Blue Goat Cyber^SMMedical Device Cybersecurity

Where are you right now?

Designing the device

We need security built in before the FDA asks for it.

Medical Device Threat Modeling
Secure MedTech Product Design

Getting ready to submit

We need a complete, FDA-ready cybersecurity package.

Full-Service FDA Premarket Cybersecurity
Medical Device Penetration Testing
FDA-Compliant SBOM Services

Got an FDA deficiency letter

The FDA flagged our cybersecurity and the clock is ticking.

FDA Deficiency Response

Passing hospital security reviews

Hospitals won't buy until we pass their security review.

MedTech Compliance Bundle
HIPAA Penetration Testing

Already on the market

We need to stay compliant and handle new vulnerabilities.

FDA Postmarket Cybersecurity
MedTech Cybersecurity Advisory
Legacy Device Protection

Investors and acquirers

We need to know if the target's cybersecurity will hold up with the FDA.

Cybersecurity Due Diligence

Not sure? Answer two questions See all services

Readiness quiz2-min score Scope estimatorTest-day range Cost of delayROI calc

Blue Goat products

GoatWatchSBOM risk management for medical devices

Learn

Blog
Podcast
Webinars
Talks & workshops
Glossary
FAQs

Playbooks & Tools

Guides
Playbooks (PDF)
Infographics
Interactive Tools

Signals & Proof

Goat FeedNew
News
Medical Device Security News
The Goat's Weekly
Case Studies
Proof / Receipts

All resources, topic hubs, & collections →

Book Strategy Session How to prepare →

CVSS 4.0 at a glance, with a medical device example - Infographic

All infographics

Threat Modeling

CVSS 4.0 at a glance, with a medical device example

The four CVSS 4.0 metric groups and a worked infusion pump example that scores 8.7 High.

Infographic of CVSS 4.0 Base, Threat, Environmental, and Supplemental metric groups, plus an illustrative infusion pump vulnerability with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N scoring 8.7 High. — The base score is a starting point. Add Threat and Environmental metrics for how your device is actually deployed.

Download the graphic Talk through it with us

What the graphic says

The full text version, so the content is readable without the image.

The four metric groups

Base (required): Exploitability (AV, AC, AT, PR, UI), vulnerable system impact (VC, VI, VA), and subsequent system impact (SC, SI, SA).
Threat (optional): Exploit maturity (E), which updates the score as attacks appear.
Environmental (optional): Security requirements (CR, IR, AR), modified base metrics, and a Safety value for subsequent integrity and availability.
Supplemental (no effect on score): Safety, Automatable, Recovery, Value density, Response effort, and Provider urgency.

Worked example (illustrative)

An infusion pump on the hospital network accepts unauthenticated commands over its local service port. An attacker on the same network segment can change settings or stop the pump.

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Score: 8.7, High (CVSS-B, base metrics only).

Source: FIRST CVSS v4.0 specification. Score computed with the same engine as our calculator.

Keep reading

Free CVSS v4.0 calculator
CVSS score for medical devices
CVSS 3.1 vs 4.0 for medical devices

More in Threat Modeling

Infographic: the four threat modeling questions - what are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job - each with the artifacts it produces.

Part 1

Underneath it all, four questions

Infographic: the nine-step medical device threat modeling workflow mapped to the four questions, from scoping and the DFD through STRIDE, attack trees, controls, testing, and the residual risk QA gate.

Part 2

Four questions, nine steps

Infographic chain of seven steps: threat, vulnerability, CIA loss, hazardous situation, harm rated per ISO 14971, security control, and verification, with shared IDs on every row.

Part 3

Cybersecurity hazard analysis: from threat to harm to control

Infographic of a device, phone app, and cloud separated by trust boundaries, with six STRIDE cards: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, each with the property it breaks and a device example.

STRIDE threats on a connected medical device

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.

Book strategy session Explore services

Full-service medical device cybersecurity. We protect patients and accelerate FDA clearance for connected medical devices.

275+ Devices Supported · Mission: 1,000 by 2028

SDVOSB · Service-Disabled Veteran-Owned Small Business

We sponsor 10 community projects →

Services

Full-Service FDA Premarket Cybersecurity
FDA Deficiency Response
Medical Device Threat Modeling
Medical Device Penetration Testing
FDA Postmarket Cybersecurity
All services →

Services

Full-Service FDA Premarket Cybersecurity
FDA Deficiency Response
Medical Device Threat Modeling
Medical Device Penetration Testing
FDA Postmarket Cybersecurity
All services →

Company

About
Core values
Manifesto
Leadership
Why Us
Partners
Careers
Press
Contact
Company overview PDF

Company

About
Core values
Manifesto
Leadership
Why Us
Partners
Careers
Press
Contact
Company overview PDF

Resources

Blog
Guides
Podcast
Case studies
Monthly Pulse newsletter
All resources →

Resources

Blog
Guides
Podcast
Case studies
Monthly Pulse newsletter
All resources →

Get in touch

info@bluegoatcyber.com
844-939-GOAT
Book a strategy session →
1776 N Scottsdale Rd, Unit 727
Scottsdale, AZ 85257Serving clients worldwide

Follow

© 2026 Blue Goat Cyber. All rights reserved.

Privacy
Terms
Cookies
Sitemap
Accessibility
CVD

MedTech Cybersecurity · Since 2022