Scoping A Medical Device Penetration Test

Part of our Medical device penetration testing series. For the full overview, start with FDA Penetration Testing Requirements for Medical Devices.

Identifying a scope for the penetration test of a medical device is a vital stage of the test plan development phase. As part of the regulations for various regulatory bodies, it is crucial to have a clear and test plan in place. This test plan covers many different aspects of what will happen during the penetration test, including the tools, personnel, and very importantly, the scope of the penetration test. Scoping is always very important in a penetration test, but it can be even more so in a medical device context.

Key Takeaways

• Define internal components and trust boundaries.
• Identify and test all external connections.
• Assess data ingress and egress points.
• Evaluate connections between trust boundaries.
• Scoping ensures regulatory compliance (e.g., FDA).
• Complete scoping protects patient safety and data.

Table of Contents

• Key Takeaways
• Identifying The Scope Of A Medical Device
• Medical Device Penetration Testing FAQs

Why this matters

The FDA's Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 3, 2026 final guidance) made cybersecurity documentation a gating criterion for clearance under Section 524B of the FD&C Act. Reviewers now apply this guidance to scoping a medical device penetration test the same way they apply software lifecycle expectations from IEC 62304 and security risk-management expectations from AAMI TIR57 and ANSI/AAMI SW96:2023.

Gaps in this area are the single most common driver of first-cycle cybersecurity Additional Information (AI) requests. The FDA's FY2024 CDRH performance reports show cybersecurity is among the top deficiency categories cited in 510(k) and PMA AI letters, behind only software documentation and clinical evidence. Treating it as a checklist exercise rather than a design-controlled engineering artifact is what creates the gap.

Identifying The Scope Of A Medical Device

During any regulatory submission, it is critical to properly identify the scope of whatever the device is. There can be a massive range of relevant components that make up a complete medical device. Many of these may have a minor enough functionality that they may not initially seem of concern, but it is vital to make sure that all bases are covered. When submitting to a regulatory body such as the FDA or the EU MDR, there will be checks during the submission review to ensure that absolutely everything has been accounted for in the system.

One part of the scope that is critical to establish is going to be the internal system and any components that make up the system. This can be considered the area inside the trust boundary, which developers know they have control over. Any components within the trust boundary control the internal operation and mechanisms of the device. Testing these components is vital, especially when patient safety and patient data are under question.

The area within the trust boundary can have many different functionalities depending on the system. This can include data storage, many different connections between these data stores, and a wide range of active processes. Testing this can be done in two different ways, with both being important for a test. The first way can be attempting to manipulate the application to compromise functionality and safety. Another important part of this is testing abuse cases, where the tester attempts to use the application to perform malicious acts.

Functionality testing will line up with more typical penetration testing. In the case of application testing, this will look for traditional web or binary vulnerabilities, depending on the specifics of the application. A large part of this testing is looking at how the application handles patient data. Patient confidentiality should be at the front of the penetration testers’ minds during testing. It can be extremely harmful if a flaw in the design of the application allows for the compromise of this data.

Outside of testing the internal area, it is often even more important to test the connections in and out of the trust boundary. These entry points into the system can be prone to many different vulnerabilities. Ensuring that the testing team has an appropriate plan in place for how they can assess the security of these entry points is the first step to ensuring that this part of the test is properly covered.

Any time data comes into or leaves the system, the way that this data is processed should be addressed. This is especially important, as the development team will be unable to control the other end of these connections. Any time something exists outside the trust boundary, it can be prone to a whole new range of vulnerabilities. Because of this, a compromise of the connected component can often lead to a compromise of the device under test.

See also: Robustness & Fuzz Testing for Medical Device Cybersecurity, Post-Exploitation Frameworks in MedTech: What Defenders Need, and 25 Use Cases for White-Box Penetration Testing.

Finally, testers should look at connections between trust boundaries. It may be the case that medical devices contain multiple connected systems with connections that are not contained in any trust boundary. These connections are subject to security risks and should be carefully evaluated. While the specifics of the connection and entry points make up the details of the test cases involved, a very typical concern is going to be anything around encryption and confidentiality in the communications.

After a clear understanding of the scope has been solidified, the next step is to test everything thoroughly. This is where the talent of skilled security professionals like those at Blue Goat Cyber comes in. Our team can assist with every step of the security process for your submission, from scope definition to testing,

How Blue Goat approaches this

Blue Goat Cyber's medical device practice is led by engineers with CISSP, OSCP, and prior military red-team backgrounds. We treat cybersecurity documentation as design-controlled engineering output, not a submission template, every artifact (threat model, SBOM, security risk assessment, penetration test, labeling) traces back to a controlled requirement and a verified result.

Our engagements deliver the full Feb 3, 2026 guidance documentation set scoped to the device's risk profile, integrated with the existing IEC 62304 software lifecycle and ISO 14971 risk file. See our medical device cybersecurity services for the full scope. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

FAQ

What is medical device penetration testing?

Medical device penetration testing is a controlled cybersecurity exercise to identify vulnerabilities in a medical device and its connected systems. Testers simulate real-world attacks to uncover security weaknesses before malicious actors can exploit them, ensuring device integrity and patient data protection.

Why is scoping crucial for medical device penetration tests?

Scoping is crucial because medical devices often involve complex ecosystems, including hardware, software, network connections, and third-party components. A well-defined scope ensures that all relevant attack surfaces are covered, meeting regulatory requirements and preventing overlooked vulnerabilities that could impact patient safety or data security.

What does the FDA require regarding medical device cybersecurity?

The FDA requires medical device manufacturers to implement secure product development lifecycle processes, conduct threat modeling, provide a software bill of materials (SBOM), and establish procedures for post-market vulnerability management and updates. These requirements, detailed in the February 3, 2026 final guidance, aim to enhance the cybersecurity of medical devices throughout their lifecycle.

How does defining trust boundaries impact a penetration test?

Defining trust boundaries helps differentiate between components controlled by the manufacturer and those outside their direct control. This distinction guides testers in prioritizing areas within the device's core system while also focusing on secure interactions with external elements, such as connected systems or third-party software.

What types of connections should be included in the scope?

The scope should include all data entry and exit points, such as wired (Ethernet, USB, serial) and wireless (Wi-Fi, Bluetooth) interfaces. It must also cover connections to external networks, cloud services, and any interfaces with other medical devices or IT infrastructure.

Can inadequate scoping affect regulatory submissions?

Yes, inadequate scoping can lead to incomplete vulnerability assessments, potentially resulting in device submissions that do not meet regulatory requirements. The FDA reviews submissions to ensure all potential risks are addressed, and a poorly scoped penetration test may fail to demonstrate a device's cybersecurity posture adequately.

About the author

Christian Espinosa, CISSP, Founder, Blue Goat Cyber. Christian leads a team focused exclusively on medical device cybersecurity for FDA premarket submissions and postmarket compliance. Read more about Christian.