Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

SPDF· Jun 25, 2026

CI/CD Security Gates for Medical Devices

How to wire SAST, SBOM, secrets, container, and signature gates into a medical-device CI/CD pipeline so the SPDF produces the evidence FDA reviewers.

#SPDF#CI/CD#DevSecOps

Read article

Compliance· Jun 23, 2026

FDA Cybersecurity Failure Consequences

What happens if you fail an FDA cybersecurity inspection: the 483-to-consent-decree enforcement ladder and the commercial fallout for device makers.

#FDA#Postmarket#Enforcement

Read article

Compliance· Jun 23, 2026

Documenting Update Cadence for an FDA

How to document update cadence for an FDA §524B submission: the regular cycle and the out-of-cycle expedited path reviewers expect under §524B(b)(2)(B).

#Section 524B#Premarket#Patching

Read article

Compliance· Jun 23, 2026

Does FDA 524B Apply to Legacy Medical Devices?

FDA Section 524B applies to any new premarket submission for a cyber device, including legacy platforms.

#Section 524B#Legacy Devices#Postmarket

Read article

SDLC· Jun 23, 2026

SPDF vs SSDLC: What Medtech Teams Get

SPDF vs SSDLC for medical devices. Why the FDA's Secure Product Development Framework demands more than a standard Secure SDLC, and what to add.

#Primer

Read article

Pricing· Jun 20, 2026

Medical Device Cybersecurity Cost (2026)

What medical device cybersecurity actually costs in 2026: four cost drivers, fixed-fee vs hourly pricing, and premarket vs postmarket budget lines.

#Pricing#Budget#FDA

Read article

FDA· Jun 18, 2026

SPDF and IEC 62304 Mapping: FDA Cyber

How SPDF activities map to IEC 62304 software lifecycle processes - the exact crosswalk FDA reviewers expect, where they overlap, and where 62304 falls.

#SPDF#IEC 62304#FDA

Read article

Postmarket· Jun 18, 2026

H-ISAC and Medical Device Threat

The threat intelligence sources medical device manufacturers should monitor to satisfy FDA Section 524B postmarket obligations: H-ISAC, CISA KEV, ICS.

#H-ISAC#Threat Intelligence#CISA KEV

Read article

Compliance· Jun 18, 2026

FDA Section 524B Subsections Explained

A subsection-by-subsection walkthrough of FDA Section 524B for cyber medical devices: what §524B(a), (b)(1), (b)(2), (b)(3), (b)(4), and (c) require.

#Section 524B#FDA#Premarket

Read article

Compliance· Jun 18, 2026

CAPA and Medical Device Cybersecurity

How to run CAPA for medical device cybersecurity findings: when a vulnerability or FDA deficiency triggers a CAPA, and what evidence closes it out.

#CAPA#QMSR#FDA

Read article

Risk Management· Jun 18, 2026

FMEA vs Threat Modeling for Medical

FMEA covers random and systematic failure modes; threat modeling covers adversarial action.

#FMEA#Threat Modeling#ISO 14971

Read article

Compliance· Jun 18, 2026

HHS 405(d) HICP Practice #9 for 524B

How HHS 405(d) and the Health Industry Cybersecurity Practices (HICP) Medical Device Security practice maps to FDA Section 524B artifacts, and how.

#HHS 405(d)#HICP#FDA

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.