From the Editor
As 2025 comes to a close, all of us at Blue Goat Cyber thank you for your trust and partnership. We know how much work and investment it takes to move a medical device from concept to clearance, and how essential cybersecurity is to protecting that effort. When done right, cybersecurity doesn't slow innovation - it safeguards it. Looking ahead to 2026, our commitment remains clear: help you bring secure medical devices to market, and keep them safe throughout their entire lifecycle. We wish you a relaxing holiday season and a successful, secure year ahead.
Where you'll find us in early 2026
JPM Healthcare Conference week (Jan 12–15, San Francisco) - Blue Goat Cyber is a Gold Sponsor of the 12th Annual QNova LifeSciences Partnering Forum at the Hilton San Francisco Union Square. MedTech World Middle East (Feb 11–13, Dubai) - CEO Christian Espinosa and VP of Strategic Partnerships Melissa Espinosa will attend alongside global innovators, investors, government leaders, and MedTech visionaries. If you'll be at either event, we'd welcome the opportunity to connect.
Regulatory Pulse: what FDA's updated cyber guidance really means
In 2023, the FDA released its first major comprehensive medical device cybersecurity guidance, followed by a June 2025 update. On February 3, 2026 the agency finalized "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" - the binding edition reviewers now enforce - explicitly linking expectations to Section 524B of the FD&C Act. By tying cybersecurity expectations directly to statute, the FDA strengthened its enforcement authority and clarified several areas that had previously caused confusion. At its core, the guidance emphasizes the need to demonstrate a "reasonable assurance of cybersecurity" as part of medical device safety - and reinforces a risk-based approach plus cybersecurity considerations across the entire device lifecycle, not just at submission. Patient safety is not synonymous with being "secure" in cybersecurity terms; a device can function as intended while still exposing patients, hospitals, or manufacturers to unacceptable risk.
MedTech & AI: what FDA's AI data tells us, and what it doesn't
AI is now embedded in the majority of newly released medical devices. In 2025, the FDA updated its AI-enabled device database to list more than 1,200 authorized devices - up roughly 300 from the prior year. Notably, none of these authorized devices currently use generative AI or large language models, despite the attention those technologies receive. Most FDA-authorized AI devices today rely on deep learning, with radiology leading the way. GenAI may eventually play a role - but introduces serious cybersecurity risks like data manipulation or poisoning that could lead to unsafe recommendations. For now, caution is warranted as global regulators continue to evolve their approach.
Looking ahead: what to watch in medical device cybersecurity in 2026
- How will enforcement evolve if regulatory agencies face staffing constraints?
- Will submissions be delayed or rejected when cybersecurity assurance appears weak or incomplete?
- How will hospitals - already stretched thin - manage increasing dependence on connected technologies?
Ask the Goat: navigating FDA cyber expectations with confidence
Q: How can Blue Goat Cyber help ensure our new connected medical device meets FDA's latest cybersecurity requirements - including "cyber device" expectations under Section 524B - so our premarket submission isn't delayed or rejected? A (The Goat): We serve as your dedicated medical device cybersecurity partner, aligning your product and documentation with FDA's latest guidance and Section 524B. We support device teams through threat modeling and security risk analysis, SBOM creation and component analysis, security architecture and documentation, and comprehensive cybersecurity and penetration testing with submission-ready reports. We also support risk control, residual risk justification, and postmarket needs such as vulnerability monitoring, SBOM monitoring, and coordinated vulnerability disclosure. With a fixed-fee, full-service model and experience supporting hundreds of FDA-regulated devices, we help reduce cyber-related deficiencies and move you through FDA review with greater confidence and predictability.