Everything below is approved for publication. For interviews or expert comment on FDA medical device cybersecurity, contact Melissa Espinosa at info@bluegoatcyber.com.
Blue Goat is a medical device cybersecurity firm based in Scottsdale, Arizona. Founded in 2022, it supports medical device manufacturers with cybersecurity consulting, threat modeling, SBOM services, penetration testing, and premarket submission documentation. Its work connects technical security evidence with patient safety and manufacturer decisions. 275+ FDA submissions supported, zero cybersecurity rejections. The firm aims to help secure 1,000 devices by 2028.
One package for applicable FDA cybersecurity documentation, threat modeling, SBOMs, testing, and submission support.
Device, firmware, app, and cloud testing for FDA submissions.
FDA-aligned threat models that identify risks early and speed approvals.
Generate and verify SBOMs, component details, and vulnerability evidence.
Cybersecurity evidence and technical responses for FDA correspondence.
Continuous compliance, monitoring, and vulnerability response.
Full FDA premarket cybersecurity package for Software as a Medical Device - cloud, mobile, and web SaMD.
Defend AI/ML SaMD against adversarial attacks - and meet FDA's PCCP, GMLP, and 2025 AI-enabled device guidance.
Full list on the services page.
Christian Espinosa, MBA, is the founder and CEO of Blue Goat Cyber. He speaks on FDA premarket and postmarket cybersecurity, SBOM obligations, and secure product design at MedTech events in the US, Europe and Asia, and hosts the Med Device Cyber Podcast. More on the About page and media page.
Please don't alter the logos. Credit photos to Blue Goat Cyber.
All releases are on the news page. Outside coverage is on the press page.
To book Christian Espinosa for a keynote, panel, or workshop, email info@bluegoatcyber.com. More on the talks and events pages.
Melissa EspinosaVP, Strategic Partnerships30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.
