Imaging & AI/SaMDClass II SaMD (De Novo)
Series-B imaging AI manufacturer (US, ~60 FTEs)
- Timeline
- 30-day FDA response window - delivered in 21 days
- Engagement team
- Lead consultant + threat-modeling engineer + SBOM/pen-test pair (4 people)
- Standards & guidance
- FDA Premarket Cybersecurity Guidance (Feb 3, 2026 final) · AAMI SW96:2023 · IEC 81001-5-1 · ISO 14971 (security harms) · AAMI TIR57
- Tech stack
- PyTorch model server behind FastAPI · DICOMweb gateway (Orthanc) · AWS (EKS, S3, KMS, Cognito) · Auth0 federated identity
Challenge
An FDA reviewer issued a cybersecurity AI Request on a De Novo submission for an AI triage SaMD, citing an incomplete threat model, a non-conformant SBOM, and missing evidence that the model-loading pipeline had been security-tested. The team had 30 days to respond, no in-house cybersecurity lead, and an investor-board commitment to a Q3 commercial launch.
Approach
- Reconstructed the threat model in Microsoft Threat Modeling Tool to AAMI SW96 expectations - 47 STRIDE threats across the DICOM gateway, model loader, inference API, and clinician web app, each traced to a 14971 harm and a control
- Generated an FDA-compliant CycloneDX 1.5 SBOM for the entire model-serving stack, including transitive Python wheels and the CUDA/cuDNN runtime; mapped 312 components against KEV and EPSS
- Ran an authenticated gray-box pen test against the SaMD REST API, the DICOMweb endpoints, and the model-loader (pickle deserialization, model substitution, prompt-injection-style adversarial inputs)
- Drafted the deficiency response narrative aligned line-by-line to the reviewer's questions, with a cross-reference matrix back to the SPDF evidence package
Outcome
- Deficiency cleared in
- 21 days
- Final submission outcome
- De Novo granted
- Additional reviewer rounds
- 0
- High/critical pen-test findings closed before response
- 100%
Deliverables
- 47-threat STRIDE model with traceability matrix to ISO 14971 harms
- CycloneDX 1.5 SBOM (312 components) + vulnerability disclosure sheet
- Pen test report with 3 highs / 11 mediums and remediation guidance
- FDA AI Request response letter (12 pages) with evidence appendices
- Updated SPDF cybersecurity plan and postmarket monitoring SOP
What we'd tell the next team
- Pickle-based model loading is the single most common cyber finding we see in PyTorch SaMDs - swap to safetensors before submission, not after
- Reviewers want to see the SBOM tied to a vulnerability triage process, not just an inventory - KEV + EPSS scoring closes that loop
- Threat models written without explicit harm mapping read as security theater; SW96 traceability is what moves a reviewer
"We had three weeks to respond and no playbook. Blue Goat dropped in, took ownership of the cyber section, and we cleared on the next round."