Jul 31, 2026
How to Choose a Medical Device Penetration Testing Vendor
Seven questions that separate medical device penetration testing vendors from generic IT security firms, and the red flags that predict FDA deficiencies.
What FDA is asking for, and what to do about it.
Notes from submissions, deficiency letters, and test reports.
34 articles, newest first
Jul 31, 2026
What Goes in a Medical Device Penetration Test Report for FDA
What a medical device penetration test report needs for FDA review: scope, tester independence, methods, duration, scored findings, and dispositions.
Jul 31, 2026
How Much Does Medical Device Penetration Testing Cost?
Medical device penetration testing typically runs $12,000 to $75,000+. The drivers: interface count, device complexity, FDA reporting depth, and re-testing.
Apr 15, 2026
Medical Device Security Testing Guide: What to Test, When to Test It, and What FDA Expects
A practical medical device security testing guide: architecture review, code review, fuzzing, penetration testing, and the FDA-ready evidence each produces.
Mar 31, 2026
Congress Just Advanced a Healthcare Cybersecurity Bill. What It Means for Medical Device Companies.
The Health Care Cybersecurity and Resiliency Act (S.3315) cleared the Senate HELP Committee. What it would require and what it means for device manufacturers.
Mar 25, 2026
What the Stryker Attack Actually Means for Medical Device Companies
The Stryker wiper attack exposed the gap between FDA compliance and operational resilience. Here is what medical device companies should actually do about it.
Mar 24, 2026
The 5 Riskiest Medical Devices in 2026, According to New Research
Forescout's 2026 Riskiest Devices report names the five riskiest medical devices in 2026 and what the list means for manufacturers' FDA cybersecurity programs.
Mar 4, 2026
SBOM Generation for Medical Device Software: Practical Setup by Stack
Practical SBOM generation for medical device software across common stacks, with validation, quality gates, and SOUP handling for FDA submission.
Feb 24, 2026
FDA's 3rd Cybersecurity Guidance in 3 Years: What Actually Changed?
FDA released its 3rd cybersecurity guidance in 3 years. The update swaps QSR for QMSR and leaves the documentation list untouched. Here is what changed.
Jan 8, 2026
Medical Device Encryption for Non-Engineers
A plain-language guide to medical device encryption for QA and regulatory teams: symmetric vs asymmetric, key management, and quantum implications.
Nov 24, 2025
Software Design Specification for IEC 62304 and FDA Compliance
How to write a Software Design Specification that meets IEC 62304 clause 5.4 and FDA expectations, with checklists, examples, and common pitfalls.
Oct 28, 2025
IEC 62304 to FDA eSTAR: A Software Documentation Guide
Map IEC 62304 processes to FDA eSTAR software documentation. A clause-by-clause guide to the 10 software documents for medical device submissions.
Sep 4, 2025
Balancing Security Controls with Usability in Medical Devices: A Risk-Based Approach
How to balance medical device cybersecurity controls with clinical usability: a risk-based method, emergency access patterns, and what FDA expects to see.
Aug 20, 2025
12 Essential FDA Cybersecurity Risk Assessment Rules
Twelve rules that decide whether your FDA cybersecurity risk assessment satisfies a reviewer or triggers an AI request, each mapped to the guidance.
Aug 6, 2025
Documentation Overload: The Documents FDA Requires for Software and Cybersecurity
The documents FDA requires for software and cybersecurity in an eSTAR, built from the software guidance Table 1 and the 2026 cybersecurity guidance Appendix 4.
Jul 22, 2025
STRIDE for Medical Devices: A Complete Threat Modeling Framework
STRIDE for medical devices in practice: how to run the session, the six questions to ask of each element, the controls each one points to, what to hand FDA.
Jul 17, 2025
How to Create FDA-Compliant Cybersecurity Traceability Matrices in 2025
How to build the cybersecurity traceability matrix FDA's February 2026 guidance asks for, with four example tables linking threats, controls, SBOM, and tests.
Jul 9, 2025
A Guide to Post-Market Cybersecurity Management
Covers the monitoring, vulnerability response, and legacy planning manufacturers need to keep medical devices cybersecure after FDA clearance.
Jun 25, 2025
SPDF vs IEC 62304: Avoid Costly Documentation Mistakes
How FDA's Secure Product Development Framework fits with IEC 62304, and why one development process still produces two FDA documentation packages.
Jun 18, 2025
Security Architecture as the Foundation of your Medical Device
Explains why secure architecture decisions early in development prevent costly rework and position medical devices for smoother FDA cybersecurity reviews.
Apr 26, 2025
Medical Device Risk Assessment using CVSS
How to use CVSS in medical device risk assessment: FDA's CVSS v3.0 reference, the MITRE rubric, exploitability scoring, and where the score fits in your file.
Feb 20, 2025
Secure Your Medical Device with Cybersecurity Controls
How to implement cybersecurity controls for medical devices: choose, build, and verify each control, with every one traced to a specific threat in your model.
Feb 19, 2025
How to Conduct Medical Device Penetration Testing
How to conduct medical device penetration testing that FDA can review: scope from the threat model, tester independence, device-specific phases, reporting.
Feb 19, 2025
How to Implement Secure Software Development Lifecycle (SDLC) for Medical Devices
Secure SDLC for medical devices: which security activity belongs in each stage, the FDA artifact it produces, and common submission failures.
Feb 18, 2025
Master Data Flow Diagrams for Medical Devices: 4 Critical Components
How to create data flow diagrams for medical devices: the four components plus trust boundaries, the steps to build one, and how DFDs feed FDA's threat model.
Feb 18, 2025
How to Perform security code review
How to perform a security code review for medical device software: inputs, tools plus manual review, what to look for in device code, and FDA evidence.
Feb 14, 2025
Medical Device Security Architecture: How to Build the View FDA Expects
How to build the medical device security architecture views FDA reviewers expect: the four views in Section V.B.2, trust boundaries, controls, and standards.
Feb 11, 2025
How to Establish Patch Management and Security Update Process
How to establish a patch management and security update process for medical devices that meets Section 524B and FDA's cybersecurity management plan elements.
Feb 10, 2025
A Comprehensive Guide to Threat Modeling for Cloud-Connected Medical Devices
Threat modeling for cloud-connected medical devices: model the device, app, and cloud, apply STRIDE at trust boundaries, score exploitability, document for FDA.
Jan 31, 2025
FDA Cybersecurity Requirements for Medical Devices with Software
What FDA actually expects in the cybersecurity package for a software-based medical device, mapped to where each artifact lives in your submission.
Jul 29, 2024
5 reasons FDA will refuse your 510(k) application due to cybersecurity deficiencies
Five cybersecurity gaps that stall a 510(k) under Section 524B and FDA's February 2026 guidance, from a missing threat model to an SBOM with no support data.
Jul 18, 2024
Ensuring Secure Software Updates for Medical Devices
The update path is privileged code execution shipped to every device. Here is the architecture that keeps medical device software updates secure.
Jul 18, 2024
New Cybersecurity Regulations Make Remote Software Updates Practically Mandatory
Why remote software updates are practically mandatory for FDA cyber devices under Section 524B, and what the 2026 cybersecurity guidance expects you to show.
Jul 18, 2024
What Information FDA is Expecting for Cyber Devices?
What information FDA expects for cyber devices under Section 524B and the February 2026 guidance: the plan, the process evidence, and the SBOM.
Want the long version?
The full medical device cybersecurity book is free to read online, chapter by chapter, no signup.
Open chapter 1