Vulnerability Management Metrics for Medical Device Manufacturers (2026)

Most medical device teams already collect vulnerability data. Few can answer a simple question from a reviewer or a hospital buyer: how long does it take you to fix a serious vulnerability, and how many devices actually receive the fix?

Vulnerability management metrics answer that question with numbers. They turn a written postmarket plan into evidence that the plan works.

The FDA's Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026) recommends tracking metrics on how quickly vulnerabilities are patched and deployed. Section 524B of the FD&C Act requires cyber device manufacturers to have a plan to monitor, identify, and address postmarket vulnerabilities.

The useful question is not how many scans your team ran. It is whether identified vulnerabilities were assessed in the right device context, whether controls reduced exposure, and whether updates reached supported devices. A reporting process needs those distinctions before an average repair time means anything. Manufacturers also need to identify what they cannot measure, rather than treating missing deployment records as completed updates.

Why This Matters

The FDA's February 3, 2026 premarket cybersecurity guidance asks manufacturers to describe measures and metrics showing that vulnerabilities are identified and addressed in a timely way. Its examples include the percentage of identified vulnerabilities that are patched, the time from identification to patch, and the time from patch availability to full deployment. For PMA devices, it recommends reporting metric results in periodic reports.

The FDA's Postmarket Management of Cybersecurity in Medical Devices (December 28, 2016) describes 30-day communication and 60-day remediation conditions within a specific enforcement-discretion policy for Part 806 reporting. They are not universal deadlines or permission to wait. The policy also requires no known associated serious adverse events or deaths and active participation in an Information Sharing and Analysis Organization. Regulatory staff must assess all conditions and applicable reporting obligations.

Hospitals ask too. Their security teams review MDS2 forms and patch commitments before purchase, and they track whether manufacturers deliver.

Several standards support the same discipline. IEC 81001-5-1 covers vulnerability handling and security updates in the health software lifecycle. AAMI TIR97 addresses postmarket security risk management for device manufacturers. ISO/IEC 29147 and ISO/IEC 30111 describe vulnerability disclosure and handling processes. Select device-specific targets and document their rationale, rather than assuming one timetable fits every product.

Official sources: The FDA's February 3, 2026 premarket cybersecurity guidance, Section V.A.4 and the FDA's December 28, 2016 postmarket cybersecurity guidance, Section VII.B. The premarket guidance recommends three metric categories: patched-vulnerability percentage, time to patch, and time to field implementation to the extent known. These are guidance recommendations, not a substitute for statutory duties under Section 524B.

Which vulnerability management metrics should medical device manufacturers track?

Track a small set of metrics that cover the full lifecycle of a vulnerability: discovery, assessment, remediation, deployment, and backlog. Each one should have a clear start date, end date, and owner.

Keep the list short. Eight well-defined metrics are more useful than 30 that nobody trusts.

How should each KPI be calculated?

Define the population and reporting period before calculating a percentage. Otherwise, two teams can report the same label while measuring different things.

Record elapsed calendar days consistently. Maintain identification, triage, fix availability, and confirmed deployment dates as separate fields. Report averages where the FDA recommends them, alongside medians, oldest open items, and counts by risk level so an average does not hide a long-running exposure.

These calculations are reporting definitions, not a compliance score. Agree the population, exclusions, and data owner before comparing products or reporting trends.

How should remediation targets be set for medical devices?

Set targets by risk level, where risk combines exploitability with the potential impact on patient safety. A vulnerability with a high CVSS score in a component that cannot be reached may need less urgency than a moderate one on an exposed wireless interface that controls therapy.

A practical approach uses three or four levels tied to your security risk assessment:

• Uncontrolled risk to essential performance or patient safety. Act as quickly as possible. Have regulatory staff assess reporting duties and the conditions of the FDA's enforcement-discretion policy.
• High security risk, controlled safety risk. Set an urgency justified by exploitation, exposure, and available controls. A routine release may be too late.
• Medium or low risk. Fix on the regular update cycle documented in your 524B plan.
• No credible exploit path. Document the rationale and review it when the threat picture changes.

Check exploitation status as part of triage. A vulnerability listed in the CISA Known Exploited Vulnerabilities catalog warrants prompt device-specific review, even when its base score is moderate. A KEV listing does not itself establish device exposure, patient harm, or a new exploitability score. For how CVSS fits in, see our guide to CVSS scoring for medical devices.

Why deployment coverage matters more than release speed

Deployment coverage measures whether a released fix has reached the field. An unpatched device may remain exposed, depending on its configuration and compensating controls. A release date alone does not show that residual risk has been reduced on installed devices.

Measure coverage at fixed points after each release, such as 30, 90, and 180 days. Break it down by product version, region, and customer type when you can, because hospitals with change control boards often update slower than home users.

See also: FDA PCCP Beyond AI: Cybersecurity & Firmware Uses, FDA Section 524B Subsections Explained, and VEX Resources for Medical Device Teams: Guides and Mistakes.

If you cannot measure coverage, record it as an evidence gap. Do not invent telemetry or count unknown devices as updated. Our article on documenting update cadence for a 524B submission covers how to describe update timing for reviewers.

Separate confirmed installation, customer notification, and patch download. They are different events. Where direct telemetry is unavailable, identify whether service records or customer confirmations support the result, and state the limitations.

How SBOM monitoring connects to vulnerability metrics

SBOM monitoring coverage tells you whether your remediation numbers can be trusted. If only half of your components are checked against vulnerability sources, a short average remediation time may reflect what you did not find.

Track three things:

1. The share of SBOM components with an identifier that vulnerability databases can match, such as a CPE or package URL.
2. The time since the last automated check against sources like the NVD and the CISA KEV catalog.
3. The number of components past end of support, since routine upstream fixes may no longer be available.

Comparing SBOM versions between releases helps catch new exposure early. See SBOM diffing and CVE correlation for postmarket devices for a worked approach.

Common mistakes with vulnerability management metrics

The most common mistake is measuring activity instead of outcomes. Counting scans run or tickets opened says nothing about whether patients are safer.

Other mistakes we see often:

• Stopping the clock at release. The fix is not done until devices in the field have it.
• Averaging everything. A mean remediation time hides the one critical vulnerability left open for nine months. Report the median plus the oldest open item for each risk level.
• Using CVSS as the only priority. It ignores device context and clinical impact.
• No link to CAPA criteria. Investigate missed targets and determine whether systemic failures warrant corrective action under the manufacturer's QMS.
• Undefined start dates. Decide whether the clock starts at public disclosure, at your first awareness, or at triage, and apply it consistently.

For how these metrics fit the broader FDA framing of measures and metrics, see our cybersecurity measures and metrics guide.

Need a second set of eyes on your postmarket metrics? Our FDA postmarket cybersecurity services include a review of your vulnerability handling targets and reporting.

How Blue Goat Cyber Approaches This

We start with the vulnerability process your team actually runs. We trace how a vulnerability is reported or found, triaged, fixed, released, and deployed, and we note where each date is recorded today and where it is missing.

From there, we help define a short set of vulnerability management metrics with clear start and end points. We set remediation targets by risk level using your security risk assessment, our documented exploitability method, and your ISO 14971 safety inputs. We connect SBOM monitoring to triage so new CVEs and KEV entries are assessed against your device context, not just their base score.

We then write the metrics and targets into your cybersecurity management plan, link missed targets to your CAPA procedure, and prepare the reporting format for periodic reports and customer requests.

The manufacturer owns safety severity, risk acceptance, release decisions, and regulatory reporting. We support the cybersecurity analysis and documentation without replacing those decisions. We distinguish a confirmed fix from a mitigation, a nonaffected assessment, and an unknown status so the reporting does not overstate progress.

Blue Goat track record: 275+ FDA submissions supported, zero cybersecurity rejections. Learn more about our FDA postmarket cybersecurity services, including ongoing vulnerability monitoring and support.

Frequently Asked Questions

What are vulnerability management metrics for medical devices?

They are measurements of how well a manufacturer finds, assesses, fixes, and deploys fixes for vulnerabilities in its devices. Common examples are time to triage, time to remediate by risk level, deployment coverage on fielded devices, open vulnerability age, and SBOM monitoring coverage. Together, they show whether a postmarket cybersecurity plan works in practice.

Does the FDA require specific vulnerability management KPIs?

The FDA's February 3, 2026 guidance recommends patched-vulnerability percentage, time to patch, and time to field implementation, or equivalent information. It recommends providing available results in premarket submissions and PMA annual reports. It does not set one universal KPI target. The 2016 guidance's 30-day and 60-day conditions belong to a specific reporting enforcement-discretion policy, not every vulnerability.

Is mean time to remediate the most important metric?

Not on its own. Mean time to remediate can look good while one critical vulnerability stays open for months. Report the median time by risk level, the share of vulnerabilities fixed within target, and the oldest open item. For medical devices, deployment coverage on fielded devices is often more telling than release speed.

Should remediation priority follow CVSS scores?

CVSS is a useful input but should not decide priority alone. It does not account for how the device is used, which interfaces are reachable, or what happens to the patient if the vulnerability is exploited. Combine CVSS with exploitation status, such as a CISA KEV listing, and with your safety risk assessment.

How often should vulnerability metrics be reviewed?

Set a review cadence that fits product risk, the manufacturer's QMS, and reporting obligations. A quarterly trend review can be useful, but it is not a universal FDA requirement. Urgent findings need review when discovered, not at the next meeting. Investigate missed targets, assess CAPA criteria, and include available metric results in PMA annual reports as the FDA recommends.

CTA

Want vulnerability management metrics your team can meet and defend? We help medical device manufacturers set risk-based targets, connect SBOM monitoring, and report results. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. Schedule a discovery session.