Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

Medical Device Security· Aug 1, 2026

Linux vs Windows for Medical Devices: Security Comparison

Embedded Linux vs Windows IoT Enterprise LTSC for medical devices: attack surface, isolation, secure boot, patching, SBOM, and what FDA reviewers actually look at.

#Operating Systems#Embedded Linux#Windows IoT

Read article

FDA· Jul 30, 2026

Indications for Use, Predicates, and Cybersecurity Scope

How your Indications for Use statement and predicate choice change the cybersecurity scope of a 510(k): use environment, harm ceiling, pen test scope, and Special 510(k) eligibility.

#FDA#510(k)#Indications for Use

Read article

FDA· Jul 30, 2026

Breakthrough Device Designation and Cybersecurity

Breakthrough Device designation speeds FDA interaction but waives no cybersecurity requirement. Here is how Section 524B applies to Breakthrough devices in 2026.

#FDA#Breakthrough Devices#Section 524B

Read article

FDA· Jul 25, 2026

510(k) Cleared but No Postmarket Cybersecurity: Are You Breaking the Law?

Cleared under Section 524B but skipping postmarket cybersecurity? Here's what statute, regs, and FDA enforcement actually say - across 510(k), De Novo, PMA, PDP, and HDE.

#FDA#Postmarket#Section 524B

Read article

Compliance· Jul 23, 2026

Premarket Cybersecurity in Your QMS: ISO 13485 & QMSR

Where FDA premarket cybersecurity artifacts live in an ISO 13485 / QMSR quality system: DHF, risk management file, DMR, and postmarket - clause-by-clause map.

#QMSR#ISO 13485#FDA

Read article

Compliance· Jul 23, 2026

CLIA Lab Cybersecurity: HIPAA & 21 CFR Part 11 (2026)

Cybersecurity for CLIA high-complexity labs: HIPAA, 21 CFR Part 11 data integrity, LIMS hardening, vendor patching, AI/cloud analytics, and CMS/CAP inspection readiness.

#CLIA#HIPAA#21 CFR Part 11

Read article

Privacy· Jul 23, 2026

De-identification vs Anonymization: HIPAA & GDPR

De-identification vs anonymization for medical devices: HIPAA Safe Harbor, GDPR Recital 26, and what the FDA expects for AI/ML training data and postmarket telemetry.

#HIPAA#GDPR#De-identification

Read article

FDA· Jul 23, 2026

Types of 510(k): Traditional, Special, Abbreviated

The three types of 510(k) - Traditional, Special, and Abbreviated - explained side by side, with the cybersecurity implications of each under Section 524B.

#FDA#510(k)#Traditional 510(k)

Read article

FDA· Jul 22, 2026

Q-Sub vs Pre-Sub: FDA Cybersecurity Guide

Q-Sub vs Pre-Sub for FDA cybersecurity: what they are, how they differ, and when to use a Pre-Submission to de-risk Section 524B threat models, SBOMs, and pen tests.

#FDA#Pre-Sub#Q-Sub

Read article

Standards· Jul 21, 2026

AAMI SW96 vs TIR57: Did SW96 Replace It?

AAMI SW96 didn't formally replace TIR57, but SW96 is now the FDA-recognized normative standard. Here's what changed and what the FDA expects in 2026.

#AAMI SW96#AAMI TIR57#FDA

Read article

FDA· Jul 21, 2026

FDA SIR Cybersecurity Response: eSTAR Prep Guide

FDA Submission Issue Request (SIR) response strategy for cybersecurity: eSTAR prep checklist, common 524B gaps, and how to answer without restarting review.

#FDA#eSTAR#Cybersecurity

Read article

FDA· Jul 10, 2026

Medical Device Pen Testing: FDA vs EU MDR 2026

Medical device pen testing under FDA vs EU MDR: the 5 FDA report elements, MDR Annex I §17.2/17.4, and how one report serves both submissions.

#FDA#EU MDR#Penetration Testing

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.