Everything below is approved for publication. For interviews or expert comment on FDA medical device cybersecurity, contact Melissa Espinosa at info@bluegoatcyber.com.
Blue Goat Cyber is a medical device cybersecurity firm based in Scottsdale, Arizona. Founded in 2014, it helps medical device makers meet FDA cybersecurity requirements under Section 524B and the FDA's February 2026 premarket cybersecurity guidance, with threat modeling, SBOMs, penetration testing, and submission documentation. The firm has supported 275+ medical devices and aims to help secure 1,000 devices by 2028.
Full-service: we own 100% of SPDF, SBOMs, threat modeling, pen testing, and eSTAR documentation.
FDA-compliant device, firmware, app, and cloud testing.
FDA-aligned threat models that identify risks early and speed approvals.
Create, validate, and maintain SBOMs for premarket and postmarket.
Got an FDA hold or AI letter? We close cybersecurity deficiencies fast.
Continuous compliance, monitoring, and vulnerability response.
Full FDA premarket cybersecurity package for Software as a Medical Device - cloud, mobile, and web SaMD.
Defend AI/ML SaMD against adversarial attacks - and meet FDA's PCCP, GMLP, and 2025 AI-enabled device guidance.
Full list on the services page.
Christian Espinosa, MBA, is the founder and CEO of Blue Goat Cyber. He speaks on FDA premarket and postmarket cybersecurity, SBOM obligations, and secure product design at MedTech events in the US, Europe and Asia, and hosts the Med Device Cyber Podcast. More on the About page and media page.
Please don't alter the logos. Credit photos to Blue Goat Cyber.
All releases are on the news page. Outside coverage is on the press page.
To book Christian Espinosa for a keynote, panel, or workshop, email info@bluegoatcyber.com. More on the talks and events pages.
Melissa EspinosaVP, Strategic Partnerships30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.
