Debunking the Top 5 Medical Device Cybersecurity Myths

Cybersecurity in the medical technology (MedTech) industry is a topic that often creates confusion and misconceptions. Many leaders in the space are uncertain about the actual risks, responsibilities, and best practices associated with securing connected devices and healthcare networks.

To help clear the air, we sat down with Christian Espinosa, CEO and Founder of Blue Goat Cyber, at the MedTech World Asia 2025 conference in Singapore. In a candid “Mythbusters” session with Shara Layton from MedTech World, Christian tackled the biggest cybersecurity myths holding back innovation in the MedTech industry.

Why this matters

The stakes for medical device cybersecurity are critically high. Cyberattacks can disrupt patient care, compromise sensitive health data, and even endanger lives through device malfunction or inaccessibility. Regulatory bodies, including the FDA, increasingly emphasize cybersecurity throughout the medical device lifecycle. The FDA "Cybersecurity in Medical Devices" Final Guidance, dated February 3, 2026, mandates that manufacturers establish a secure by design framework, including detailed documentation for premarket submissions. This guidance underscores the necessity of continuous risk management, vulnerability assessments, and robust incident response planning. Adherence to standards like IEC 60601-1-10 (Medical electrical equipment – Part 1-10: General requirements for basic safety and essential performance – Collateral Standard: Requirements for the development of physiologic closed-loop controllers), ISO 14971 (Medical devices – Application of risk management to medical devices), and AAMI TIR57 (Principles for medical device security, Risk management) is not merely good practice but essential for ensuring device safety and market viability. Ignoring these realities poses significant risks to manufacturers, healthcare providers, and patients.

Myth #1: If It’s FDA Cleared, It Must Be Secure

The first myth Christian debunked was the notion that if a medical device is cleared by the FDA, it must be secure from a cybersecurity standpoint. As he explained, “FDA clearance just means you’ve met the minimum requirements for the FDA, but there are still additional things you should do.”

In fact, Christian pointed to a recent case where a company “basically falsified their submission to the FDA” for a genetic sequencing device. “They got approved and then a whistleblower came forth to say they falsified the submission and this device…was really not secure at all,” he said. “So there was a false assumption that it’s secure because people can slide things through the FDA to get approved without actually doing the security.”

The takeaway is clear: FDA clearance is not a guarantee of cybersecurity. Medical device manufacturers must go above and beyond the minimum regulatory requirements to ensure their products are truly secure.

Myth #2: Hackers Don’t Target Medical Devices, They’re After Banks

The second myth Christian debunked was the idea that hackers aren’t interested in targeting medical devices, and are instead focused on attacking banks and other financial institutions.

“Hackers often don’t target anything specifically,” he explained. “They have malicious software that is propagating the internet looking for a vulnerable target. And if the vulnerable target happens to be a medical device, then that device is going to be compromised often with something called ransomware.”

The reason medical devices are attractive targets, according to Christian, is that they are often connected to hospital networks, which he described as “a hostile network” that is “always under attack.” Hackers know they can hold these critical devices for ransom, forcing hospitals and patients to pay up in order to regain access and functionality.

So the reality is that medical devices are very much in the crosshairs of cybercriminals. Manufacturers and healthcare providers can’t afford to be complacent about security, assuming they won’t be targeted.

Myth #3: Only Hospitals Need to Worry, Not Device Manufacturers

The third myth Christian tackled was the idea that only hospitals need to worry about medical device cybersecurity, not the manufacturers themselves.

“Device manufacturers need to worry because if there’s an issue with their device, somebody hacks into let’s say a surgical robot and that robot causes somebody to be paralyzed or kills a patient, who do you think is going to be liable?” he said. “It’s going to be the hospital a little bit, but it will go back to the medical device manufacturer as well.”

Beyond the legal liability, Christian also pointed out that compromised devices can severely damage a manufacturer’s brand and business. “It’s not going to be good for their brand if their devices are compromisable, which will hurt their business as well,” he explained.

The bottom line is that medical device manufacturers have a critical responsibility to ensure their products are secure. They can’t simply pass the buck to the hospitals and healthcare providers using their technology.

Myth #4: AI Will Solve Cybersecurity Risks Automatically

The fourth myth Christian debunked was the notion that artificial intelligence (AI) will automatically solve cybersecurity risks in the medical technology space.

“AI, we like to think it will help with cyber security, but it actually introduces a lot of issues with cyber security,” he said. “The reality is it’s kind of like AI versus AI. The people trying to defend their environments utilize AI, but those trying to attack the environments also employ AI. So, it’s basically which group is better at training AI, the attackers or the people producing the product and the people trying to defend their device?”

Christian pointed to a real-world example to illustrate the dangers of over-relying on AI in healthcare applications: “There was a case not too long ago where, with a counseling app or therapy app a suicidal patient was getting counseled by the AI chatbot, and at some point the AI chatbot told the patient to go ahead and kill themselves. The patient killed themselves, and now the family is suing that company because we like to think about AI in terms of when it gets things right, but not when it gets things wrong. But in a medical device or healthcare use case, when it gets to something wrong, the consequences can be pretty dire like the one I just mentioned.”

The key takeaway is that while AI can be a powerful tool in the fight against cybercrime, it’s not a silver bullet. MedTech leaders must approach AI-powered security solutions with caution and a clear understanding of the risks.

Myth #5: Cybersecurity Slows Down Innovation

See also: Why Medical Device Cybersecurity Is Nothing Like Enterprise, How Can Medical Device Manufacturers Support Operational, and Navigating the Cybersecurity Landscape for MedTech.

The final myth Christian debunked was the idea that cybersecurity slows down innovation in the medical technology industry.

“The lack of cybersecurity slows down innovation,” he said. “And that that’s a good myth because people often think that but from our experience when medical device manufacturers don’t consider cyber security and they try to do a submission then it’s slowed down because they have to go try to retroactively add cyber security to their device whereas if they would have designed it in their device at the beginning it would have actually sped up their time to market.”

In other words, proactively building security into the design and development process can actually accelerate a medical device’s path to market, rather than slowing it down. Trying to bolt on security after the fact is what really creates delays and complications.

The Path Forward: Awareness, Accountability, and Proactive Security

Christian’s myth-busting insights underscore the pressing need for greater awareness, accountability, and proactive security measures in the medical technology industry.

As he noted, “I feel like it’s an awareness challenge in Metech.” Too many MedTech leaders are operating under false assumptions about the cybersecurity landscape and their own responsibilities. Raising awareness and educating the industry is a critical first step.

But awareness must also be coupled with a clear sense of accountability. Medical device manufacturers can no longer pass the buck to hospitals and healthcare providers. They have a duty to ensure their products are secure, both to protect patients and to safeguard their own brands and businesses.

Finally, the key to success is taking a proactive, security-first approach to innovation. As Christian emphasized, “if they would have designed it in their device at the beginning it would have actually sped up their time to market.” Embedding security into the entire product lifecycle, from design to deployment, is the best way to mitigate risks without slowing down progress.

To learn more about Blue Goat Cyber’s cybersecurity services for medical device manufacturers, schedule a Discovery Session.

Key Takeaways:

• FDA clearance does not guarantee cybersecurity for medical devices.
• Hackers actively target medical devices, often using ransomware to extort them.
• Medical device manufacturers, not just healthcare providers, are responsible for securing their products.
• AI-powered security solutions have limitations and risks that must be carefully managed.
• Proactively designing security into medical devices can actually accelerate innovation, rather than hinder it.

Select all squares with buses If there are none, click skip

Table of Contents

• Myth #1: If It’s FDA Cleared, It Must Be Secure
• Myth #2: Hackers Don’t Target Medical Devices, They’re After Banks
• Myth #3: Only Hospitals Need to Worry, Not Device Manufacturers
• Myth #4: AI Will Solve Cybersecurity Risks Automatically
• Myth #5: Cybersecurity Slows Down Innovation
• The Path Forward: Awareness, Accountability, and Proactive Security
• Key Takeaways:

How Blue Goat approaches this

Our approach to medical device cybersecurity emphasizes proactive integration and compliance assurance. We don't just identify vulnerabilities; we partner with manufacturers to embed security through the entire product development lifecycle, aligning with FDA requirements for premarket submissions. Our team, composed of experts holding certifications like CISSP and OSCP, including ex-military red team personnel, brings a unique blend of offensive and defensive security expertise to anticipate threats and build resilient devices. We conduct thorough threat modeling, penetration testing, and risk assessments tailored specifically for medical devices. Our commitment extends to regulatory success: if the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost. We provide strategic guidance and technical execution to ensure your devices meet and exceed regulatory expectations, facilitating a smoother path to market. Explore our premarket cybersecurity services to ensure compliance and strengthen device security. Learn more at https://bluegoatcyber.com/services/fda-premarket-cybersecurity-services.

FAQ

Does FDA clearance mean a medical device is cyber-secure?

No, FDA clearance indicates a device meets minimum regulatory requirements, but it does not guarantee complete cybersecurity. Manufacturers must implement security measures beyond these minimums.

Do hackers target medical devices?

Yes, hackers frequently target medical devices. They exploit vulnerabilities in connected devices, often deploying ransomware, because these devices are critical and connected to healthcare networks.

Are medical device manufacturers responsible for cybersecurity?

Yes, medical device manufacturers bear significant responsibility for the cybersecurity of their products. Liability for security failures can extend to manufacturers, and compromised devices harm their brand and business.

Can AI solve all medical device cybersecurity risks?

AI can assist with cybersecurity, but it does not solve all risks automatically. Attackers also use AI, and erroneous AI decisions in medical contexts can lead to severe consequences.

Does cybersecurity slow down medical device innovation?

A lack of cybersecurity often slows innovation. Integrating security from a product's initial design phase can accelerate time to market, as it avoids retrofitting security measures later.