government, we set out to develop approaches with an ethos of action and risk reduction. In the remainder of this manuscript, we present three strategies to accomplish this aim: prototype BSAT modeling, priority experiments for de-risking, and threshold (goal) development for de-tiering, de-listing, and de-risking.

The National Institute of Allergy and Infectious Diseases (NIAID) has proposed the implementation of a “prototype pathogen model” for pandemic preparedness (Cassetti et al., 2023). The foundational idea for the model is that current methods of researching individual pathogens can be used as models for work on related pathogens. As such, NIAID identified one or multiple “prototype pathogens” for known human-infecting virus families believed to have pandemic-causing potential. These surrogates are then proposed as models for which experimental results can be applied to their respective families. Each family was also identified as having certain key gaps of information that need to be filled, and as such would require research and experimentation with the goal of addressing those gaps. Overall, using these inferences could prove useful in increasing pandemic preparedness for key groups of viruses that pose the greatest perceived risk for causing outbreaks.

Here, we adopt a prototyping model for BSAT with similar goals, but a different approach. Similar to NIAID, we sought to identify experimental data gaps that can be addressed, allowing development of research agendas to meet those deficiencies. However, our approach differed in that it aimed to categorize BSAT across microbial classes to better understand the “why?” of listing and stratification of select agents, from a security analysis perspective. In doing so, we identified themes for agent selection, allowing us to probe the merits of those themes as well as to develop approaches to direct decision-making qualitatively, based on observing changes in biosecurity risk over time. These approaches thus provide an action-oriented mindset, allowing for research prioritization to de-risk these agents.

The overall results of our literature review are listed in Supplementary Table S1 and Table 4, with Supplementary Table S1 providing the sourced data and Table 4 showing the percentages of Tier 1 and non-Tier 1 agents that fit the aforementioned criteria and additional factors. Further, Table 5 uses odds ratio (OR) calculations to show whether differences between Tier 1 and non-Tier 1 agents meet our threshold for prototype characteristics. The results of each criterion and additional factor will be discussed in individual sections.

Collectively, the above analysis allowed us to generate a prototype model of both Tier 1 and non-Tier 1 BSAT, the overall findings of which are detailed in Figure 6. Importantly, the distinguishing features separating the two prototypes are:

• Vaccine development

Of these, BSAT type was the least discerning, with bacteria being more represented in Tier 1 but viruses well represented in both prototypes.

Three facets of these prototypes merit further discussion: vaccines, BSAT type, and host tropism. Our initial vaccine analysis seemed counterintuitive; vaccines are generally indicative of an ability to prevent outbreaks; yet more vaccines are developed and available for Tier 1 BSAT than non-Tier 1 BSAT. Our explanation for this observation is that because Tier 1 BSAT are perceived to pose greater threat to public health, more resources have been invested in developing vaccines for Tier 1 BSAT. While this has led to greater availability of vaccines for Tier 1 agents, this fact has not been compelling enough to consider these agents sufficiently de-risked such that they can be de-tiered. This is possibly an artifact of the recency of Tiering itself (starting in 2012) and the minimal vaccine advancements made for Tier 1 agents since that time, but could also indicate that in the government’s estimation vaccine availability does not reduce risk sufficiently for de-Tiering in these cases. The latter seems most likely, and if so, is undoubtedly correlated with the additional factor of prior weaponization efforts.

To the factor of BSAT type, around 270 viral species (Forni et al., 2022) and 1,500 bacterial species (Bartlett et al., 2022) are known to infect humans. This contrasts with 11,273 species of taxonomically classified viruses (International Committee on Taxonomy of Viruses, 2024) and 35,498 taxonomically classified species of bacteria (Schloss and Handelsman, 2004) (though researchers estimate the true number of species is much higher). When these values are compared to the actual makeup of the SATL, there is a clear skew towards viruses. We hypothesize that this skew may be influenced by human perception of risk; viruses are viewed as having a higher risk of causing a pandemic (Adalja et al., 2019). As the drafting of the SATL is inherently subjective in that it is influenced by SMEs whose opinions shape the final form of the list, we cannot ignore the role that perceived versus actual risk plays in the list. This may represent biases of biological function, transmission dynamics, therapeutic/sanitation technology, human perception, genome sampling and construction capabilities, and more.

In Tier 1, there is a skew toward bacteria as compared to the overall SATL. This overrepresentation seems most likely to be a vestige of early bioweapons research efforts, which found more success in the weaponization of bacteria. As shown above, retention of agents on the SATL is clear for those that have been the focus of prior weaponization efforts. Given this, a variety of factors may have resulted in more “success” of these weaponization efforts for bacteria in comparison to other microorganisms and toxins prior to the enactment of the Biological and Toxins Weapons Convention (BTWC) (Tuzmukhamedov, 1972). These include, but are not limited to, ability to cultivate, availability of antibiotics, availability of vaccines, stability, etc. It may also be possible that the rapid discovery of viruses and the more common emergence of new viruses in the last 30 years has diluted the non-Tier 1 proportion of bacteria, while this effect is muted in Tier 1 because it has not changed much since inception.

Finally, the observed bias toward human-affecting agents and toxins represents anthropocentrism in perceived risk evaluation, as might be expected. But it is worth noting that the effects of destabilized economies and food chains may warrant more serious consideration in perceived risk evaluation. Human illness only represents one form of suffering that is possible due to BSAT events, and we posit that the carnality and relatability of human illness may lead to underestimation of the potential suffering elicited by animal- and plant-affecting BSAT events.

The recent development of humanized murine models allows for testing of human-affecting agents and toxins with more human-relevant results than previously attainable, and is an important avenue for reduction of dual-use concern (Allen et al., 2019). This is true even while acknowledging that these models still have limitations in their prediction of human clinical outcomes (Walsh et al., 2017). Extending this approach to the development of murine models for the study of classes of agents and toxins as a method for studying BSAT would clearly have translational value for the field(s) at large, and we thus view humanized murine models for the study of BSAT as a high-value and low perceived risk approach. Such models would then allow morbidity and mortality evaluation both qualitatively and temporally in ways unattainable through vaccination and challenge trialing in humans. Further, in vivo viability studies of genetically altered agents and toxins would be enabled by such models, including mutational strategies, targeted genetic modifications, and chimeric agents and toxins. This strategy does not necessitate using BSAT, but instead could use related surrogate agents or attenuated versions of BSAT. Pairing this approach with meta-analysis studies of the amenability of classes of agents and toxins to genetic alteration through literature review and interviews with experts would provide key information on the ease and feasibility of genetically altering BSAT, informing perceived risk approximation.

One example of the potential benefits of humanized murine models is the success of those developed for influenza A virus (IAV). Researchers aimed to increase the function of the innate and adaptive immune response in modified mice to IAV; to do so, they infected human PBMC-reconstituted immunodeficient mice with H1N1 and H5N1 IAV, and then tracked disease progression and outcomes. These methods then enabled the development of novel therapeutics and vaccines against IAV, which are currently under investigation for their utility. As such, the application of humanized murine models has potential downstream applications for de-risking of both BSAT and non-listed agents and toxins, which can help to justify the cost and potential risk associated with the creation of such models (Krishnakumar et al., 2019).

We also recommend development and implementation of pan-experiments that are applicable to many agents on the SATL, building off of NIAID’s prototype pathogen model for pandemic preparedness (Deschamps et al., 2023). It is our belief that the examination of the following experiments in all BSAT will prove an appropriate starting point for further evaluation and consideration for de-risking: protein structure elucidation, sequencing of clinical and environmental isolates, determination of primary immunogens, cell tropism and receptor requirements, elucidation of replication mechanisms, toxin binding partners, and development of monoclonal antibodies. All of the aforementioned goals provide valuable insight into the way pathogens harm their hosts and replicate, and as such indirectly equate to the risk presented by each pathogen. Protein structure elucidation could be accomplished via techniques like cryo-electron microscopy, and would allow researchers to gain insight into the enzymatic processes involved in pathogenesis (Cheng, 1979; Thompson and Kovall, 2019). Similarly, determination of a primary immunogen(s) and protective epitopes for each BSAT would allow for a greater understanding of how an infection propagates within its host and gives a starting point for vaccine and therapeutic development. Primary immunogen detection could be elucidated through either immunohistology investigation or solid phase immunoassays (Butler, 2000). Regarding cell tropism, receptor requirements, and replication mechanisms, understanding the proteins (both host and pathogen) that are essential for cellular susceptibility and permissivity would be useful in gaining a more comprehensive view of pathogen threat (Morizono and Chen, 2011). Finally, with knowledge of primary immunogens and receptor binding interactions in mind, the development of sterilizing monoclonal antibodies is a significant step in de-risking an agent or toxin, the production of which could direct therapeutic development (StatPearls, 2023).

NIAID’s prototype pathogen model centers around viruses, but the concept of using a single agent or toxin as a surrogate agent seems transposable beyond this group as well. We recommend that FSAP work with NIAID to determine appropriate surrogates for all Tier 1 agents, and to then encourage, through grant funding, research on sequences of primary clinical isolates, viral entry protein structure/arrangement, host receptors and entry mechanisms, and viral pathogenesis mechanisms (Deschamps et al., 2023). The results of these experiments would serve as a foundation of knowledge that could be used to de-risk BSAT in ways that limit DURC.