Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity
    ⌘K

    Vulnerability Research

    MedTech Vulnerability Landscape Report

    The most common vulnerabilities found in medical device penetration tests, broken out by device class.

    Forthcoming. This page reflects the methodology and structure of an upcoming report. Numeric findings and charts will be published after the analyst extract and legal review are complete. Press contacts can request early access at [email protected].
    Trevor Slattery, COO at Blue Goat Cyber

    By Trevor Slattery

    COO · Blue Goat Cyber

    Published: June 15, 2026 · Last reviewed: June 15, 2026

    Executive summary

    This report quantifies which classes of vulnerabilities medical device manufacturers are most likely to ship — and how the pattern shifts across device categories. The goal is to give product teams a triage map: where to invest hardening effort first based on their device class.

    Findings are drawn from anonymized engagement reports across penetration tests and threat-led security assessments completed between 2022 and 2025.

    Pending analyst extract and legal review — numeric findings will be populated before the public release.

    Methodology

    Sample
    Penetration test engagements completed 2022–2025.
    Time period
    January 2022 – December 2025
    Inclusion criteria
    • Engagements that produced a final report delivered to the client.
    • Findings classified to a CWE category by the testing engineer at delivery time.
    • Engagements covering medical devices, embedded MedTech accessories, or SaMD applications.
    Limitations
    • Sample is not random; engagements were initiated by clients seeking pre-submission testing.
    • Severity ratings reflect Blue Goat Cyber's internal CVSS-aligned rubric, not a third-party score.
    • Device-class buckets approximate FDA product code groupings but are not 1:1.
    Anonymization
    • All client and product names removed before analysis; records are keyed by an internal study ID.
    • Device-specific identifiers (510(k) numbers, De Novo numbers, UDIs) stripped from the source dataset.
    • Findings reported only at aggregate level; minimum cell size of 5 to prevent re-identification.
    • Free-text deficiency excerpts paraphrased; no verbatim FDA correspondence is reproduced.

    Key findings

    1. 1. Most common CWE family across all device classes.

      internal extract pending

      Pending extract.

    2. 2. Cardiac vs. surgical robotics show distinct vulnerability profiles.

      internal extract pending

      Pending extract.

    3. 3. Average critical-severity findings per engagement.

      internal extract pending

      Pending extract.

    Charts

    All charts are free to re-use with attribution to Blue Goat Cyber. Each chart has an embed-friendly URL — see the press kit for the iframe snippet.

    Top 10 CWE categories across all engagements

    internal extract pending

    Share of total findings by CWE family.

    Pending data extract — chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber penetration test dataset, 2022–2025. · Unit: % of findings

    Findings per engagement by device class

    internal extract pending

    Average findings per engagement, broken out by device class and severity.

    Pending data extract — chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber penetration test dataset, 2022–2025. · Unit: findings per engagement

    Severity distribution of findings

    internal extract pending

    Share of findings rated Critical, High, Medium, or Low.

    Pending data extract — chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber penetration test dataset, 2022–2025. · Unit: % of findings

    BLE/RF findings by device class

    internal extract pending

    Average BLE or radio findings per engagement, by device class.

    Pending data extract — chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber BLE/RF testing subset, 2022–2025. · Unit: findings per engagement

    Most common vulnerable components observed in SBOMs

    internal extract pending

    Share of analyzed SBOMs containing a known-vulnerable version of the listed component.

    Pending data extract — chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber SBOM analysis dataset, 2023–2025. · Unit: % of SBOMs

    Average remediation time by severity

    internal extract pending

    Median days from finding disclosure to client-confirmed remediation.

    Pending data extract — chart will render once the analyst team and legal review approve the underlying numbers.

    Source: Blue Goat Cyber retest dataset, 2022–2025. · Unit: days (median)

    Cite this report

    Blue Goat Cyber. (2026). MedTech Vulnerability Landscape Report. https://bluegoatcyber.com/research/medtech-vulnerability-landscape-2026

    Sources & references

    Primary sources cited in this article. Links open in a new tab.

    1. FDA — Cybersecurity in Medical Devices (Premarket Guidance, 2023)— FDA
    2. AAMI TIR57 — Principles for Medical Device Security: Risk Management— AAMI
    3. MITRE CWE — Common Weakness Enumeration— MITRE
    4. NVD — National Vulnerability Database— NIST
    Ready when you are

    Want a deeper briefing on these findings?

    We host private analyst briefings for journalists, investors, and MedTech regulatory teams.