Blue Goat Cyber logoBlue Goat CyberSMMedical Device Cybersecurity
    ⌘K

    Press kit: AI/ML SaMD Security: Year in Review

    Vulnerabilities, FDA expectations, and real-world findings on AI-enabled medical devices.

    Media contact

    Email press@bluegoatcyber.com for interviews, custom data cuts, or fact-check requests. We respond same-day for active stories. Lead author for this report: .

    Quote-ready findings

    • "Pending legal review."

    Charts

    Free to re-use with attribution. Reach out to media@bluegoatcyber.com for high-resolution chart exports.

    FDA deficiency themes for AI/ML SaMD submissions

    internal extract pending

    Share of AI/ML deficiencies by content area.

    Pending data extract - chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber AI/ML SaMD deficiency subset, 2026. · Unit: % of deficiencies

    Penetration test findings on AI/ML SaMD

    internal extract pending

    Share of findings by category (model supply chain, prompt injection, data poisoning, classic web/API).

    Pending data extract - chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber AI/ML SaMD penetration test subset, 2026. · Unit: % of findings

    2026 CVEs in ML inference stacks affecting MedTech

    internal extract pending

    Count of CVEs disclosed in 2026 by ML framework.

    Pending data extract - chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Public CVE disclosures, 2026, filtered to ML inference frameworks. · Unit: CVEs

    Predetermined Change Control Plan coverage in AI/ML submissions

    internal extract pending

    Share of AI/ML submissions including a PCCP that addressed cybersecurity-relevant changes.

    Pending data extract - chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber AI/ML SaMD submission subset, 2026. · Unit: % of submissions

    Model supply chain SBOM completeness

    internal extract pending

    Share of AI/ML SBOMs that include training-data provenance, model-weight provenance, and inference-runtime version.

    Pending data extract - chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber AI/ML SBOM subset, 2026. · Unit: % of SBOMs

    Citation

    Blue Goat Cyber. (2026). AI/ML SaMD Security: Year in Review. https://bluegoatcyber.com/research/ai-ml-samd-security-year-in-review-2026

    Canonical report URL: https://bluegoatcyber.com/research/ai-ml-samd-security-year-in-review-2026

    Back to full report