Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

FDA· May 22, 2026

Q-Day Isn't a Future Problem for Medical Devices. It's a Present-Day FDA Compliance Gap.

The FDA's February 2026 premarket guidance already requires cryptography strong throughout a device's service life. For 10-20 year implants, that means post-quantum crypto — today.

#FDA#Premarket#Post-Quantum Cryptography

Read article

FDA· May 22, 2026

Cybersecurity Is Now a QMS Requirement: What MedTech Teams Need to Document, Control & Maintain

Cybersecurity documentation belongs in the QMS, not a side folder. What MedTech teams must create, control, and maintain across the full device lifecycle.

#FDA#QMSR#QMS

Read article

FDA· May 22, 2026

Cybersecurity on an FDA 483: What Inspectors Are Citing Under QMSR

How the FDA's Form 483 is being used to cite cybersecurity gaps under QMSR and 820.35 — the observations inspectors write, and how to close them before a Warning Letter.

#FDA#QMSR#Form 483

Read article

SBOM· May 17, 2026

5 VEX Mistakes That Trigger FDA Cybersecurity Deficiencies

The 5 VEX document mistakes we see the FDA flag in cybersecurity deficiency letters — and exactly how to fix each one before you submit.

#SBOM#VEX#FDA

Read article

SBOM· May 17, 2026

SBOM vs VEX: What's the Difference? (Medical Device Guide)

SBOM vs VEX explained for medical device submissions. What each document does, how they pair, and what the FDA actually expects in your 510(k) package.

#SBOM#VEX#FDA

Read article

FDA· May 15, 2026

FDA Deficiency Letter vs RTA vs Hold Letter: What's the Difference?

FDA Deficiency Letter, RTA, and Hold Letter explained side-by-side. What each one means, the clock impact, and how to respond without losing months.

#FDA#Deficiency Response#510(k)

Read article

FDA· May 14, 2026

FDA Cybersecurity Review Timeline: What to Expect in 2024

Learn the actual timelines for FDA cybersecurity review. Understand 510(k) and De Novo clock stops, RTA hold periods, and how to avoid costly delays.

#FDA#Premarket#510(k)

Read article

FDA· May 10, 2026

Preparing Your eSTAR 510(k) Cybersecurity Documentation

What FDA reviewers expect in eSTAR Section Q: SBOM, threat model, SPDF evidence, pen test reports, and a traceability matrix that survives RTA screening.

#FDA#eSTAR#510(k)

Read article

Threat Modeling· May 8, 2026

Brainjacking: The Real Cyber-Physical Threat to NeuroTech

Brainjacking is the unauthorized control of an implanted neurostimulator. We unpack the attack vectors, clinical consequences, and what manufacturers must build into DBS, SCS, and BCI products.

#Threat Modeling

Read article

FDA· Apr 10, 2026

Postmarket Cybersecurity for Medical Devices: The FDA Roadmap

FDA clearance is the beginning of your cybersecurity obligations, not the finish line. Postmarket cybersecurity for medical devices is an active, continuous requirement that most manufacturers underestimate until a problem forces their hand. Most invest significant resources building premarket docum

#FDA#Postmarket

Read article

Pen Testing· Apr 10, 2026

Medical Device Pen Testing: Choosing the Right Provider

When penetration test reports are vague, incomplete, or written to enterprise IT standards rather than medical device requirements, FDA reviewers issue deficiencies that can delay clearance, sometimes requiring a full re-test before you can respond. If you're selecting a provider for medical device

#Pen Testing

Read article

FDA· Apr 10, 2026

How to Respond to an FDA Cybersecurity AI Request

Receiving an FDA cybersecurity Additional Information Request (AIR) doesn't mean your submission is dead. It means the clock is ticking, and the next move has to be precise. FDA issues these requests when reviewers find specific, documented gaps in your cybersecurity package, and they expect every g

#FDA#AI

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ submissions.