Which services should we start with for an FDA submission?

Most premarket programs combine threat modeling, an SBOM, and penetration testing - all packaged against the FDA's 2026 premarket guidance and ANSI/AAMI SW96. We map the right starting point in the Discovery Session.

Can we engage you for just one piece, like pen testing or SBOM?

Yes. Every service is scoped and priced as a standalone engagement with a fixed fee, so you can pull in only the piece you need - or layer them into a full SPDF program.

Do you only work on premarket, or also postmarket?

Both. Premarket: pen testing, threat modeling, SBOM, deficiency response, secure-by-design. Postmarket: GoatWatch monitoring, patch and vulnerability management, legacy device cybersecurity, and CVD program support.

How do you keep services consistent across a multi-device portfolio?

We standardize the SPDF artifacts (threat model, SBOM, test plan, traceability) so they reuse cleanly across families of devices - only the device-specific risks and surfaces change.

How is the engagement priced and how long does it take?

Fixed-fee, scoped after a free 30-minute Discovery Session. Most premarket engagements (penetration testing, threat modeling, SBOM, deficiency response) complete in 4–8 weeks. We typically start within 1–2 weeks of contract signature.

What if the FDA still pushes back after we submit?

We back our work with a 100% success guarantee. If your submission is delayed because of a cybersecurity deficiency in our deliverables, we resolve it at no additional cost until your device is cleared.

Services

Cybersecurity for every stage of your device lifecycle.

Premarket through postmarket - one team, one accountable partner. Fixed-fee pricing, FDA-ready deliverables.

Premarket

26 services

FDA Submissions

Full-Service FDA Premarket Cybersecurity

Full-service: we own 100% of SPDF, SBOMs, threat modeling, pen testing, and eSTAR documentation.

Cybersecurity for every stage of your device lifecycle.

Premarket

FDA Submissions

Full-Service FDA Premarket Cybersecurity

FDA Deficiency Response

FDA-Compliant SBOM Services

Secure Design & Documentation

Secure MedTech Product Design

Medical Device Threat Modeling

AI/ML Medical Device Security

Pen Testing Methodology

Penetration Testing

Penetration Testing Services

Medical Device Penetration Testing

Device Vulnerability & Pen Testing

BLE & RF Penetration Testing

Firmware Penetration Testing

PHI Cloud Backend Penetration Testing

Black Box Penetration Testing

Gray Box Penetration Testing

White Box Penetration Testing

Application Security

Application Penetration Testing

Web Application Penetration Testing

API Penetration Testing

Mobile Application Penetration Testing

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST)

Network & Infrastructure Testing

Network Penetration Testing

Internal Penetration Testing

Wireless Penetration Testing

HIPAA Penetration Testing

Postmarket

Postmarket & Legacy

FDA Postmarket Cybersecurity

Legacy Device Protection

Stay ahead of CVEs. Audit-ready always.

Common questions about our services