Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

Pen Testing· Jun 3, 2026

Fuzz Harness Generation for Medical

How to build FDA-defensible fuzz harnesses for the protocols medical devices actually speak.

#Primer

Read article

FDA· Jun 3, 2026

SBOM Diffing & CVE Correlation Postmarket

How to operationalize SBOM diffing and CVE correlation across releases so postmarket vulnerability monitoring holds up under FDA Section 524B and the Feb.

#Primer

Read article

Penetration Testing· Jun 3, 2026

FDA & AI Pen Testing for Medical Devices

What the FDA's Feb 2026 premarket cybersecurity guidance says (and doesn't say) about AI-run penetration testing, where AI helps, where it fails a 524B.

#Penetration Testing#AI#FDA

Read article

FDA· Jun 3, 2026

FDA Cybersecurity Major vs Minor

How the FDA distinguishes Major from Minor cybersecurity deficiencies in 510(k) and PMA reviews, the response-window difference, and how to keep findings.

#Primer

Read article

FDA· Jun 3, 2026

PMA Supplement Cybersecurity Changes

Which PMA submission type a cybersecurity change requires - 180-day supplement, Real-Time, Special, 30-day notice, or annual report - and the decision.

#Primer

Read article

FDA· Jun 3, 2026

De Novo Cybersecurity Requirements

How cybersecurity expectations apply to De Novo submissions under Section 524B - SPDF, SBOM, threat model, testing - and where De Novo differs from.

#Primer

Read article

Standards· Jun 3, 2026

IEC 81001-5-1 vs AAMI SW96 Compared

IEC 81001-5-1 vs AAMI SW96 compared side-by-side: scope, lifecycle vs risk focus, FDA recognition, and which to anchor your Secure Product Development.

#Primer

Read article

FDA· Jun 2, 2026

FDA Penetration Testing Requirements

What the FDA's Feb 2026 premarket guidance actually requires for medical device penetration testing - what's inside a real pen test, what's separate.

#FDA#Penetration Testing#Section 524B

Read article

FDA· Jun 2, 2026

Letter to File vs New 510(k)

When a cybersecurity change to a cleared device stays as a letter to file in the DHF, and when it forces a new 510(k). Decision framework and examples.

#FDA#510(k)#Section 524B

Read article

FDA· Jun 2, 2026

Special vs Traditional 510(k)

When the FDA accepts a Special 510(k) for cybersecurity changes - BLE, firmware signing, Secure Boot, SBOM swaps - and when it pushes you to Traditional.

#FDA#510(k)#Section 524B

Read article

SBOM & Supply Chain· Jun 1, 2026

SBOM EOS, EOL & LoS for FDA 524B

EOS vs EOL vs Level of Support in your medical device SBOM: what Section 524B requires, how to express it in CycloneDX and SPDX, and how to defend it.

#SBOM#FDA#Section 524B

Read article

Pen Testing· Jun 1, 2026

BLE & RF Penetration Testing

What a real BLE/RF penetration test on a Class II connected medical device actually finds. Aligned with the FDA's Feb 3, 2026 premarket cybersecurity.

#Primer

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.