Insights

Field notes from the MedTech security trenches.

Deep dives on FDA expectations, threat modeling, penetration testing, SDLC, and the standards your team is being asked to meet.

Risk· Jun 1, 2026

CAN Bus Vulnerabilities in Medical Devices

Where CAN/CANopen shows up inside medical devices, the attack paths reviewers want modeled, and the controls that actually hold up under pen test.

#Primer

Read article

Fundamentals· Jun 1, 2026

CVSS 3.1 vs 4.0 for Medical Devices: Safety & Automatable Metrics

Why CVSS 4.0's Safety and Automatable metrics matter for patient harm, and how to handle the transition in FDA submissions and postmarket VEX statements.

#Primer

Read article

Standards· May 27, 2026

AAMI TIR57 vs TIR97 vs SW96

Medical device cybersecurity relies on AAMI TIR57, TIR97, and SW96. Understand their applications, FDA recognition, and how to use them for compliance.

#Primer

Read article

Pen Testing· May 27, 2026

Medical Device Penetration Testing Cost: 2026 Guide

Understand the factors influencing medical device penetration testing cost, from FDA requirements to device complexity. Get a transparent pricing breakdown.

#Primer

Read article

FDA· May 27, 2026

FDA Cybersecurity Review Timeline: 510(k) & De Novo Guide

Learn the actual timelines for FDA cybersecurity review. Understand 510(k) and De Novo clock stops, RTA hold periods, and how to avoid costly delays.

#Primer

Read article

FDA· May 23, 2026

510(k) Deficiencies That Trigger FDA Holds

The four cybersecurity deficiency patterns the FDA flags most often in 510(k) submissions - incomplete SBOMs, thin threat models, scoped-down pen tests.

#Primer

Read article

Fundamentals· May 23, 2026

Hire Cybersecurity Consultant vs. In-House

Understand whether to hire a medical device security consultant or build an in-house team. Evaluate costs, FDA expertise, and submission timelines.

#Primer

Read article

Fundamentals· May 22, 2026

Cybersecurity Is Now a QMS Requirement

Cybersecurity documentation belongs in the QMS, not a side folder. What MedTech teams must create, control, and maintain across the full device lifecycle.

#Primer

Read article

FDA· May 22, 2026

Q-Day: A Present-Day FDA Compliance Gap

The FDA's February 2026 premarket guidance requires cryptography that stays strong throughout a device's service life. Q-Day exposes a real compliance gap.

#Primer

Read article

FDA· May 22, 2026

FDA 483 Cybersecurity Observations on QMSR

How the FDA is using Form 483 observations to cite cybersecurity gaps under QMSR and 21 CFR 820, with recent examples and how manufacturers should respond.

#Primer

Read article

SBOM & Supply Chain· May 17, 2026

SBOM vs VEX: What's the Difference?

SBOM vs VEX explained for medical device submissions. What each document does, how they pair, and what the FDA actually expects in your 510(k) package.

#Primer

Read article

FDA· May 17, 2026

5 VEX Mistakes That Trigger FDA Findings

Avoid common VEX mistakes that trigger FDA cybersecurity deficiencies. Learn to properly prepare your VEX for medical device premarket submissions.

#Primer

Read article

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.