President
Jose Bohorquez, PhD
Jose founded CyberMed to help companies get secure medical devices to market efficiently. He has more than 20 years of experience in the medical devices industry, leading product development and security teams for over 15 years.
Dr. Bohorquez is a frequent NIH reviewer for SBIR grant proposals, a digital health startup mentor for NYU's Endless Corridor Labs, and a member of the Executive Advisory Board for the FIRST robotics competition.
He holds Bachelor's and Master's degrees in Electrical Engineering and Computer Science from the University of Florida and completed his PhD at MIT.
Credentials
- PhD, Massachusetts Institute of Technology
- MS & BS, Electrical Engineering and Computer Science, University of Florida
- NIH SBIR grant reviewer
- Mentor, NYU Endless Corridor Labs
Areas of expertise
- FDA medical device cybersecurity
- 510(k) cybersecurity submissions
- Premarket cybersecurity documentation
- Secure product development framework
- Medical device threat modeling
Articles by Jose Bohorquez
- How to Choose a Medical Device Penetration Testing Vendor
Seven questions that separate medical device penetration testing vendors from generic IT security firms, and the red flags that predict FDA deficiencies.
July 31, 2026
- What Goes in a Medical Device Penetration Test Report for FDA
What a medical device penetration test report needs for FDA review: scope, tester independence, methods, duration, scored findings, and dispositions.
July 31, 2026
- How Much Does Medical Device Penetration Testing Cost?
Medical device penetration testing typically runs $12,000 to $75,000+. The drivers: interface count, device complexity, FDA reporting depth, and re-testing.
July 31, 2026
- Congress Just Advanced a Healthcare Cybersecurity Bill. What It Means for Medical Device Companies.
The Health Care Cybersecurity and Resiliency Act (S.3315) cleared the Senate HELP Committee. What it would require and what it means for device manufacturers.
March 31, 2026
- FDA's 3rd Cybersecurity Guidance in 3 Years: What Actually Changed?
FDA released its 3rd cybersecurity guidance in 3 years. The update swaps QSR for QMSR and leaves the documentation list untouched. Here is what changed.
February 24, 2026
- Software Design Specification for IEC 62304 and FDA Compliance
How to write a Software Design Specification that meets IEC 62304 clause 5.4 and FDA expectations, with checklists, examples, and common pitfalls.
November 24, 2025
- IEC 62304 to FDA eSTAR: A Software Documentation Guide
Map IEC 62304 processes to FDA eSTAR software documentation. A clause-by-clause guide to the 10 software documents for medical device submissions.
October 28, 2025
- 12 Essential FDA Cybersecurity Risk Assessment Rules
Twelve rules that decide whether your FDA cybersecurity risk assessment satisfies a reviewer or triggers an AI request, each mapped to the guidance.
August 20, 2025
- Documentation Overload: The Documents FDA Requires for Software and Cybersecurity
The documents FDA requires for software and cybersecurity in an eSTAR, built from the software guidance Table 1 and the 2026 cybersecurity guidance Appendix 4.
August 6, 2025
- How to Create FDA-Compliant Cybersecurity Traceability Matrices in 2025
How to build the cybersecurity traceability matrix FDA's February 2026 guidance asks for, with four example tables linking threats, controls, SBOM, and tests.
July 17, 2025
- A Guide to Post-Market Cybersecurity Management
Covers the monitoring, vulnerability response, and legacy planning manufacturers need to keep medical devices cybersecure after FDA clearance.
July 9, 2025
- SPDF vs IEC 62304: Avoid Costly Documentation Mistakes
How FDA's Secure Product Development Framework fits with IEC 62304, and why one development process still produces two FDA documentation packages.
June 25, 2025
- FDA Cybersecurity Requirements for Medical Devices with Software
What FDA actually expects in the cybersecurity package for a software-based medical device, mapped to where each artifact lives in your submission.
January 31, 2025
- 5 reasons FDA will refuse your 510(k) application due to cybersecurity deficiencies
Five cybersecurity gaps that stall a 510(k) under Section 524B and FDA's February 2026 guidance, from a missing threat model to an SBOM with no support data.
July 29, 2024
- What Information FDA is Expecting for Cyber Devices?
What information FDA expects for cyber devices under Section 524B and the February 2026 guidance: the plan, the process evidence, and the SBOM.
July 18, 2024