Press kit: Top FDA Cybersecurity Deficiencies: What 30+ FDA Letters Raised Most

A ranked share of the cybersecurity issues the FDA raised across 30+ Additional Information letters Blue Goat Cyber reviewed.

Media contact

Email press@bluegoatcyber.com for interviews, custom data cuts, or fact-check requests. We respond same-day for active stories. Lead author for this report: Christian Espinosa, Founder & CEO.

Quote-ready findings

"SBOM gaps appeared in 90% of the FDA Additional Information letters Blue Goat Cyber reviewed, usually missing support status, end-of-support dates, or machine-readable format rather than a missing SBOM."
"In one letter, the FDA raised the same "only a high level description was provided" finding nine separate times."
"Reviewers rejected vulnerability scanning offered in place of penetration testing."

Charts

Free to re-use with attribution. Reach out to media@bluegoatcyber.com for high-resolution chart exports.

Share of reviewed FDA letters that raised each issue

Percentage of the 30+ letters reviewed that raised each category at least once. Not a rate across all submissions.

Source: Blue Goat Cyber review of 30+ FDA Additional Information letters, read in full, 2026. · Unit: % of letters

Citation

Blue Goat Cyber. (2026). Top FDA Cybersecurity Deficiencies: What 30+ FDA Letters Raised Most. https://bluegoatcyber.com/research/fda-medical-device-cybersecurity-deficiencies-2026

Canonical report URL: https://bluegoatcyber.com/research/fda-medical-device-cybersecurity-deficiencies-2026

Back to full report