How a medical device penetration test runs

1. Kickoff

A project manager is assigned and we set up Slack and secure file shares.

2. Intake

IFU, architecture, hazard analysis, and threat model. We can build the threat model if you do not have one.

3. Readiness review

Week 1 checks before testing starts.

4. Logistics

Test setup, devices, and travel if needed.

5. Testing

Device, radios, app, cloud, and update path.

6. Tear sheet

Early findings so fixes can start.

7. Full report

Findings traced to threats and controls.

8. Unlimited retests

We retest until uncontrolled risks are closed.

What the graphic says