SBOM Risk Management for Medical DevicesGoatWatch is Blue Goat's SBOM tool and risk management platform for medical device software, used on both sides of clearance. Premarket, it produces the FDA-aligned SBOM and vulnerability baseline your submission needs. Postmarket, it keeps that SBOM current, watches every component for new vulnerabilities, and tells you which ones actually matter for your device, judged against your architecture and the patient-harm pathway, not a raw severity score.
275+ FDA submissions supported · Live and in use today.
What FDA actually expects for SBOMs, vulnerability monitoring, and postmarket cybersecurity, in plain English, with templates you can use this week.
Aligned to FDA Feb 2026 guidance · v1.1
MedTech compliance standards we follow
Whether you need premarket SBOM creation or postmarket continuous monitoring, GoatWatch covers both - standalone or as part of our full postmarket service.
Import a CycloneDX or SPDX bill of materials, or have us build one. Components are normalized, version-resolved, and maintained against FDA's three-tier support taxonomy: actively maintained, no longer maintained, and abandoned.
Every component is matched against the NIST NVD and upstream supplier advisories, so a new disclosure against your dependency tree surfaces without you going looking for it.
Known Exploited Vulnerabilities are treated as a separate, higher-priority signal because FDA treats them that way. A KEV match on one of your components becomes an explicit action item.
Not every vulnerability matters equally. GoatWatch prioritizes by exploitability in your specific architecture and the patient-harm pathway, cutting the noise raw CVE feeds produce.
Vulnerabilities that do not apply are documented as not affected, with a justification. Findings, decisions, and SBOM change history are exportable as evidence for FDA postmarket and audits.
Every component is tracked against its published end-of-life date. Components approaching EOL are flagged early so you can plan a replacement before the vendor stops shipping the product entirely.
EOS dates are monitored per component, because a product that is still installed but no longer receiving security patches is a postmarket cyber risk regardless of whether a CVE exists today.
Each component is classified against the FDA's three-tier taxonomy: actively maintained, limited support, or unsupported. Level-of-support changes trigger alerts so triage and lifecycle plans stay accurate.
SBOM rigor stopped being optional the moment regulators, buyers, and attackers started asking the same question at the same time: what is actually running inside this device?
Cybersecurity is a Refuse-to-Accept criterion, not a recommendation. The Feb 2026 guidance gave reviewers a sharper checklist and stricter cross-reference rules.
No SBOM, no submission. Reviewers screen for it before the 180-day clock starts.
Hospitals increasingly require current SBOMs and MDS2 forms as a condition of purchase, often as RFP-gating items before contracts move forward.
Buyers now ask for the SBOM alongside the price sheet.
Ripple20, Log4Shell, Curl CVE-2023-38545, and the XZ Utils backdoor each touched hundreds of device models. Manufacturers without SBOMs spent weeks just checking exposure.
When the next CVE lands, an SBOM turns weeks of scrambling into hours of triage.
The submission artifacts reviewers look for, a live checklist to score your readiness, and a component inventory view that mirrors what ships in every GoatWatch account.
The FDA's Feb 2026 guidance maps each artifact to an eSTAR v7.0 cybersecurity slot. Missing or contradictory ones are the most common cause of AI-letter delays.
CycloneDX 1.5+ / SPDX 2.3+
Supplier, component, version, PURL/CPE, hash, dependency graph, author, timestamp
Hand-edited JSON; missing hashes or transitive deps.
Table or appendix
Level of Support (LOS), End of Support (EOS), End of Life (EOL) per component
No LOS / EOS / EOL dates for OSS or COTS dependencies.
VEX (CycloneDX VEX or CSAF)
CVE ID, CVSS, affected component + version range, VEX status, justification
Stale CVE lookup; no VEX status at submission.
Narrative per finding
Exploitability in device context, patient-harm pathway, residual risk, compensating controls
Generic 'not exploitable' with no device or harm context.
SPDF + architecture view
Delivery channel, cadence, authentication, rollback, evidence patches reach fielded devices
No evidence patches actually reach fielded devices.
FDA expects SBOM rigor before clearance - and continuous vigilance after launch. GoatWatch covers both sides of the lifecycle.
Vendor stops selling or producing the component. Existing installs may keep running.
Vendor stops issuing security patches or fixes. This is where postmarket risk quietly accumulates.
FDA's Feb 2026 three-tier signal: actively maintained, limited, or unsupported. Regulators key on this.
Build a complete, FDA-aligned SBOM before you submit. We help you validate component data, resolve unknowns, and produce a baseline cybersecurity risk assessment that holds up under review.
After clearance, your SBOM keeps working. GoatWatch monitors every component daily, prioritizes exploitable risks, and gives you the evidence trail regulators expect.
Upload or generate your SBOM - we support CycloneDX, SPDX, and custom formats.
GoatWatch maps every component to known CVEs, vendor advisories, and end-of-life status.
Post-launch, receive prioritized alerts when new vulnerabilities affect your device.
Generate audit-ready reports for FDA postmarket submissions and compliance reviews.
The sequence we use with clients starting from a blank slate on a single device line.
Inventory build systems, identify third-party components and firmware blobs, choose SBOM format (CycloneDX 1.5+ preferred).
Deliverable · Signed inventory of build systems, chosen SBOM format decision memo.
Inventory build systems, identify third-party components and firmware blobs, choose SBOM format (CycloneDX 1.5+ preferred).
Deliverable · Signed inventory of build systems, chosen SBOM format decision memo.
Integrate SBOM generation into CI/CD. Validate completeness against build artifacts. Produce the first VEX baseline.
Deliverable · Reproducible SBOM emitted per build + first VEX baseline (CycloneDX VEX or CSAF).
Integrate SBOM generation into CI/CD. Validate completeness against build artifacts. Produce the first VEX baseline.
Deliverable · Reproducible SBOM emitted per build + first VEX baseline (CycloneDX VEX or CSAF).
Stand up daily CVE ingestion against the SBOM. Define triage criteria, severity thresholds, and named owners.
Deliverable · Daily CVE feed wired to the SBOM, written triage SOP with named owners.
Stand up daily CVE ingestion against the SBOM. Define triage criteria, severity thresholds, and named owners.
Deliverable · Daily CVE feed wired to the SBOM, written triage SOP with named owners.
Implement versioning and retention. Document the process in a Cybersecurity Management Plan (eSTAR v7.0 Slot 8).
Deliverable · Versioned SBOM archive + Cybersecurity Management Plan document (eSTAR v7.0 Slot 8).
Implement versioning and retention. Document the process in a Cybersecurity Management Plan (eSTAR v7.0 Slot 8).
Deliverable · Versioned SBOM archive + Cybersecurity Management Plan document (eSTAR v7.0 Slot 8).
Run a tabletop exercise on a simulated CVE. Refine the playbook. You are now defensibly compliant.
Deliverable · Completed tabletop exercise report + refined incident-response playbook.
Run a tabletop exercise on a simulated CVE. Refine the playbook. You are now defensibly compliant.
Deliverable · Completed tabletop exercise report + refined incident-response playbook.
A side-by-side look at what you actually get with med-device-specific SBOM risk management.
What SBOM ownership looks like when the monitoring, triage, and evidence layer is doing the work for you.
Every component re-checked every day against NVD, CISA KEV, and vendor advisories. No quarterly gaps.
Triage that used to take a security engineer weeks of spreadsheet work is ready the same shift.
Postmarket reporting artifacts assembled continuously. Pull the pack when the FDA, an auditor, or a customer asks.
LOS, EOS, and EOL changes flag the day the vendor publishes them, not the day a reviewer spots them.
Most SBOM platforms put you in a multi-month onboarding queue. We start this week.
Talk directly with a senior medical device cyber expert. We learn your device, SBOM status, and postmarket risk profile - no sales reps.
We ingest your existing SBOM (SPDX/CycloneDX) or generate one. Components are normalized, version-resolved, and mapped to your device context.
GoatWatch goes live, tracking CVEs, vendor advisories, and EOL/EOS/LOS notices. Triage rules tuned to your risk profile, alerts routed to your team.
Vulnerability timelines, triage decisions, remediation actions, and SBOM change history - exportable for FDA, notified bodies, and internal QMS.
"GoatWatch gave us visibility into our SBOM risks that we simply didn't have before. When the FDA asked about our postmarket surveillance process, we had audit-ready evidence on day one."
VP of Regulatory Affairs
Class III Medical Device Manufacturer
"We used to track CVEs in spreadsheets, and it was a nightmare. GoatWatch's device-context triage means we focus on real threats, not noise. It has been a game-changer for our team."
Director of Product Security
Connected Health Platform
"Blue Goat handled our premarket SBOM analysis and transitioned us seamlessly into GoatWatch for postmarket monitoring. The continuity from submission to surveillance is exactly what we needed."
Head of Quality & Compliance
Surgical Robotics Company
GoatWatch is one piece of our full medical device cybersecurity offering.
30 minutes with a senior medical device cybersecurity expert. We'll review your SBOM, scope ongoing monitoring, and send a fixed-fee quote in 24 hours.
