Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

FDA· Jul 10, 2026

Medical Device Pen Testing: FDA vs EU MDR 2026

Medical device pen testing under FDA vs EU MDR: the 5 FDA report elements, MDR Annex I §17.2/17.4, and how one report serves both submissions.

#FDA#EU MDR#Penetration Testing

Read article

FDA· Jul 10, 2026

Mining FDA Databases for Cybersecurity Precedent

A five-source workflow (510(k), De Novo, PMA, MAUDE, FOIA) for mining FDA cybersecurity precedent by product code before a Section 524B filing.

#FDA#510(k)#De Novo

Read article

Compliance· Jul 10, 2026

FDA PCCP Beyond AI: Cybersecurity, Firmware Uses | Blue Goat

The FDA PCCP guidance isn't AI-only. Use a predetermined change control plan for cybersecurity patches, firmware updates, and SBOM component swaps.

#PCCP#Section 524B#Firmware

Read article

Fundamentals· Jul 7, 2026

When to Start Medical Device Cybersecurity

You're two years into product development and still "not ready" for cybersecurity? You're already late. When to start medical device cybersecurity, by phase.

#Primer

Read article

Standards· Jul 7, 2026

How SPDF Maps to IEC 81001-5-1 Activities

A phase-by-phase mapping of the FDA's SPDF onto IEC 81001-5-1 activities, so dual FDA + EU submissions produce one artifact set instead of two.

#Primer

Read article

Standards· Jul 7, 2026

IEC 81001-5-1 vs IEC 62304 for Medical Devices

IEC 62304 governs the software lifecycle. IEC 81001-5-1 adds security activities on top. Here's what each covers, where they overlap, and how they combine for the FDA and EU.

#Primer

Read article

Standards· Jul 7, 2026

How JSP2 and MDS2 Fit Together for Medtech

JSP2 is a development framework, MDS2 is a procurement disclosure form. Here's how the two artifacts complement each other across the device lifecycle.

#Primer

Read article

Standards· Jul 7, 2026

JSP2 vs SPDF vs IEC 81001-5-1: Framework Pick

The FDA lists JSP2, SPDF, IEC 81001-5-1, and ISA/IEC 62443-4-1 as acceptable cybersecurity frameworks. Here's how to actually pick one for your submission.

#Primer

Read article

Fundamentals· Jul 7, 2026

Medcrypt vs Finite State vs Blue Goat Cyber

Choosing between MedCrypt, Finite State, and Blue Goat Cyber? Compare SBOM tools, vulnerability management, and FDA-required pen testing for your medical device

#Primer

Read article

FDA· Jul 2, 2026

Premarket FDA Cybersecurity Checklist

The premarket FDA cybersecurity submission checklist medical device teams use to pass 510(k) and PMA review under Section 524B and the 2026 guidance.

#Primer

Read article

AI & ML· Jun 29, 2026

FDA AI Cybersecurity Threats: 7 Attacks

The FDA's Feb 3, 2026 guidance names 7 AI cyber threats, data poisoning, model inversion, evasion, leakage, overfitting, bias, drift, as 524B obligations.

#AI & ML#FDA#Section 524B

Read article

Compliance· Jun 26, 2026

Does Section 524B Apply to My

Section 524B applies to a connected auto-injector when the device constituent has software and any electronic interface, regardless of whether CDER or CDRH leads review.

#Section 524B#Combination Products#Auto-Injector

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.