Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

FDA· Jun 3, 2026

FDA Cybersecurity Deficiencies in PMA Submissions: AI Requests, Major Deficiencies, and Complete Response Letters

How the FDA flags cybersecurity gaps in PMA submissions - RTF, Major Deficiency, Approvable, and Complete Response Letters for combination products - and how to respond.

#FDA#PMA#Deficiency Response

Read article

FDA· Jun 3, 2026

PMA Supplement vs Real-Time vs 30-Day Notice for Cybersecurity Changes

Which PMA submission type a cybersecurity change requires - 180-day supplement, Real-Time, Special, 30-day notice, or annual report - and the decision logic under Section 524B.

#FDA#PMA#Premarket

Read article

FDA· Jun 3, 2026

FDA Cybersecurity Major vs Minor Deficiency: How Reviewers Grade Findings

How the FDA distinguishes Major from Minor cybersecurity deficiencies in 510(k) and PMA reviews, the response-window difference, and how to keep findings out of the Major column.

#FDA#Deficiency Response#510(k)

Read article

FDA· Jun 3, 2026

De Novo Cybersecurity Requirements: What the FDA Expects

How cybersecurity expectations apply to De Novo submissions under Section 524B - SPDF, SBOM, threat model, testing - and where De Novo differs from 510(k) and PMA.

#FDA#De Novo#Premarket

Read article

Standards· Jun 3, 2026

IEC 81001-5-1 vs AAMI SW96: Which Standard for Your SPDF?

IEC 81001-5-1 vs AAMI SW96 compared side-by-side: scope, lifecycle vs risk focus, FDA recognition, and which to anchor your Secure Product Development Framework on.

#Standards#IEC 81001-5-1#AAMI SW96

Read article

FDA· Jun 2, 2026

FDA Penetration Testing Requirements for Medical Devices

What the FDA's Feb 2026 premarket guidance actually requires for medical device penetration testing - what's inside a real pen test, what's separate dev/CI work, and the 5 required report elements.

#FDA#Penetration Testing#Section 524B

Read article

FDA· Jun 2, 2026

Letter to File vs New 510(k) for Cybersecurity Changes

When a cybersecurity change to a cleared medical device stays as a letter to file in the DHF, and when it forces a new 510(k). Decision framework, gray-zone cases, and Section 524B stakes.

#FDA#510(k)#Section 524B

Read article

FDA· Jun 2, 2026

Special vs Traditional 510(k) for Cybersecurity Changes

When the FDA accepts a Special 510(k) for cybersecurity changes - BLE, firmware signing, Secure Boot, SBOM swaps - and when it pushes you to Traditional. With a decision tree and Pre-Sub strategy.

#FDA#510(k)#Section 524B

Read article

SBOM & Supply Chain· Jun 1, 2026

SBOM End-of-Support, EOL, and Level of Support: What the FDA Expects

EOS vs EOL vs Level of Support in your medical device SBOM — what Section 524B requires, how to express it in CycloneDX and SPDX, and how to defend it in a Feb 2026 FDA submission.

#SBOM#FDA#Section 524B

Read article

Standards· May 23, 2026

MedTech Cyber Standards Every Device Team Must Know

The seven MedTech cyber standards FDA reviewers expect - FDA premarket guidance, IEC 62304, ISO 14971, AAMI TIR57, UL 2900, IEC 62443, IEC 81001-5-1 - and how to map them as one program.

#Standards#IEC 62304#ISO 14971

Read article

Fundamentals· May 23, 2026

Medical Device Security Testing: The Complete Taxonomy

Security testing for medical devices is not one thing. A practical breakdown of SAST, DAST, SCA, fuzz, penetration testing, and threat model validation - and how the FDA expects them to fit together.

#Fundamentals#Security Testing#Pen Testing

Read article

Fundamentals· May 23, 2026

OT vs IT Security: 7 Differences That Actually Matter

Operational technology and information technology share terminology but operate under fundamentally different constraints. A practical breakdown of the seven differences that matter for medical device manufacturers and FDA submissions.

#Fundamentals#OT Security#IEC 62443

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.