The Goat Feed is the MedTech cybersecurity feed of record. Every item links to a primary source. Every Notable or Critical item carries a short analyst note from Blue Goat Cyber Research. When we get something wrong, we log the correction publicly. This page documents exactly how that works.
Every row in the feed traces back to one of these primary sources. Each card shows the ingest cadence, the scope we keep, which feed categories the source can populate, and how severity is decided.
Scope - Entries whose vendor/product/CVE text matches our MedTech vendor list or device-relevant software stack (operating systems, runtimes, comms libraries, common OT components).
Severity - Always Critical - active in-the-wild exploitation by definition.
Scope - Every ICS-MA advisory; no filtering. These are inherently device-relevant.
Severity - Notable by default. Upgraded to Critical when paired with a KEV add or active exploitation.
Scope - All safety communications; cyber-flagged items elevated.
Severity - Critical when the communication is cyber-flagged. Notable for material device safety issues with a cyber angle. Info otherwise.
Scope - All device recall events; classification used to derive severity.
Severity - Class I → Critical. Class II → Notable. Class III → Info. Recalls referencing firmware/software defects are tagged Software Quality.
Scope - Filtered to connected, software, AI/ML, or device categories with a known cyber surface (no purely mechanical clearances).
Severity - Info by default. Tagged 524B when the clearance falls under Section 524B cyber device scope (signal for future postmarket monitoring).
Scope - Adverse event reports with cyber-related keywords (unauthorized access, malware, ransomware, network outage, integrity failure, etc.) in narrative text.
Severity - Notable when the report describes a confirmed cyber signal. Info for ambiguous software-quality reports flagged for review.
Scope - Field Safety Notices and National Patient Safety Alerts for medical devices.
Severity - Notable for cyber-relevant FSNs. Info for general device alerts referenced for context.
Scope - Newly published CVEs whose CPE strings match our MedTech vendor list.
Severity - Notable when CVSS ≥ 7.0 or EPSS percentile ≥ 90. Info otherwise. Upgraded to Critical on subsequent KEV add.
Scope - New or revised TIR57, TIR97, SW68, SW96, and related MedTech security standards.
Severity - Notable for new or revised standards with binding-by-reference impact. Info for drafts and committee notes.
Scope - International Medical Device Regulators Forum publications, including the IMDRF cybersecurity working group.
Severity - Notable for final documents. Info for consultation drafts.
Coverage roadmap: BfArM / ANSM / Swissmedic ingest, FDA 483 inspection findings, and deeper EPSS-driven CVE triage are scheduled additions. The legacy short-form sources list is preserved below for citation.
Direct links to the primary upstream feeds and endpoints we pull from, for citation and independent verification.
Every item gets one of three severities at ingest. Severity is recomputed if the underlying signal changes (e.g. a CVE moves to KEV, a recall is upgraded).
The Blue Goat take is the analyst note that appears under Notable and Critical items. It is the editorial value-add that distinguishes this feed from a raw aggregator.
Every material edit to a published item is logged with the field changed, the before and after, and the reason. Items with a logged correction show a Corrected badge. If you spot something wrong, tell us and we will correct it and credit you on request.
Source suggestions, corrections, and tips: research@bluegoatcyber.com.
Notable and critical items from the past seven days, with the Blue Goat take included.
