Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity
    ⌘K
    About

    We protect patients by helping MedTech teams build secure devices.

    Founded by Christian Espinosa, a mountain climber and former military cyber operator. Named after the resilience of mountain goats - and built on the belief that medical device cybersecurity deserves a specialist.

    Built on the standards FDA reviewers expect

    Our story

    A mission born from expertise - and a personal resolve.

    Blue Goat Cyber's story starts a decade before the company existed. In 2014, founder Christian Espinosa launched Alpine Security to help manufacturers navigate FDA expectations and protect the patients who depend on connected devices. After selling Alpine in 2020, a serious health scare gave Christian a firsthand appreciation for how much modern medicine depends on technology working safely, reliably, and securely.

    In 2022, he founded Blue Goat Cyber with a sharper, more personal mission: protect lives by making sure medical devices are secure by design and ready for FDA scrutiny. Since then, the team has supported submissions for startups and global manufacturers alike - including Intuitive Surgical, bioMérieux, Nova Biomedical, Inogen, and Natera - across robotic surgery systems, diagnostic platforms, blood analyzers, wearables, and SaMD.

    We're a service-disabled veteran-owned business with a record in which no client has failed to clear due to cybersecurity on FDA cybersecurity submissions. Every engagement is fixed-fee with unlimited retests, and if a submission is rejected for cybersecurity reasons we resolve the deficiencies at no additional cost. That's not a marketing promise - it's how we structure the work.

    Christian Espinosa, Founder & CEO of Blue Goat Cyber
    A health scare made the mission personal. Patients depend on connected devices working safely - every time. That's not a slogan. It's why we only do MedTech.
    Christian Espinosa · Founder & CEO
    Where the name comes from

    Why Blue Goat?

    Christian is an avid mountain climber. On the trails, he's watched goats find footing on terrain that would stop almost anything else - relentless, resilient, focused on the next foothold. That's the discipline we wanted the company to embody.

    The Blue is for the impossibly clear sky over a snow-covered ridgeline - clarity, trust, and limitless potential. Together it captures what we're trying to bring to MedTech security: steady footing on hard terrain, with no shortcuts to the summit.

    Purpose

    Medical device security is patient safety.

    Why we exist: so the devices people depend on can't be turned against them.

    Vision

    Connected medical devices that are secure by design and resilient for their entire service life.

    The world we are working toward, with no end date.

    Mission

    By 2028, help medical device teams get 500 devices through FDA review with zero cybersecurity-driven rejections, and teach the industry to start cybersecurity early.

    What we do daily, with a deadline: secure the devices in front of us, and through books, stages, podcasts, webinars, and mentoring, help every other team understand what cybersecurity means for their device before it costs them.

    Credibility

    Track record that backs the story.

    The numbers behind the engagements - and the manufacturers who've trusted us with their submissions.

    0%

    In-house

    Cybersecurity scope delivered in-house, never subcontracted

    0+

    Submissions

    Medical device submissions supported

    0+ yrs

    Specialist

    Specialist focus on MedTech security

    SDVOSB

    Certified

    Service-disabled veteran-owned business

    Trusted by MedTech leaders

    • Intuitive Surgical logo, Blue Goat Cyber client
    • bioMérieux logo, Blue Goat Cyber client
    • Natera logo, Blue Goat Cyber client
    • Inogen logo, Blue Goat Cyber client
    • Medivis logo, Blue Goat Cyber client
    • Velico Medical logo, Blue Goat Cyber client

    Global client footprint

    MedTech teams we secure, mapped

    108+HQ locations
    19Countries

    Hover any pin to see the HQ location. Pinch / scroll to zoom. Representative selection of MedTech, IVD, SaMD, and digital-health organizations Blue Goat Cyber has supported across 19 countries.

    Success outcomes

    What commitment-backed work has produced.

    • Cleared 510(k), De Novo, PMA, and IDE submissions across robotic surgery, diagnostics, wearables, and SaMD.
    • Resolved FDA cybersecurity deficiency letters at no additional cost - every engagement is commitment-backed.
    • Reduced average premarket cybersecurity review cycles for repeat clients by catching gaps before submission.
    • Stood up post-market SBOM, vulnerability monitoring, and coordinated disclosure programs aligned to Section 524B.
    Devices we secure

    From robotic surgery to wearables.

    Every category below is something we've taken through FDA cybersecurity review.

    Robotic surgery

    Endoscopic, laparoscopic, and surgical robotics platforms.

    Diagnostics & IVD

    Hematology, molecular diagnostics, and clinical analyzers.

    Wearables

    Continuous monitors, biosensors, and patient-worn devices.

    SaMD

    Software as a medical device, mobile, and cloud companions.

    Implantables

    Pacemakers, neurostimulators, and active implantable devices.

    Imaging

    AI-enabled imaging systems and PACS-integrated platforms.

    Drug delivery

    Infusion pumps, autoinjectors, and connected combination products.

    Patient monitors

    Bedside, ambulatory, and remote patient monitoring.

    Milestones

    How we got here.

    A decade of MedTech cybersecurity work - walk the path from Alpine Security to Blue Goat Cyber.

    1. 2026Company

      Judge, Sponsor & Mentor - MedTech Innovator Asia Pacific 2026

      Blue Goat Cyber gives back to the global MedTech community as a judge, sponsor, and mentor for MedTech Innovator Asia Pacific - the world's largest accelerator for medical device innovation - helping APAC startups navigate FDA, EU MDR, and global cybersecurity compliance.

    2. 2026Award

      Medical Device Cybersecurity Solution of the Year

      MedTech Outlook names Blue Goat Cyber its 2026 Medical Device Cybersecurity Solution of the Year - recognizing patient-safety-first engagements that deliver market access and regulatory clearance without the chaos.

    3. 2025Company

      250+ FDA submissions supported

      Cross 250 FDA cybersecurity submissions across 12+ device classes, with no client failing to clear because of cybersecurity. Expand the team with senior MedTech security and regulatory hires.

    4. 2025Award

      MedTech Service Provider Excellence Award

      Awarded at the MedTech World Malta 2025 Awards Gala (sponsored by the Malta Medicines Authority) for global leadership in medical-device cybersecurity - threat modeling, secure-by-design, SBOM, and lifecycle vulnerability management.

    5. 2026Award

      Medical Device Cybersecurity Partner of the Year

      MedTech World North America 2026 Awards (in collaboration with CS Lifesciences) names Blue Goat Cyber Cybersecurity Partner of the Year - recognition of our patient-safety-first approach to FDA cybersecurity submissions and global medical device security partnerships.

    6. 2026Industry

      FDA finalizes premarket cybersecurity guidance

      On February 3, 2026, the FDA finalizes "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions" (superseding the September 27, 2023 version and the June 2025 update). Defines the seven-section submission format reviewers now enforce at Technical Screening.

    7. 2025Industry

      FDA AI-enabled device guidance released

      FDA's January 2025 guidance sets expectations for AI-enabled medical devices - transparency, real-world monitoring, change control, and cybersecurity across the model lifecycle.

    8. 2024Content

      Owned media: MDC Podcast + Webinar series launch

      Christian launches the Med Device Cyber Podcast and a companion technical webinar series - translating FDA expectations, threat modeling, SBOM, and postmarket security for product, quality, and regulatory leaders.

    9. 2023Industry

      FDA Section 524B becomes law (PATCH Act)

      Section 524B of the FD&C Act gives FDA refuse-to-accept authority for cyber devices and mandates SBOMs, threat models, and postmarket plans in every premarket submission. Cybersecurity becomes table stakes for clearance.

    10. 2023Content
      The In-Between: Life in the Micro book cover

      The In-Between: Life in the Micro published

      Christian releases his memoir The In-Between: Life in the Micro (Shrinking Ego, Dec 12, 2023) - a focused look at the small moments that shape relationships, business, and life.

    11. 2022Company

      Blue Goat Cyber founded

      Christian leaves CISO Global and launches Blue Goat Cyber from Pocatello, Idaho - a medical-device-only specialist with commitment-backed engagements, fixed-fee pricing, and end-to-end coverage from premarket through postmarket.

    12. 2022Company

      A personal health scare

      In O'Fallon, IL, a portable Doppler ultrasound helps diagnose Christian's life-threatening blood clots. The stakes of connected-device safety become personal.

    13. 2021Content
      The Smartest Person in the Room book cover

      The Smartest Person in the Room published

      Christian publishes The Smartest Person in the Room - a leadership book on the human side of cybersecurity, drawn from years of running red teams and building Alpine.

    14. 2020Company

      Alpine sold to Cerberus Sentinel - 50+ submissions cleared

      By the time Alpine is sold to Cerberus Sentinel, the team has cleared 50+ medical device cybersecurity submissions (510(k), De Novo, PMA) across imaging, diagnostics, and connected devices with zero clearance failures - the foundation of the methodology Blue Goat Cyber would later productize.

    15. 2015Company

      Alpine launches MedTech cybersecurity division

      Alpine Security spins up one of the earliest dedicated MedTech cybersecurity practices - pen testing, threat modeling, and FDA-aligned compliance support for medical device manufacturers.

    16. 2014Company

      Alpine Security founded

      Christian Espinosa founds Alpine Security in Fairview Heights, IL - a cybersecurity firm built on hands-on penetration testing, incident response, and security training.

    Core beliefs

    What we stand for.

    Seven beliefs that shape how we approach every medical device cybersecurity engagement. See scenarios and examples for each →

    Patient safety comes first

    Every patient deserves secure, reliable medical devices designed to protect lives without compromise. Safeguarding the people who depend on your devices is our top priority.

    Security enables innovation

    Cybersecurity is the foundation for advancing healthcare. By addressing risks early, we empower manufacturers to deliver groundbreaking, life-saving solutions with confidence.

    Trust is earned through action

    Trust is built by delivering solutions that meet the highest standards of security and compliance - not just compliant, but truly secure.

    Proactive prevents future threats

    We work ahead of emerging threats so you stay ahead of risk. Proactive measures prevent costly vulnerabilities and ensure long-term device security.

    Compliance is the starting point

    Meeting regulatory requirements is just the beginning. True success means devices that inspire trust and protect patients in a rapidly evolving landscape.

    Collaboration drives success

    We work side-by-side with manufacturers to solve challenges and build customized solutions. Your success is our mission.

    The stakes demand excellence

    Lives depend on what we do. We're committed to delivering exceptional cybersecurity solutions every time, upholding the highest standards of quality and care.

    How we operate

    Team core values.

    The day-to-day mantras every Blue Goat team member lives by.

    • Think flexibly to solve problems
    • Find the opportunity in every situation
    • Listen carefully, respond clearly
    • Own the problem, find the solution
    • Grow beyond your comfort zone
    • Obsess over critical details
    • Learn fast, learn often
    Our team

    Specialists, not generalists.

    A focused team of MedTech security operators - small enough that you always know who's accountable.

    Headshot of Christian Espinosa, Founder & CEO at Blue Goat Cyber

    Christian Espinosa

    Founder & CEO

    U.S. Air Force Academy graduate and veteran with 30+ years in cybersecurity. Founded Alpine Security in 2014 (acquired 2020), then Blue Goat Cyber in 2022. Has supported 250+ FDA medical device submissions; no client has failed to clear due to cybersecurity. Author of three books including The Smartest Person in the Room. Ironman triathlete and mountaineer.

    Connect on LinkedIn
    Headshot of Myles Kellerman, CTO at Blue Goat Cyber

    Myles Kellerman

    CTO

    Chief Technology Officer leading medical device and IoMT security testing, threat modeling, and pen testing aligned with FDA premarket and postmarket cybersecurity expectations. Oversees device, application, red team, and physical assessments across Class II and Class III programs, plus internal tooling that keeps submission-grade evidence consistent. 18+ years in IT, 13+ in cybersecurity, with earlier work on aircraft and embedded defense systems that translates directly to safety-critical MedTech.

    Connect on LinkedIn
    Professional headshot of Jordan John, VP of Regulatory Affairs & Compliance at Blue Goat Cyber - a smiling man with short dark hair and a beard, wearing a navy suit, light blue shirt, and red patterned tie, photographed against a plain white background.

    Jordan John

    VP, Regulatory Affairs & Compliance

    Owns the regulatory and compliance lane across FDA premarket and postmarket submissions. Aligns cybersecurity evidence with Section 524B, eSTAR, and the broader regulatory file so every package holds together end-to-end.

    Headshot of Melissa Espinosa, VP, Strategic Partnerships at Blue Goat Cyber

    Melissa Espinosa

    VP, Strategic Partnerships

    Leads Blue Goat's channel and partner network across MedTech consulting, regulatory, and technology firms. A former cardiac stepdown nurse, she brings a bedside view of how device security failures reach patients - and uses it to shape partnerships that keep clinical risk, not just compliance, at the center of every engagement.

    Connect on LinkedIn
    Headshot of Kristy Kennedy, VP, Sales at Blue Goat Cyber

    Kristy Kennedy

    VP, Sales

    Global commercial leader focused on medical device and life sciences. 25+ years helping MedTech manufacturers commercialize regulated products - from Class II device launches to distributor and OEM partnerships - now applied to helping device makers scope FDA-aligned cybersecurity engagements without slowing their submission timeline.

    Connect on LinkedIn
    Professional headshot of Michelle Hughes, Director of Project Management at Blue Goat Cyber - a smiling Black woman with short curly hair, wearing coral-pink top and a blue-and-white striped blazer, photographed indoors against a soft neutral background.

    Michelle Hughes

    Director of Project Management

    Drives complex MedTech cybersecurity engagements from kickoff through FDA clearance. Coordinates technical, QA, and regulatory workstreams to keep submissions moving and clients informed at every checkpoint.

    Professional headshot of Sarah Beach, Senior Project Manager at Blue Goat Cyber - a white woman with long straight auburn hair, wearing a white blouse, photographed against a plain light-gray background with a neutral expression.

    Sarah Beach

    Senior Project Manager

    Owns engagement timelines, deliverables, and FDA interactions end-to-end. Keeps threat models, pen tests, SBOMs, and submission packages on rails so engineering and regulatory teams stay aligned without surprises.

    FAQ

    FDA cybersecurity questions, answered.

    What MedTech founders, regulatory leads, and product security teams ask us most often - and how our process delivers a submission-ready cybersecurity package.

    Blue Goat in the Wild

    On stage, on the floor, and on the road

    Title Sponsor of MedTech World. Cybersecurity Sponsor for LSI. Sponsor/judge/mentor at MedTech Innovator APAC, HLTH, AdvaMed, Verge across US, EMEA, APAC.

    Reception · MedTech World Dubai
    Speaking · MedTech World
    Panel · MedTech Innovator APAC · Singapore (Judge & Mentor)
    Panel · MedTech World Dubai (DHA, EHS, Malta)
    Panel · CS Lifesciences
    Interview · MedTech World
    Interview · KPMG at MedTech World
    Booth · HLTH
    Booth · The MedTech Conference · AdvaMed
    Booth · LSI Europe (Cybersecurity Sponsor)
    Booth · 'Patient Safety, Not Only Data Protection' · MedTech World
    Sponsor Floor · MedTech World
    Partnership · Pen Testing Booth
    Partnership · Hong Kong MedTech Association
    Site Visit · Surgical Robotics Lab · Hong Kong
    Keynote · LSI Asia '26 · Singapore
    Booth · LSI Asia '26 (Cybersecurity Sponsor)
    Booth · LSI Asia '26 · Melissa on the floor
    Booth · LSI Asia '26 · Melissa and Dixie
    Gala · LSI Asia '26 · Christian and Melissa
    Gala · LSI Asia '26 · With peers and partners
    Founder · Night Ops Training
    Give back

    Programs and projects we sponsor and support

    We reinvest in the MedTech cybersecurity community by mentoring innovators and building free public resources. These are the programs and projects Blue Goat Cyber proudly sponsors or supports.

    MedTech Innovator APAC thumbnail
    Featured · Judge, sponsor & mentor

    MedTech Innovator APAC

    Judge, sponsor & mentor for APAC MedTech innovators

    Blue Goat Cyber proudly gives back to MedTech Innovator APAC as a judge, sponsor, and mentor - helping early-stage MedTech companies across the Asia Pacific region strengthen cybersecurity and FDA-readiness as they scale.

    Visit site

    About these sponsorships

    How do you choose which projects to sponsor?
    We back independent, non-commercial efforts that materially help the MedTech cybersecurity community - open educational resources, podcasts, mentorship programs, and public datasets. We prioritize projects with a clear public benefit, transparent ownership, and no conflicts of interest with our client work.
    Can my project apply for sponsorship?
    Yes. Reach out through our contact page with a short description of the project, who it serves, and what kind of support you're looking for. We review new requests on a rolling basis and respond even when we can't sponsor.
    How often is this list updated?
    We refresh the list quarterly, and immediately whenever a sponsorship starts, ends, or changes scope - so what you see here always reflects active commitments.
    Ready when you are

    Get FDA cleared without the cybersecurity headaches.

    30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.