Vulnerability sources
- Blue Goat
- NVD + CISA KEV + vendor advisories + ICS-CERT
- NVD-only scanner + spreadsheet
- NVD feed only, no KEV prioritization
- In-house
- Whatever someone remembers to check
Postmarket Vulnerability Management
Postmarket Vulnerability Management
Run a defensible postmarket vulnerability program for your in-market devices, CVD intake, SBOM monitoring, VEX updates, patch governance, and FDA reporting, built and operated by a senior US-based team.
Postmarket vulnerability management services for medical devices, SBOM monitoring, VEX, CVD, and FDA reporting.
Request a written scope instead- Fixed fee after scoping
- Defined deliverables
- Manufacturer-reviewed evidence
275+ FDA submissions supported, zero cybersecurity rejections.
Last updated
Included in your agreed scope
- Continuous SBOM monitoring (NVD + CISA KEV)
- VEX drafts for manufacturer review on every triage
- Coordinated vulnerability disclosure (CVD) program
- Patch + emergency update decision framework
- FDA reporting assessment and drafting support
- Quarterly written program reviews
Trusted by medical device teams worldwide
Lifecycle scope
What's in your postmarket vulnerability program
The proposal identifies included deliverables, exclusions, manufacturer inputs, and review responsibilities for this engagement.
01
Continuous SBOM monitoring (GoatWatch)
Your shipping SBOM (SPDX or CycloneDX) matched daily in GoatWatch, our postmarket platform, against NVD, CISA KEV, and vendor advisories. New CVEs triaged within an SLA you set.
02
VEX on every triage
VEX communicates affected, not affected, fixed, or under investigation status when supported by device-specific evidence and manufacturer review. A CVE match alone does not determine status.
03
CVD program operations
Public disclosure policy, security@ intake, triage workflow, researcher comms, and CVE coordination, modeled on ISO/IEC 29147 and 30111.
04
Patch + update governance
Decision framework for emergency patches, planned updates, and end-of-support, every decision logged with rationale and risk justification.
05
FDA postmarket reporting
Assess reporting under 21 CFR Parts 803 and 806, including applicable exceptions and enforcement discretion. We provide technical assessment and drafting support; the manufacturer owns reportability and submission decisions.
06
Fixed fee, no per-CVE billing
Monthly retainer or annual fixed fee. Quarterly written program reviews. No surprise invoices when a busy CVE month hits.
Illustrative security checks
Evidence areas reviewed during onboarding
These are program review areas, not predicted findings or a completion-time promise. Device evidence determines which concerns apply.
Active CISA KEV entries affecting shipped components
Check shipped component versions against KEV entries. Investigate applicability and patient-harm context before assigning a VEX status or remediation priority.
SBOM drift between shipped firmware and design history
The SBOM submitted to the FDA doesn't match what's actually on devices in the field. Detected by comparing build manifests to a sampled device pull.
End-of-support components still in production
OpenSSL, BusyBox, or Linux kernel branches past vendor EOS but still in current builds. Triggers a 524B(b)(1) patch-delivery question whether the FDA asks or not.
No public security@ or CVD policy page
Check the public reporting contact and internal intake ownership. Agree escalation, acknowledgment, and disclosure responsibilities.
What happens after you book the call
- 1Scoping
Review your devices and program
Discuss architecture, available records, access, responsibilities, and target dates. Agree confidential handling before transferring device material.
- 2Proposal
Agree deliverables, fee, and dates
The proposal identifies included work, exclusions, manufacturer inputs, and delivery milestones. The 24-hour quote turnaround is separate from delivery, remediation, and review time.
- 3Ongoing
Operate and review
Monitor the agreed device inventory and vulnerability sources. Support triage, evidence-based VEX, disclosure, and patch decisions within agreed response times. The manufacturer approves risk and reporting decisions.
"Thoroughly enjoyed working with Blue Goat Cyber! Very knowledgeable and professional. Would work with again without hesitation!"
Blue Goat Cyber vs. the alternatives
What you actually get versus an NVD-only scanner with a spreadsheet, or stitching it together internally.
SBOM-driven triage
- Blue Goat
- Device-specific assessments; optional approved VEX
- NVD-only scanner + spreadsheet
- CVE list with no exploitability context
- In-house
- Manual lookups per CVE
Patch governance
- Blue Goat
- Risk-ranked, owner-assigned, SLAs tracked
- NVD-only scanner + spreadsheet
- Email blasts, no follow-through
- In-house
- Ad-hoc, often missed
Evidence exports
- Blue Goat
- Narrative and audit log on agreed cadence
- NVD-only scanner + spreadsheet
- Raw scanner exports
- In-house
- Built before each audit
Pricing model
- Blue Goat
- Fixed-fee program, predictable
- NVD-only scanner + spreadsheet
- Per-CVE or per-alert invoicing
- In-house
- Unbudgeted FTE time
| Capability | Blue Goat Cyber | NVD-only scanner + spreadsheet | In-house |
|---|---|---|---|
| Vulnerability sources | NVD + CISA KEV + vendor advisories + ICS-CERT | NVD feed only, no KEV prioritization | Whatever someone remembers to check |
| SBOM-driven triage | Device-specific assessments; optional approved VEX | CVE list with no exploitability context | Manual lookups per CVE |
| Patch governance | Risk-ranked, owner-assigned, SLAs tracked | Email blasts, no follow-through | Ad-hoc, often missed |
| Evidence exports | Narrative and audit log on agreed cadence | Raw scanner exports | Built before each audit |
| Pricing model | Fixed-fee program, predictable | Per-CVE or per-alert invoicing | Unbudgeted FTE time |
Support matched to your scope
Your team approves vulnerability assessments, VEX statements, updates, and reporting decisions. Monitoring and response dates are agreed in the program scope.
Mutual NDA before the call
We sign a mutual NDA before the initial call so you can share device details, architecture, and FDA correspondence freely.
Fixed-fee quote within 24 hours of the call
The quote identifies deliverables, assumptions, and dates. Quote turnaround is separate from the time needed to deliver the work.
Senior US engineers, fixed fee
Senior-led cybersecurity work within the agreed scope. Your team reviews the evidence and owns risk, release, and submission decisions.
Common questions
What is the smallest first step?
The free 30-minute call. A senior engineer reviews your fielded devices, SBOM coverage, and current process with you and flags the gaps. You get a written scope and fixed-fee quote within 24 hours, with no commitment.
What does the fixed fee cover?
One monthly or annual fee for the agreed device scope: daily SBOM monitoring in GoatWatch against NVD, CISA KEV, and vendor advisories, triage of new CVEs against device evidence, VEX drafts for your review, CVD intake, the patch decision framework, FDA reporting assessment and drafting support, and a written program review every quarter. No per-CVE billing, so a busy month costs the same. Remediation engineering and reportability decisions stay with the manufacturer.
Do we need a CVD policy if no researcher has ever contacted us?
Covered cyber-device submissions require a plan including CVD and related procedures. A published policy and discoverable intake channel support implementation; absence of a public URL alone does not establish a statutory violation.
How fast do you triage a new CVE against our SBOM?
Response times are agreed for your device inventory and vulnerability priorities. Initial triage, investigation, engineering remediation, disclosure, and reporting have separate responsibilities and milestones.
Can you take over our existing program or do we have to start over?
Take over. We review your current CVD policy, SBOM, triage history, and FDA correspondence, then bridge to the operating model on a fixed schedule.
Do you handle FDA postmarket reporting yourselves or coach our team?
Either. We draft the report, your regulatory team submits, or we coach your team through it. Both are in scope.
Is there a per-CVE charge if it's a busy month?
No. Fixed monthly retainer or annual fixed fee, no per-CVE billing, busy months and quiet months cost the same.
Are your engineers US-based?
Yes. Senior US-based medical device cybersecurity team. No offshoring.
Who you're talking to
Christian Espinosa, Founder & CEO
MBA, CISSP · U.S. Air Force Academy graduate · 30+ years in cybersecurity
Christian leads the senior medical device cybersecurity team behind 275+ FDA submissions supported, zero cybersecurity rejections. Author of three books including Medical Device Cybersecurity: An In-Depth Guide.
Need a postmarket vulnerability program?
30-minute call with a senior medical device cybersecurity expert. Fixed-fee program quote within 24 hours of the call. Fixed-fee retainer, no per-CVE billing.
Replies in 1 business dayMutual NDA firstUS-based senior engineerNo sales pitch