Common Post-Market Pitfalls

Pitfall 1: "Set and Forget"

Problem: No ongoing monitoring Impact: Missing critical vulnerabilities Solution: Automated monitoring + regular reviews

Pitfall 2: "Security Through Obscurity"

Problem: Hoping nobody finds vulnerabilities Impact: Unprepared for disclosure Solution: Proactive CVD program

Pitfall 3: "Patch and Pray"

Problem: No verification of deployment Impact: Vulnerable devices remain Solution: Track and verify updates

Pitfall 4: "Silent Treatment"

Problem: Poor customer communication Impact: Loss of trust, unpatched devices Solution: Clear, timely communication

Pitfall 5: "Going It Alone"

Problem: Not sharing/learning from others Impact: Repeated mistakes, missed threats Solution: Active ISAC participation

Sources

Primary documents for the topics in this section:

1. ISO/IEC 29147:2018, Information technology: Security techniques, Vulnerability disclosure, ISO/IEC.
2. Health Information Sharing and Analysis Center (Health-ISAC), Health-ISAC.