Nine steps from the first call to an FDA-ready cybersecurity package, and support after you submit. Here's what happens at each step, what we need from you and what we do.
The short answer
You book a free strategy call, get a fixed-fee proposal, and meet your project manager at kickoff. You send your IFU, architecture, threat model, and hazard analysis. We build the deliverables and test the device, you fix what we find, and we retest. You get an FDA-ready package, and if the FDA raises a cybersecurity deficiency on our work, we help you respond at no extra cost.
Before you sign
A free 30-minute call about your device, your submission type and your timeline. We tell you plainly what the FDA will expect and where the gaps are likely to be.
After a short scoping call, you get a written proposal with a fixed fee, what's included and a schedule. No hourly billing and no surprise change orders for work in scope.
Getting started
Once the contract is signed, you get a named project manager, a shared Slack channel and secure file shares. The kickoff call sets dates, contacts and how we'll report progress.
We ask for the documents that let us trace every finding and deliverable back to how the device is used and what could harm a patient. Penetration testing starts only once a threat model and hazard analysis exist, because they tell us what to test and which findings could hurt a patient.
Instructions for Use (IFU)
How the device is used and by whom
System architecture
What connects to what
Threat model
What we test against. We can build it if you don't have one.
Hazard analysis
Links each finding to patient harm
The work
Depending on scope, we build the premarket deliverables (threat model, risk assessment, SBOM, architecture views, labeling, management plan) and run a mostly manual, white-box penetration test.
You get an early tear sheet of findings so your engineers can start fixing. We retest your fixes until the findings are closed, and each one is rated for patient-harm risk, not CVSS alone.
Submission
Reports and deliverables are formatted for the FDA's February 2026 guidance and the eSTAR template, with a signed Letter of Attestation for the pen test.
If the FDA sends a cybersecurity deficiency on work we delivered, we help you respond at no extra cost. Clearance is always the FDA's decision.
After clearance
Once the device is on the market, we can monitor new vulnerabilities in your SBOM, handle disclosures and keep your management plan current.
Tell us about your device and timeline. You'll leave knowing what the FDA will expect.
