Six questions mapped to the SPDF and FDA premarket guidance. Get a planning-grade scope, depth, and timeline - then a tailored proposal.
For medical devices, both Blue Goat and the FDA recommend white-box testing. Reviewers expect testers to leverage source, firmware, and threat models - black-box alone routinely leads to deficiencies.
| Capability | Black-box | Gray-box | White-box |
|---|---|---|---|
| Source code access | |||
| Firmware / binaries | |||
| Threat model & architecture | |||
| Authenticated test paths | |||
| Deep logic + business-flow flaws | |||
| Aligned with FDA expectations | |||
| Scope coverage per test-day |
Premarket guidance and consensus standards both expect testers to leverage source code, design artifacts, and threat models, not just an external view of the device.
Calls for security testing that demonstrates device resilience using design documentation, threat models, and source-level analysis, not black-box probing alone.
Requires sponsors to provide reasonable assurance that the device and related systems are cybersecure - which reviewers read as evidence-backed, white-box-informed testing.
Frames security testing as an output of threat modeling and architecture analysis. That is white-box by definition.
Postmarket monitoring and vulnerability handling assume testers have access to internals - the same access white-box pen testing uses premarket.
The estimator gives you a planning number. These resources help you sharpen scope before kickoff.
2-minute self-assessment to score your submission against current FDA guidance.
Read FDA cybersecurity readiness quizOur SPDF-aligned methodology, deliverables, and reviewer-ready report format.
Read Medical device penetration testingSTRIDE-based modeling - the input that lets a pen test test the right things.
Read Threat modeling servicesFull SPDF + eSTAR-ready submission package aligned to FDA guidance.
Read FDA premarket cybersecurityQuantify what every week of submission slip costs in revenue and runway.
Read Cost-of-delay calculatorOur recommended depth for medical devices - and the FDA's preference. Full source, firmware, and threat-model access for deeper findings.
Read White-box penetration testingHow we plan, execute, and report - designed for FDA reviewer scrutiny.
Read Pen testing methodology