For medtech startups

Your first FDA cybersecurity submission, scoped at a fixed fee

If your device has software and can connect, the FDA will expect a threat model, SBOM, security testing and a postmarket plan. Tell us about your device and we'll scope the work.

What the package covers

Threat model and cybersecurity risk assessment
Architecture views
SBOM with known-vulnerability review
Penetration testing, with retests until findings close
Postmarket vulnerability plan
Submission documentation mapped to eSTAR

How it works

1
Send the form
Tell us about your device and when you plan to file.
2
Short scoping call
We learn the architecture, interfaces and what already exists.
3
Fixed-fee scope
You get a written fixed-fee scope within 24 hours of the call.

Fixed fee, a project manager, a shared Slack channel and in-house testing. 275+ devices supported. A penetration test for a simple device with no travel starts at about $15,000.

Still planning? Read medical device cybersecurity for startups or the early-stage readiness checklist.

Get my fixed-fee scope

Tell us about your device and target filing date. We reply within one business day and send a fixed-fee scope within 24 hours of a short scoping call.