Search the Blue Goat Cyber library.
Site-wide search across services, guides, blog, podcast, news, MedTech segments, topic hubs, glossary, and pages. Use the filters to narrow scope.
Try "FDA", "threat modeling", "SBOM", "pen test", or filter by type and category.
Services36
AI/ML Medical Device Security
Defend AI/ML SaMD against adversarial attacks - and meet FDA's PCCP, GMLP, and 2025 AI-enabled device guidance.
Read service Application SecurityAPI Penetration Testing
REST and GraphQL API testing with fuzzing and auth analysis.
Read service Application SecurityApplication Penetration Testing
Thick client, thin client, mobile, and web app coverage.
Read service Penetration TestingBlack Box Penetration Testing
External, unauthenticated testing of internet-facing systems.
Read service Penetration TestingBLE & RF Penetration Testing
Wireless interface testing for BLE, Wi-Fi, Zigbee, NFC, and proprietary RF.
Read service Penetration TestingDevice Vulnerability & Pen Testing
10+ years testing medical devices for 510(k) and PMA clearance.
Read service Application SecurityDynamic Application Security Testing (DAST)
Runtime testing combined with manual penetration testing.
Read service Go-To-Market ComplianceEU Cyber Resilience Act (CRA) for Medical Devices
CRA readiness for connected medical devices: essential cybersecurity requirements, vulnerability handling, and CE-mark conformity before December 11, 2027.
Read service FDA SubmissionsFDA Deficiency Response
Got an FDA hold or AI letter? We close cybersecurity deficiencies fast.
Read service Postmarket & LegacyFDA Postmarket Cybersecurity
Continuous compliance, monitoring, and vulnerability response.
Read service FDA SubmissionsFDA-Compliant SBOM Services
Create, validate, and maintain SBOMs for premarket and postmarket.
Read service Penetration TestingFirmware Penetration Testing
Embedded firmware extraction, reverse engineering, and exploitation.
Read service FDA SubmissionsFull-Service FDA Premarket Cybersecurity
Full-service: we own 100% of SPDF, SBOMs, threat modeling, pen testing, and eSTAR documentation.
Read service Go-To-Market ComplianceGDPR for Connected Medical Devices
GDPR readiness aligned to MDR/IVDR: RoPA, Article 32 controls, DPIAs, breach response, SCCs, and DPAs.
Read service Penetration TestingGray Box Penetration Testing
Authenticated testing for insider threat and application scenarios.
Read service Go-To-Market ComplianceHIPAA Compliance Program for MedTech
End-to-end HIPAA Security Rule program for MedTech, SaMD, and digital health Business Associates.
Read service Network & Infrastructure TestingHIPAA Penetration Testing
Penetration testing scoped to HIPAA Security Rule expectations.
Read service Go-To-Market ComplianceHITRUST Readiness (e1 / i1 / r2)
HITRUST CSF readiness and certification support for MedTech selling into IDNs, AMCs, and large health systems.
Read service Network & Infrastructure TestingInternal Penetration Testing
Insider-threat simulation against your enterprise environment.
Read service Postmarket & LegacyLegacy Device Protection
Reduce risk on fielded devices - no redesign, no new submission, no downtime.
Read service Go-To-Market ComplianceMDS2 & HSCC Procurement Disclosure Service
We complete your MDS2 (Manufacturer Disclosure Statement for Medical Device Security) and HSCC procurement responses so hospital security reviews stop blocking deals.
Read service Penetration TestingMedical Device Penetration Testing
FDA-compliant device, firmware, app, and cloud testing.
Read service Secure Design & DocumentationMedical Device Threat Modeling
FDA-aligned threat models that identify risks early and speed approvals.
Read service Go-To-Market ComplianceMedTech Compliance Bundle
One program covering FDA Clearance, SOC 2, HIPAA, HITRUST, and GDPR - run in parallel for hospital-ready and EU-ready launch.
Read service Application SecurityMobile Application Penetration Testing
iOS and Android testing covering storage, network, and platform.
Read service Network & Infrastructure TestingNetwork Penetration Testing
External and internal testing of your network systems.
Read service Penetration TestingPenetration Testing Services
Black, gray, and white box testing for compliance and real-world defense.
Read service Penetration TestingPHI Cloud Backend Penetration Testing
Cloud backend testing for connected devices that store or transmit PHI.
Read service Postmarket & LegacyPostmarket SBOM Monitoring & VEX Automation
Continuous SBOM monitoring, automated VEX triage, and CAPA-ready evidence for cleared devices - so postmarket cybersecurity stops being a quarterly fire drill.
Read service Secure Design & DocumentationSaMD Cybersecurity
End-to-end FDA premarket cybersecurity package for Software as a Medical Device - cloud, mobile, and web SaMD.
Read service Secure Design & DocumentationSecure MedTech Product Design
Bake cybersecurity into your device from day one.
Read service Go-To-Market ComplianceSOC 2 Type II for MedTech
SOC 2 Type II readiness, control build, and audit support so HDO procurement stops blocking your contracts.
Read service Application SecurityStatic Application Security Testing (SAST)
Code-level vulnerability discovery to support FDA expectations.
Read service Application SecurityWeb Application Penetration Testing
Front-end, back-end, API, and mobile coverage in one engagement.
Read service Penetration TestingWhite Box Penetration Testing
Full-knowledge testing with administrator access and source code.
Read service Network & Infrastructure TestingWireless Penetration Testing
Secure your Wi-Fi and wireless attack surface.
Read serviceGuides23
10 Reasons Cybersecurity Vendors Fail MedTech
Why generic IT-security vendors keep blowing FDA submissions - and what to demand from a true MedTech specialist.
Read guide Pen Testing12 Critical Findings from Medical Device Pen Tests
Real, recurring vulnerabilities we uncover during penetration testing on Class II/III connected medical devices.
Read guide Threat Modeling12 Critical Threat-Modeling Gaps in Submissions
Where threat models fall short of FDA expectations under the 2026 cybersecurity guidance - and how to fix the gaps.
Read guide FDA12 Reasons the FDA Rejects Cybersecurity Submissions
The most common deficiencies we see in 510(k), De Novo, and PMA cybersecurity packages - and how to avoid each one.
Read guide AI/MLAAMI CR34971 Explained: AI Risk Management for Medical Devices
What CR34971 adds on top of ISO 14971, the AI-specific risk categories it covers, and how to integrate it with your existing risk file.
Read guide FDAeSTAR Cybersecurity Readiness Checklist (510(k) & De Novo)
Map every cybersecurity control to the exact eSTAR section reviewers expect. A 20-point readiness checklist for 510(k) and De Novo submissions under the FDA's February 2026 final guidance.
Read guide AI/MLFDA 2025 AI-Enabled Device Software Functions Guidance, Decoded
Plain-English breakdown of FDA's 2025 draft AI guidance: what it adds beyond PCCP and GMLP, transparency labeling expectations, and what reviewers want to see.
Read guide Deficiency ResponseFDA Cybersecurity Deficiency Letter Response Playbook
A field-tested playbook for responding to FDA cybersecurity deficiencies inside the 180-day clock - triage, gap analysis, fix sequence, and reviewer-ready format.
Read guide FDAFDA Cybersecurity Deficiency Response Checklist
Step-by-step checklist for responding to FDA cybersecurity deficiency letters without losing your submission timeline.
Read guide Threat ModelingFDA-Grade Medical Device Threat Model: Template & Worked Example
Step-by-step template to build a threat model FDA reviewers will accept - architecture views, STRIDE, safety mapping, control traceability, and a worked example.
Read guide PMAFull-Service Cybersecurity for PMA Submissions
Everything a Class III PMA cybersecurity package needs - and how a single integrated team delivers threat modeling, SBOM, pen testing, postmarket plan, and reviewer engagement.
Read guide AI/MLGMLP Crosswalk: 10 Principles to Engineering Controls
Each of the FDA/Health Canada/MHRA Good Machine Learning Practice principles mapped to concrete engineering, QMS, and documentation controls.
Read guide StandardsGTM Compliance Crosswalk: FDA + SOC 2 + HIPAA + HITRUST + GDPR
Overview and crosswalk of the five frameworks every MedTech innovator must satisfy after FDA clearance - shared controls, sequencing, and FAQs.
Read guide 510(k)How to Pass FDA 510(k) Cybersecurity on the First Submission
The exact cybersecurity package that gets through 510(k) review without an AI letter. Eight artifacts, common rejection patterns, and a 30-day pre-submission readiness check.
Read guide SBOMMedical Device SBOM Requirements for FDA: A Complete Checklist
What FDA requires in your SBOM under Section 524B and the 2026 guidance: format, depth, vulnerability mapping, postmarket maintenance, and the most-cited deficiencies.
Read guide AI/MLPCCP Template & Worked Example for AI/ML Medical Devices
How to write a Predetermined Change Control Plan FDA will accept - structure, the three required components, performance bounds, and a worked example.
Read guide Penetration TestingPenetration Testing Scope for FDA Submissions: A 510(k) / De Novo / PMA Guide
How to scope penetration testing for an FDA submission so the report holds up under reviewer scrutiny. Required attack surfaces, evidence depth, and how scope differs by pathway.
Read guide PostmarketPostmarket Cybersecurity Readiness Plan
What you need in place after clearance to satisfy FDA postmarket expectations and stay ahead of vulnerabilities.
Read guide PostmarketPostmarket SBOM Maintenance for Medical Devices
How to maintain SBOMs across a fleet of cleared devices - regeneration cadence, vulnerability triage, VEX, and the postmarket cybersecurity plan that ties it together.
Read guide ChecklistPremarket FDA Cybersecurity Submission Checklist (2026)
A printable, item-by-item checklist for the cybersecurity content of an FDA premarket submission - aligned to the February 2026 final guidance.
Read guide StandardsThe MedTech Cybersecurity Standards Decoder
FDA Section 524B, IEC 81001-5-1, AAMI TIR57, ISO 14971 and more - what they require, how they connect, and what the FDA expects to see.
Read guide SPDFThe SPDF Playbook
A practical playbook for implementing the Secure Product Development Framework across your QMS and SDLC.
Read guide PostmarketVulnerability Disclosure Programs for Medical Devices (VDP & CVD)
Stand up a Vulnerability Disclosure Program and Coordinated Vulnerability Disclosure workflow that satisfies FDA, aligns to ISO/IEC 29147 / 30111, and actually works for a small MedTech security team.
Read guideBlog24
21 CFR Part 820 and Medical Device Cybersecurity
Updated October 26, 2024 The development, manufacturing, and management of medical devices require strict regulatory adherence to ensure these products' safety, effectiveness, and reliability. A key regulatory framework governing this process is 21 CFR Part 820, often called the Quality System Regul
Read blog Pen Testing25 Use Cases for White-Box Penetration Testing
This article explores white box penetration testing use cases and their importance in ensuring robust cybersecurity.
Read blog FDA510(k) Cybersecurity Requirements Every Maker Must Meet
Most 510(k) deficiencies don't fail on clinical data. They fail on cybersecurity. FDA reviewers are sending Additional Information (AI) requests, and outright Refuse-to-Accept (RTA) holds, at a rate that has become the primary timeline risk for connected device submissions. The documentation bar has
Read blog TestingA Comprehensive Guide to Software Testing for Medical Devices
Learn the ins and outs of software testing for medical devices in this comprehensive guide.
Read blog PrimerA Guide to Hacker Hat Colors
White, gray, and black hat hackers each shape MedTech risk differently. Map the hat colors to threat modeling and FDA-aligned pen testing.
Read blog StandardsAAMI TIR57 Risk Management for Medical Devices
A practical guide to AAMI TIR57 (R2023) and how it supports FDA’s Feb 2026 cybersecurity guidance - risk analysis, controls, and evidence.
Read blog Best PracticesBest Practices for Medical Device Cybersecurity
Medical device cybersecurity best practices for 2025: threat modeling, SBOM, penetration testing, secure updates, and FDA 524B/SPDF readiness.
Read blog Threat ModelingBrainjacking: The Real Cyber-Physical Threat to NeuroTech
Brainjacking is the unauthorized control of an implanted neurostimulator. We unpack the attack vectors, clinical consequences, and what manufacturers must build into DBS, SCS, and BCI products.
Read blog QualityCAPA in Medical Device Cybersecurity
Updated November 16, 2024 Maintaining compliance with regulatory requirements is crucial in the rapidly evolving medical device manufacturing field. The Corrective and Preventive Action (CAPA) process is a cornerstone among these requirements. CAPA is a systematic approach to identifying, addressing
Read blog AuditsConducting a Medical Device Security Audit
This post outlines the key steps to perform a comprehensive cybersecurity risk assessment and testing of medical devices.
Read blog FDAFDA Cybersecurity Requirements for Medical Devices (2026)
This post explores the FDA's cybersecurity requirements for medical devices, their importance, and the challenges manufacturers face in complying with them.
Read blog LifecycleIntegrating Cybersecurity Across the Device Lifecycle
Learn how to effectively integrate cybersecurity assessments into the medical device lifecycle to ensure the safety and security of these critical technologies.
Read blog StandardsISO 14971 + AAMI TIR57: The Connection
This article discusses the relationship between ISO 14971 and AAMI TIR57, and how they help address risks in the production and use of medical devices.
Read blog RiskISO 14971 Risk Management for Medical Device Security
Learn how ISO 14971 risk management applies to medical device cybersecurity - identify cyber hazards, control residual risk, and align with FDA expectations.
Read blog PrimerLinux vs Windows: A Security Comparison
Linux vs Windows security for medical devices: isolation, hardening, secure updates, and long-term patching - so teams can choose and defend an OS decision.
Read blog StrategyManaging Connected Medical Devices: A Strategic Approach
Discover the essential strategies for effectively managing connected medical devices in this comprehensive article.
Read blog Web SecurityProtecting Medical Devices from XSS Attacks
Learn how to protect medical devices from XSS attacks with expert guidance, FDA cybersecurity compliance, and proactive strategies from Blue Goat Cyber.
Read blog TestingRisk-Based Testing for Medical Device Software
Explore the intricacies of risk-based testing for medical device software in this comprehensive guide.
Read blog SDLCSecure Software Development for Medical Devices
Learn how to ensure the safety and compliance of medical devices through secure software development.
Read blog NetworkingSecuring Communication Protocols in Medical Devices
This guide emphasizes securing communication protocols in medical devices and provides actionable insights for manufacturers to enhance safety and privacy.
Read blog IoTSecuring IoT-Enabled Medical Devices: 5 Essential Tips
Discover 5 essential tips for securing IoT-enabled medical devices and safeguarding patient data.
Read blog StandardsThe Role of MDS² in Medical Device Cybersecurity
Updated November 16, 2024 The cybersecurity of medical devices has emerged as a critical concern for manufacturers, healthcare providers, and regulatory bodies. The Manufacturer Disclosure Statement for Medical Device Security (MDS²) plays a pivotal role in addressing these concerns by providing a s
Read blog RiskThe Top 50 Cybersecurity Issues with Medical Devices
This blog lists the 50 cybersecurity issues in medical devices and explains how penetration testing could have prevented them.
Read blog Threat ModelingThreat Modeling Connected & Implantable Devices
If you're asking how to conduct a cybersecurity threat model for a connected or implantable medical device, the first thing to understand is that this is not the same exercise as modeling a web application or enterprise network. The stakes are categorically different. A missed attack vector on a hos
Read blogPodcast81
Ep 00 · How to Build an SBOM That Passes FDA Review
SBOMs are one of the most common sources of FDA deficiencies in medical device submissions. Most companies think they're doing it right, but then they get feedback asking for missing components or clarification on what's included.
Read podcast PodcastEp 00 · Master Medical Device Cybersecurity: Avoid FDA Delays | Blue Goat Cyber Webinar
How can medical device manufacturers meet FDA cybersecurity requirements the first time around? What are the most significant challenges medical device manufacturers face in ensuring FDA cybersecurity compliance?
Read podcast PodcastEp 00 · Trailer - The Med Device Cyber Podcast
You rely on a medical device to stay healthy, but what if that device could be hacked? What if someone, miles away, could manipulate it, putting your loved one’s life at risk?
Read podcast PodcastEp 00 · Webinar: 5 Key FDA Cybersecurity Standards with Jordan John
How can you integrate relevant cybersecurity standards early in your medical device development process? Also, how do FDA cybersecurity standards help reduce the time to market for new medical devices?
Read podcast PodcastEp 00 · Webinar: Hacking Med Devices - What Penetration Testing Reveals Before the FDA Does
Cyber threats targeting medical devices are increasingly sophisticated. A single undiscovered vulnerability could delay your FDA submission and put patient safety at risk.
Read podcast PodcastEp 00 · Webinar: Mastering Threat Modeling for Medical Device Cybersecurity
Christian Espinosa, CEO of Blue Goat Cyber, and Trevor Slattery, Director of Medical Device Cybersecurity, explore the critical topic of threat modeling in medical device cybersecurity.
Read podcast PodcastEp 00 · Webinar: Medical Device Penetration Testing: What Every Manufacturer Must Know
What are the unique challenges and regulatory requirements of medical device penetration testing? In this webinar episode with Christian Espinosa, CEO of Blue Goat Cyber, and Trevor Slattery, CTO of Blue Goat Cyber, you’ll learn: * How Medical Device Penetration Testi
Read podcast PodcastEp 00 · Webinar: Medical Device Risk Assessments - Cybersecurity, Compliance & Patient Safety
Medical devices are becoming more connected, but with that connectivity comes risk. In this episode, Christian and Trevor dive into risk assessments for medical devices - a crucial process in ensuring both patient safety and cybersecurity compliance.
Read podcast PodcastEp 00 · Webinar: Navigating FDA Cybersecurity Compliance: A Guide for RA/QA Professionals
When you’re working with a manufacturer to ensure that a medical device has strong cybersecurity, what do you need to know from a regulatory perspective?
Read podcast PodcastEp 00 · Webinar: Postmarket Cybersecurity Management
MedTech manufacturers, how prepared are you to monitor vulnerabilities continuously once your medical device reaches the market? Also, would you like a free checklist for your Cybersecurity Management Plan?
Read podcast PodcastEp 00 · Webinar: Risk Management Frameworks For Medical Device Safety & Security
Join Trevor Slattery, Director of Cybersecurity, and Christian Espinosa, CEO of Blue Goat Cyber, for a comprehensive webinar on medical device cybersecurity.
Read podcast PodcastEp 00 · Webinar: Security Architecture Views: Protecting Medical Devices Through Strategic Design
How can security architecture views strengthen a medical device manufacturer’s FDA submissions? This episode/webinar dives into the four critical security architecture views required by the FDA: global system, multi-patient harm, updatability and patchability, and secure use case
Read podcast PodcastEp 00 · Webinar: Why FDA Cybersecurity Submissions Fail and How to Get Yours Approved
MedTech innovators and medical device manufacturers, how can you prevent cybersecurity deficiencies from delaying your FDA submission?
Read podcast PodcastEp 01 · Cybersecurity for Medical Devices: Protecting Human Lives
How do medical device cybersecurity risks differ from traditional cybersecurity threats? In this episode, Christian Espinosa and Trevor Slattery discuss the critical importance of cybersecurity for medical devices, sharing real-life stories and insights into how device vulnerabil
Read podcast PodcastEp 02 · Hidden Vulnerabilities in Medical Devices: Why Cybersecurity Matters
How vulnerable are current medical devices to cyberattacks, and what are the consequences of these exploits? In this episode, Christian Espinosa and Trevor Slattery discuss the critical vulnerabilities in medical devices and the cybersecurity threats they face.
Read podcast PodcastEp 03 · Navigating the Regulatory Landscape of Medical Device Cybersecurity
What are the main categories of medical devices, and how do regulatory bodies govern them? In this episode, Christian Espinosa and Trevor Slattery unpack the complex regulatory environment surrounding medical device cybersecurity.
Read podcast PodcastEp 04 · Building Resilient Medical Devices: A Look at the Essential Technologies and Infrastructure
How can some of the biggest cybersecurity concerns with medical devices be addressed in the design phase?
Read podcast PodcastEp 05 · Avoid the Dumb Tax: Cybersecurity Lessons for MedTech Startups with Steve Bell
What are the most common mistakes MedTech startups make in cybersecurity, and how can founders avoid them? In this episode, Christian Espinosa and Trevor Slattery dive into the challenges MedTech startups face with their guest, Steve Bell, a 35-year veteran of the industry.
Read podcast PodcastEp 06 · The Evolution of Medical Device Cyber Threats: Past, Present, and Future
How do medical device vulnerabilities pose life-threatening risks? In this episode, Christian and Trevor again explore the fascinating and critical world of medical device cybersecurity.
Read podcast PodcastEp 07 · Startups, Regulations, & Risk: Insights from MedTech Guru Etienne Nichols
What are some of the key challenges MedTech companies face in balancing innovation with compliance? This episode dives into the intersection of quality management and cybersecurity in the MedTech industry.
Read podcast PodcastEp 08 · The Human Factor: Why Cybersecurity Awareness is Key in Medical Device Manufacturing
How does human behavior impact medical device cybersecurity? Also, why do cybersecurity awareness programs often fail to make a lasting impact? This episode dives into the human factor in medical device cybersecurity.
Read podcast PodcastEp 09 · FDA AI Guidance Explained: What It Means for Medical Device Cybersecurity
How does the FDA’s latest AI guidance on medical devices impact manufacturers and cybersecurity challenges in healthcare? In this episode, Christian and Trevor discuss the latest FDA AI guidance and how it will impact real-world AI applications in healthcare.
Read podcast PodcastEp 10 · How Trump & RFK Jr Affect AI Med Device Guidelines
How might the second Donald Trump administration and Robert F. Kennedy Jr. impact the MedTech cybersecurity world? In this episode, Christian and Trevor discuss how the Trump administration and RFK Jr.’s policies could reshape medical device cybersecurity and regulation.
Read podcast PodcastEp 11 · Advanced Threat Modeling in Medical Devices
What is threat modeling, how does it differ from penetration testing, and why are both necessary? This episode dives into the nuances of advanced threat modeling for medical devices.
Read podcast PodcastEp 12 · Postmarket Surveillance and Anomaly Detection for Medical Devices
What are some of the biggest cybersecurity risks medical devices face after they hit the market? This episode dives into the challenges of postmarket surveillance for medical devices.
Read podcast PodcastEp 13 · SBOMs Unpacked: Myths, Risks, & Benefits with Cortez Frazier Jr.
Why are Software Bill of Materials (SBOMs) critical for medical device security? In this episode, Cortez Frazier Jr. joins Christian and Trevor to discuss SBOMs, vulnerability prioritization, and why companies should stop fearing software transparency.
Read podcast PodcastEp 14 · The Growing Importance of Interoperability and Third-Party Component Security
Why is interoperability increasing cybersecurity risks in healthcare, and what can we do about it? Interoperability is making healthcare more efficient but also more vulnerable to cyber threats.
Read podcast PodcastEp 15 · Commercialize Your MedTech with Craig T Ingram
What are the 10 essential components of a successful commercialization plan in the MedTech industry, and why are they often overlooked? This episode explores the critical role of commercialization in the MedTech industry.
Read podcast PodcastEp 16 · Collaboration is Key: Bridging the Gap Between Developers and Cybersecurity Experts
What are some of the biggest barriers to effective collaboration between coders and cyber experts, and how can they be overcome? This episode explores the essential components of successful collaboration and teamwork.
Read podcast PodcastEp 17 · Cybersecurity Challenges & Trends in US Healthcare with Paul-Lukas Hoffschmidt
If you’re launching a MedTech product, what should you know about market access, cybersecurity, reimbursement challenges, and customer education?
Read podcast PodcastEp 18 · Early Cyber Strategies for MedTech Trailblazers
What are some strategies founders can use to incorporate cybersecurity into the early stages of developing a MedTech product? In this episode, Christian and Trevor break down the critical role of cybersecurity in early-stage MedTech startups.
Read podcast PodcastEp 19 · Data Protection in Medical Devices: A Deep Dive with Kevin Derr
How can medical device companies own their data without compromising security? In this episode, Kevin Derr from NeuronSphere joins Christian and Trevor to dive into the intersection of cybersecurity, compliance, and innovation in the MedTech world.
Read podcast PodcastEp 20 · The Human Factor in MedTech Design with Dylan Horvath
How can human-centered design influence medical device cybersecurity? In this episode, Christian Espinosa chats with Dylan Horvath of Cortex Design about the powerful intersection of human-centered design and medical device cybersecurity.
Read podcast PodcastEp 21 · Essential Software Documentation for Med Device Manufacturers
What documents should engineers prepare to get ready for submitting a medical device to the FDA? In this episode, Christian and Trevor dig into the underestimated role software documentation plays in cybersecurity, especially in the medical device space.
Read podcast PodcastEp 22 · AI in Medical Devices: Opportunities & Regulation with Matt Lemay
What does responsible AI implementation look like in medical devices? This episode explores the intersection of AI, cybersecurity, and medical device regulation with guest Matt Lemay, CEO of Lemay.ai.
Read podcast PodcastEp 23 · Unpacking Post-Market Management and Incident Response for Medical Devices
What should you do when a vulnerability is discovered in a medical device after it's already on the market? This dives into post-market management and incident response for medical devices, exploring what happens when a device is hacked or a vulnerability is reported.
Read podcast PodcastEp 24 · From Concept to Compliance: A Guide to Med Device Approval
Med device manufacturers, are you setting up your quality system early enough in product development? Also, are you misunderstanding the FDA’s "guidance" documents - and risking rejection?
Read podcast PodcastEp 25 · Cybersecurity Labeling and MedTech Transparency
Why is cybersecurity labeling more than just a compliance checkbox for medical device companies? In this episode, Christian and Trevor dive into the nuanced world of cybersecurity labeling for medical devices.
Read podcast PodcastEp 26 · Why Cybersecurity and Quality Are One and the Same
How can medical device startups avoid missteps in cybersecurity, quality, and compliance? In this episode, Trevor Slattery speaks with Ashkon Rasooli about the intersection of quality systems and cybersecurity in medical devices.
Read podcast PodcastEp 27 · Total Product Lifecycle Security: From Design to Disposal
How well does your security strategy cover the entire product lifespan - from concept to decommissioning? This episode dives into the importance of the Total Product Lifecycle (TPLC) and Secure Product Development Framework (SPDF) in medical device cybersecurity.
Read podcast PodcastEp 28 · Shared Responsibility in Medical Device Cybersecurity with Greg Garcia
How can shared responsibility models improve healthcare cybersecurity? In this episode, Greg Garcia joins Christian and Trevor to break down the evolving landscape of medical device cybersecurity from a national policy perspective.
Read podcast PodcastEp 29 · What the FDA Wants in Security Architecture Views for Devices
What are the four security architecture views that the FDA prioritizes, and how do they impact your device's design? This episode explores the FDA-defined security architecture views essential for medical device cybersecurity.
Read podcast PodcastEp 30 · FDA Cybersecurity Gets Real with Monica Montañez of NAMSA
How have medical device cybersecurity requirements changed since 2023, and what does this mean for your product development? In this episode, Christian and Trevor welcome Monica Montañez from NAMSA to unpack the evolving landscape of FDA cybersecurity requirements.
Read podcast PodcastEp 31 · Understanding Cybersecurity Measures and Metrics for Medical Devices
How do measures and metrics differ, and why is this distinction crucial for FDA submissions? In this episode, Christian and Trevor demystify the difference between cybersecurity measures and metrics in the context of FDA guidance.
Read podcast PodcastEp 32 · From Surgery to MedTech Startups: Dr. Dylan Attard’s Journey
What cybersecurity challenges face hospitals and medical devices today that MedTech innovators should know about? Today’s guest is Dr. Dylan Attard, who swapped his scalpel for startups when he founded MedTech World, a global conference series elevating healthcare innovation.
Read podcast PodcastEp 33 · Vulnerability, Penetration & Other Cybersecurity Testing Types Explained
Which cybersecurity tests are the most crucial, and which ones does the FDA require for medical device approval? In this episode, Christian and Trevor break down the many types of cybersecurity testing required for medical devices.
Read podcast PodcastEp 34 · Integrating Project Management to Strengthen Cybersecurity Outcomes with Steve Curry
What project management mistakes can med tech innovators avoid? What methods and tools can help med tech companies manage projects?
Read podcast PodcastEp 35 · Balancing Innovation and Regulation in MedTech Development with Karandeep Singh Badwal
How can MedTech innovators balance speed with compliance in medical devices? In this episode, Christian and Trevor sit down with Karandeep Singh Badwal about the challenges of balancing innovation with quality and regulatory compliance in medical devices, especially with the rise
Read podcast PodcastEp 36 · When Cybersecurity Becomes a Crime
What happens when cybersecurity flaws in medical devices cross the line into criminal violations? In this episode, Christian and Trevor unpack the groundbreaking case of Illumina, where cybersecurity misrepresentation led to Department of Justice enforcement.
Read podcast PodcastEp 37 · Overcoming AI and Data Security Challenges in MedTech with May Lee
How can you prepare your device for future quantum computing risks? In this episode of The Med Device Cyber Podcast, Christian and Trevor talk with May Lee of CS Life Sciences about the fast-changing world of medical device cybersecurity.
Read podcast PodcastEp 38 · Top 10 Medical Device Vulnerabilities with Myles Kellerman
How safe are the medical devices I rely on, and what are the biggest cybersecurity risks I should know about?
Read podcast PodcastEp 39 · Medical Device Startups and Cybersecurity Challenges with Suzy Engwall
What are some of the greatest challenges medical device startups face when bringing their products to market? This episode features Suzy Engwall, a healthcare innovation consultant with experience mentoring startups and guiding hospitals.
Read podcast PodcastEp 40 · What Happens When AI in Medical Devices Make Mistakes?
MedTech manufacturers and developers, what happens if your AI-powered medical device makes a terrible, life-threatening mistake? This episode explores what happens when artificial intelligence in medical devices goes wrong.
Read podcast PodcastEp 41 · 5 Most Common Misconceptions of Medical Device Security
In this episode, Christian and Trevor unpack the five most common misconceptions that put medical device manufacturers at risk.
Read podcast PodcastEp 42 · What Is A Medical Device?
MedTech developers and manufacturers, could your medical device unknowingly qualify as a “cyber device”? In this episode, Christian and Trevor break down what the FDA considers a “cyber device” and why so many manufacturers misunderstand this definition.
Read podcast PodcastEp 43 · Why AI Literacy Matters for the Future of Healthcare with José Acosta
How can AI literacy reduce patient risk in healthcare settings? In this episode, Christian Espinosa and Trevor Slattery are joined by Dr. José Acosta.
Read podcast PodcastEp 44 · Cyber Risk Management for MedTech Legacy Devices
What options do MedTech manufacturers have to bring older devices up to modern cybersecurity standards? Also, how does the FDA’s latest guidance change the process for updating legacy devices?
Read podcast PodcastEp 45 · Designing Secure Medical Device Software with Randy Horton
In medical device software development, why should cybersecurity be viewed as an element of product quality, not an add-on? In this episode, Christian and Trevor speak with Randy Horton of Orthogonal about the future of medical device software development.
Read podcast PodcastEp 46 · How Market Intelligence Shapes MedTech Growth with Kevin Saem
In the MedTech space, how can you leverage market intelligence and machine learning for business development and sales enablement? In this episode, Christian and Trevor talk with Kevin Saem about how market intelligence and cybersecurity intersect in the MedTech space.
Read podcast PodcastEp 47 · What Is Required for an FDA Pre-Market Cyber Submission?
What are the 18 required cybersecurity deliverables for a pre-market submission, and how do they map to eSTAR’s 13 sections?
Read podcast PodcastEp 48 · Cybersecurity Qs MedTech Innovators Ask: Christian’s Hot Seat
MedTech manufacturers, how can you avoid the cybersecurity pitfalls that most often lead to FDA rejection? In this episode, Trevor puts Christian “in the hot seat” to tackle the most common - and sometimes misunderstood - cybersecurity questions MedTech innovators ask.
Read podcast PodcastEp 49 · How Cybersecurity Shapes Regulatory and Quality Success with Jim Goodmiller
What risks do you take when cybersecurity is left off your development roadmap? In this episode, Christian, Trevor and guest Jim Goodmiller explore how cybersecurity intersects with regulatory expectations and quality systems, creating new challenges and opportunities for MedTech
Read podcast PodcastEp 50 · The Differences Between Black, Grey, and White Penetration Testing
MedTech developers, do you know which penetration testing methodology the FDA actually prefers for medical device submissions?
Read podcast PodcastEp 51 · Trevor Slattery Answers Tough Medical Device Cyber Questions
This episode puts Trevor in the hot seat. If you were put in the hot seat, could you clearly explain cybersecurity, safety, and lifecycle terms like Trevor?
Read podcast PodcastEp 52 · When Medical Device Cyber Failures Become Fatal
What past ransomware and medical device incidents might reveal gaps that manufacturers are still overlooking today?
Read podcast PodcastEp 53 · Untangling Software Composition Analysis for MedTech Teams
Why does software composition analysis matter beyond regulatory compliance? This episode explores SCA (Software Composition Analysis) and explains how SBOMs (Software Bill of Materials), SOUP (Software of Unknown Provenance), and related tooling fit into the broader medical devic
Read podcast PodcastEp 54 · What It Takes to Succeed in the MedTech Industry with Omar Khateeb
Ever thought about what it really takes to launch a successful MedTech startup? Omar M. Khateeb knows the challenges firsthand. As a founder with a track record of building healthtech companies, he’s lived through the hurdles that come with innovating in the MedTech space.
Read podcast PodcastEp 55 · Why Most MedTech Companies Fail at Global Expansion (And How to Fix It) with William Jin
Thinking about taking your medical device to China? Or maybe you're a Chinese company looking at the American market? William Jin has spent over 30 years helping companies do exactly that, and he'll tell you straight up that most of them aren't ready.
Read podcast PodcastEp 56 · What MedTech Startups Get Wrong About Cybersecurity Documentation with Marc Zemel
Marc Zemel has been building Retia Medical for 15 years. The company started as two guys with slides and licensed technology.
Read podcast PodcastEp 57 · From Idea to FDA Clearance: What Nobody Tells MedTech Founders with Darcy Bachert
Building medical device software is hard. Building it the right way is harder. And getting it through FDA approval while managing cybersecurity requirements? That's what Darcy Bachert has been doing for 17 years.
Read podcast PodcastEp 58 · How AI Code Security Became a Medical Device Problem with Jun Xiang Tan
Ten years ago, Singapore's healthcare system got hacked. Patient records were stolen at a national scale. The government responded by building one of the most comprehensive medical device security frameworks in the world. The Cybersecurity Labeling Scheme has four tiers.
Read podcast PodcastEp 59 · Prevention Is Better Than Cure: Applying Medical Principles to MedTech Cybersecurity
Medical device risk assessments are failing patients, not because the process is too hard, but because nobody doing the assessment has ever been in the room where the device actually gets used.
Read podcast PodcastEp 60 · How to Move Stakeholders from Awareness to Sustained Adoption Without Friction
Marketing medical devices requires understanding that stakeholders are different, buying processes are longer, and friction points are more complex than consumer products or software.
Read podcast PodcastEp 61 · Alarm Fatigue, Workflow Integration, and the Intelligent Operating Room (Professor Aamer Ahmed)
Devices that do not integrate into the clinical workflow sit unused regardless of technical sophistication. Physicians work in high-pressure environments where equipment must be 100 percent reliable, secure, and enhance workflow rather than disrupt it.
Read podcast PodcastEp 62 · Edge Cases, Alarm Fatigue, and Why AI Cannot Replace Clinical Judgment with Brandon Fertig, Senior Manager at Philips Healthcare
Alarm fatigue happens when monitoring systems raise so many false flags that clinical staff begin ignoring them, even when real critical events occur.
Read podcast PodcastEp 63 · Early Design Decisions that Shape Medical Device Success with Chris Danek, CEO of Bessel
Early design decisions define the trajectory of a medical device long before commercialization begins. Choices related to software architecture, third-party components, and system connectivity establish both the opportunity and the risk profile of the product.
Read podcast PodcastEp 64 · Traceability Requirements and Documentation Audit Trails with Dr. Basant Bajpai, CEO of Compliance MedQRA
Quality management system implementation delays create cascading failures across medical device development timelines.
Read podcast PodcastEp 65 · Why Clinical Trials Are the Most Expensive Capital Outlay for Startups with Rob Bedford, CEO of Franklyn Health
Early planning prevents expensive corrections when startups address clinical strategy, regulatory pathways, and cybersecurity requirements from day one rather than improvising solutions before launch.
Read podcast PodcastEp 66 · Vibe Coding Security Risks and Malicious Code Injection with Jake Rodriguez of Triangle Tech
Vibe coding enables rapid development through AI-generated code but introduces security risks when developers accept outputs without verification. Malicious actors can inject vulnerabilities through manipulated training data or prompt engineering.
Read podcast PodcastEp 67 · De-Risking Product Decisions in MedTech Startups with Brent Lavin of Ironwood MedTech Partners
Product decisions made during early development determine commercialization outcomes years later. Wrong choices about regulatory pathways, feature sets, and market segments create compounding problems limiting commercial success.
Read podcast PodcastEp 68 · Why MedTech Needs More Than Approval with Michael Branagan Harris of HealthTech Strategies Limited
A device can clear regulatory hurdles and still struggle commercially if the evidence is too narrow. MedTech companies need proof that speaks to affordability, care quality, operational impact, and long term value, not just technical performance.
Read podcastNews32
Blue Goat Cyber Brings Global Medical Device Cybersecurity Expertise to SWITCH Singapore 2025
Blue Goat Cyber Brings Global Medical Device Cybersecurity Expertise to SWITCH Singapore 2025 SINGAPORE, October 27, 2025 -- Blue Goat Cyber, the global authority in medical device cybersecurity and regulatory compliance, will attend the Si
Read new NewsBlue Goat Cyber Celebrates Milestone with the Release of Its 10th Episode on the Med Device Cyber Podcast
Blue Goat Cyber Celebrates Milestone with the Release of Its 10th Episode on the Med Device Cyber Podcast FDA compliance shouldn’t be a guessing game. The Med Device Cyber Podcast gives MedTech innovators a clear roadmap to secure devices,
Read new NewsBlue Goat Cyber Expands Global Presence with Strategic Success at LSI Europe 2024 and RAPS Convergence 2024
Blue Goat Cyber Expands Global Presence with Strategic Success at LSI Europe 2024 and RAPS Convergence 2024 Scottsdale, Arizona, United States - October 5, 2024 Blue Goat Cyber, a leader in medical device cybersecurity solutions, is excited
Read new NewsBlue Goat Cyber Expands into Asian Market at Mednovation MedTech Forum
Blue Goat Cyber Expands into Asian Market at Mednovation MedTech Forum SCOTTSDALE, AZ, UNITED STATES, October 24, 2024 Blue Goat Cyber, a leader in medical device cybersecurity, is excited to announce its participation in the Mednovation In
Read new NewsBlue Goat Cyber Highlights Expertise at DeviceTalks West 2024; Christian Espinosa Shares Key Cybersecurity Insights
Blue Goat Cyber Highlights Expertise at DeviceTalks West 2024; Christian Espinosa Shares Key Cybersecurity Insights SANTA CLARA, CA, UNITED STATES, October 18, 2024Blue Goat Cyber, a leader in cybersecurity solutions for the medical device
Read new NewsBlue Goat Cyber Highlights FDA Cybersecurity at DeviceTalks West 2025; CTO Trevor Slattery to Present
Blue Goat Cyber Highlights FDA Cybersecurity at DeviceTalks West 2025; CTO Trevor Slattery to Present SANTA CLARA, CA, UNITED STATES, October 14, 2025 -- Blue Goat Cyber, a trusted leader in medical device cybersecurity and FDA compliance s
Read new NewsBlue Goat Cyber Joins MedTech World Bay Area as Gold Sponsor; Christian Espinosa to Join Regulatory Strategy Panel
Blue Goat Cyber Joins MedTech World Bay Area as Gold Sponsor; Christian Espinosa to Join Regulatory Strategy Panel SCOTTSDALE, AZ, UNITED STATES, June 4, 2025 -- Blue Goat Cyber, a leading cybersecurity consultancy for FDA-regulated medical
Read new NewsBlue Goat Cyber Launches “The Med Device Cyber Podcast”: Your Go-To Resource for Medical Device Security
Blue Goat Cyber Launches \"The Med Device Cyber Podcast\": Your Go-To Resource for Medical Device Security SCOTTSDALE, AZ, UNITED STATES, October 16, 2024Blue Goat Cyber, a leader in medical device cybersecurity, is excited to announce the
Read new NewsBlue Goat Cyber Launches Legacy Medical Device Cybersecurity Service with Advanced Monitoring and Testing
Blue Goat Cyber Launches Legacy Medical Device Cybersecurity Service with Advanced Monitoring and Testing SCOTTSDALE, AZ, UNITED STATES, October 30, 2024Blue Goat Cyber, a medical device cybersecurity solutions leader, has announced a new s
Read new NewsBlue Goat Cyber Launches Milestone 25th Podcast Episode: Cybersecurity Labeling and MedTech Transparency
Blue Goat Cyber Launches Milestone 25th Podcast Episode: Cybersecurity Labeling and MedTech Transparency SCOTTSDALE, AZ, UNITED STATES, June 24, 2025 -- Blue Goat Cyber, the global authority in medical device cybersecurity, announces the re
Read new NewsBlue Goat Cyber Launches Monthly Medical Device Cybersecurity Webinar Series
Blue Goat Cyber Launches Monthly Medical Device Cybersecurity Webinar Series SCOTTSDALE, AZ, UNITED STATES, October 31, 2024Blue Goat Cyber, a leader in medical device cybersecurity and FDA regulatory compliance, is excited to announce the
Read new NewsBlue Goat Cyber Launches New Secure MedTech Product Design Consulting Service to Meet Growing Client Demand
Blue Goat Cyber Launches New Secure MedTech Product Design Consulting Service to Meet Growing Client Demand Cybersecurity should be embedded from the start to avoid costly redesigns, enhance patient safety, and confidently meet regulatory d
Read new NewsBlue Goat Cyber Leads Medical Device Cybersecurity Compliance as FDA Finalizes New Guidance
Blue Goat Cyber Leads Medical Device Cybersecurity Compliance as FDA Finalizes New Guidance SCOTTSDALE, AZ, UNITED STATES, July 9, 2025 -- On February 3, 2026, the U.S. Food and Drug Administration (FDA) finalized its medical device cybersecur
Read new NewsBlue Goat Cyber Leads the MedTech Cybersecurity Revolution at DeviceTalks Boston 2025
Blue Goat Cyber Leads the MedTech Cybersecurity Revolution at DeviceTalks Boston 2025 SCOTTSDALE, AZ, UNITED STATES, April 21, 2025 -- Blue Goat Cyber is driving the next wave of MedTech cybersecurity innovation as a platinum sponsor of Dev
Read new NewsBlue Goat Cyber Named Gold Sponsor at MedTech World Malta 2025, Advancing FDA and EU MDR Cybersecurity Alignment
Blue Goat Cyber Named Gold Sponsor at MedTech World Malta 2025, Advancing FDA and EU MDR Cybersecurity Alignment VALLETTA, MALTA, November 6, 2025 -- Blue Goat Cyber, a U.S.-based leader in medical device cybersecurity and global regulatory
Read new NewsBlue Goat Cyber Named Medical Device Cybersecurity Services Company of the Year by Healthcare Business Review
Blue Goat Cyber Named Medical Device Cybersecurity Services Company of the Year by Healthcare Business Review SCOTTSDALE, AZ, UNITED STATES, February 21, 2025 -- Blue Goat Cyber, a leading medical device cybersecurity solutions provider, ha
Read new NewsBlue Goat Cyber Reaches Milestone: 21 Episodes of The Med Device Cyber Podcast Now Available
Blue Goat Cyber Reaches Milestone: 21 Episodes of The Med Device Cyber Podcast Now Available SCOTTSDALE, AZ, UNITED STATES, May 28, 2025 -- Blue Goat Cyber, a global leader in MedTech cybersecurity and FDA cybersecurity compliance consultin
Read new NewsBlue Goat Cyber Releases Essential White Paper to Streamline Medical Device Cybersecurity Compliance
Blue Goat Cyber Releases Essential White Paper to Streamline Medical Device Cybersecurity Compliance SCOTTSDALE, AZ, UNITED STATES, November 15, 2024Blue Goat Cyber, a leading provider of cybersecurity solutions for medical device manufactu
Read new NewsBlue Goat Cyber Sponsors Cybersecurity for Medical Devices Summit to Strengthen Healthcare Security
Blue Goat Cyber Sponsors Cybersecurity for Medical Devices Summit to Strengthen Healthcare Security SCOTTSDALE, AZ, UNITED STATES, November 6, 2024Blue Goat Cyber, a leader in medical device cybersecurity, proudly announces its sponsorship
Read new NewsBlue Goat Cyber Sponsors DeviceTalks Minnesota; Jordan John to Share FDA Cybersecurity Strategies
Blue Goat Cyber Sponsors DeviceTalks Minnesota; Jordan John to Share FDA Cybersecurity Strategies SCOTTSDALE, AZ, UNITED STATES, June 3, 2025 -- Blue Goat Cyber, a leading authority in medical device cybersecurity and FDA compliance strateg
Read new NewsBlue Goat Cyber Sponsors LSI Asia 2025; CTO Trevor Slattery to Lead High-Impact MedTech Cybersecurity Panel
Blue Goat Cyber Sponsors LSI Asia 2025; CTO Trevor Slattery to Lead High-Impact MedTech Cybersecurity Panel SCOTTSDALE, AZ, UNITED STATES, June 3, 2025 -- Blue Goat Cyber, a trusted authority in medical device cybersecurity and regulatory s
Read new NewsBlue Goat Cyber Sponsors LSI Europe 2025; CEO Christian Espinosa to Lead MedTech Cybersecurity Panel
Blue Goat Cyber Sponsors LSI Europe 2025; CEO Christian Espinosa to Lead MedTech Cybersecurity Panel SCOTTSDALE, AZ, UNITED STATES, September 2, 2025 -- Blue Goat Cyber, a leading medical device cybersecurity consultancy, today announced it
Read new NewsBlue Goat Cyber Sponsors MedTech World Dubai 2025 to Support Medical Device Security in the GCC Region
Blue Goat Cyber Sponsors MedTech World Dubai 2025 to Support Medical Device Security in the GCC Region SCOTTSDALE, AZ, UNITED STATES, February 4, 2025 -- Blue Goat Cyber, a leader in medical device cybersecurity, is proud to sponsor MedTech
Read new NewsBlue Goat Cyber to Exhibit at The MedTech Conference 2025 Showcasing FDA Compliance & Cybersecurity Services
Blue Goat Cyber to Exhibit at The MedTech Conference 2025 Showcasing FDA Compliance & Cybersecurity Services SAN DIEGO, CA, UNITED STATES, September 30, 2025 -- Blue Goat Cyber, a leading provider of medical device cybersecurity services, a
Read new NewsBlue Goat Cyber to Lead Global MedTech Cybersecurity Masterclass at Asia Pacific 2025 Finals
Blue Goat Cyber to Lead Global MedTech Cybersecurity Masterclass at Asia Pacific 2025 Finals SINGAPORE, October 24, 2025 -- Blue Goat Cyber, a global leader in medical device cybersecurity and regulatory strategy, will lead a high-impact ma
Read new NewsBlue Goat Cyber to Share Critical FDA Cybersecurity Strategies at AMDM 2025 Annual Meeting
Blue Goat Cyber to Share Critical FDA Cybersecurity Strategies at AMDM 2025 Annual Meeting SCOTTSDALE, AZ, UNITED STATES, April 28, 2025 -- Medical device manufacturers increasingly face regulatory setbacks, with cybersecurity deficiencies
Read new NewsBlue Goat Cyber to Showcase Healthcare and Medical Device Cybersecurity Solutions at HLTH 2025 in Las Vegas
Blue Goat Cyber to Showcase Healthcare and Medical Device Cybersecurity Solutions at HLTH 2025 in Las Vegas LAS VEGAS, NV, UNITED STATES, October 17, 2025 -- Blue Goat Cyber, a leader in healthcare cybersecurity, medical device protection,
Read new NewsBlue Goat Cyber to Speak at MedTech World Hong Kong on Medical Device Cybersecurity
Blue Goat Cyber to Speak at MedTech World Hong Kong on Medical Device Cybersecurity SCOTTSDALE, AZ, UNITED STATES, June 25, 2025 -- Blue Goat Cyber, a leader in medical device cybersecurity, is proud to announce its participation in the upc
Read new NewsBlue Goat Cyber to Sponsor and Attend LSI USA ‘25 Emerging MedTech Summit
Blue Goat Cyber to Sponsor and Attend LSI USA ‘25 Emerging MedTech Summit SCOTTSDALE, AZ, UNITED STATES, February 14, 2025 -- Blue Goat Cyber, a leader in medical device cybersecurity, proudly announces its sponsorship of the LSI USA ‘25 Em
Read new NewsBlue Goat Cyber to Sponsor MedTech World Singapore Roadshow; Christian Espinosa to Speak on Medical Device Cybersecurity
Blue Goat Cyber to Sponsor MedTech World Singapore Roadshow; Christian Espinosa to Speak on Medical Device Cybersecurity SINGAPORE, September 27, 2025 -- Blue Goat Cyber, a leader in medical device cybersecurity, announced its sponsorship o
Read new NewsBlue Goat Cyber Wins ‘MedTech Service Provider Excellence Award of the Year’ at MedTech Malta 2025
Blue Goat Cyber Wins ‘MedTech Service Provider Excellence Award of the Year’ at MedTech Malta 2025 VALETTA, MALTA, November 16, 2025 -- Blue Goat Cyber, a leading global provider of medical device cybersecurity services, has been awarded th
Read new NewsNews
Stay up to date on Blue Goat Cyber news, press releases, and thought leadership on medical device cybersecurity, FDA guidance, and healthcare cyber risk.
Read newMedTech Segments14
Cardiovascular Devices
Cybersecurity for pacemakers, ICDs, CIEDs, and cardiac monitoring.
Read medtech segment MedTech segmentDental Devices
Cybersecurity for digital dentistry, intraoral scanners, and CAD/CAM.
Read medtech segment MedTech segmentDiabetes & Continuous Glucose Monitoring
Cybersecurity for CGMs, insulin pumps, and AID systems.
Read medtech segment MedTech segmentDigital Therapeutics (DTx)
Cybersecurity for prescription digital therapeutics and DTx apps.
Read medtech segment MedTech segmentHearing Devices
Cybersecurity for hearing aids, cochlear implants, and OTC hearing.
Read medtech segment MedTech segmentImaging & AI / SaMD
Cybersecurity for SaMD, AI/ML diagnostics, and medical imaging.
Read medtech segment MedTech segmentIn-Vitro Diagnostics (IVD)
Cybersecurity for IVD analyzers, LIS integrations, and lab platforms.
Read medtech segment MedTech segmentInfusion & Drug Delivery
Cybersecurity for infusion pumps and connected drug delivery.
Read medtech segment MedTech segmentNeuroTechnology & Brain-Computer Interfaces
Cybersecurity for BCIs, neuromodulation, and implantable neural devices.
Read medtech segment MedTech segmentOphthalmic Devices
Cybersecurity for surgical, diagnostic, and therapeutic ophthalmic devices.
Read medtech segment MedTech segmentOrthopedic & Implantable Devices
Cybersecurity for smart implants, orthopedic robots, and surgical planning.
Read medtech segment MedTech segmentSurgical Robotics
Cybersecurity for robot-assisted surgery and telesurgery platforms.
Read medtech segment MedTech segmentWearables & Remote Patient Monitoring
Cybersecurity for clinical wearables and RPM ecosystems.
Read medtech segment MedTech segmentWomen's Health Devices
Cybersecurity for fertility, maternal, and women's health devices.
Read medtech segmentTopic Hubs10
510(k) Cybersecurity
Cybersecurity for FDA 510(k) submissions under the Feb 2026 guidance and Section 524B - what reviewers want, where 510(k)s actually fail, and how to ship a clean package.
Read topic hub Topic hubCoordinated Vulnerability Disclosure (CVD)
Coordinated Vulnerability Disclosure for medical devices - CVD policy, intake, triage, and remediation under FDA postmarket guidance, AAMI TIR97, and ISO/IEC 29147/30111.
Read topic hub Topic hubFDA Premarket Cybersecurity
Everything a MedTech team needs to clear FDA premarket cybersecurity review under Feb 2026 guidance and Section 524B - services, guides, FAQs.
Read topic hub Topic hubIDE Cybersecurity
Cybersecurity for FDA Investigational Device Exemption (IDE) submissions - what reviewers expect, how to avoid a Clinical Hold, and how the artifacts roll forward into 510(k)/De Novo/PMA.
Read topic hub Topic hubMedical Device Penetration Testing
Pen testing built for FDA submissions and connected medical devices - black, gray, and white box methods, scoping, and the standards that map to each.
Read topic hub Topic hubMedTech Cybersecurity Standards
FDA guidance, AAMI, ISO, IEC, and NIST standards that govern medical device cybersecurity - what each one requires and how they connect.
Read topic hub Topic hubPostmarket Medical Device Cybersecurity
Vulnerability monitoring, CVD intake, patching, and FDA reporting for cleared devices - the postmarket program Section 524B now requires.
Read topic hub Topic hubSBOMs for Medical Devices
FDA-compliant SBOM generation, CVE/KEV monitoring, and the formats (SPDX, CycloneDX) reviewers expect in 510(k), De Novo, PMA, and IDE submissions.
Read topic hub Topic hubSoftware as a Medical Device (SaMD) Cybersecurity
Cybersecurity for Software as a Medical Device (SaMD) - cloud, mobile, and standalone software under FDA 2026 guidance, IEC 62304/81001-5-1, and Section 524B.
Read topic hub Topic hubThreat Modeling for Medical Devices
Threat models that hold up under FDA review - STRIDE applied to connected and implantable devices, AAMI SW96 alignment, and the gaps reviewers flag most often.
Read topic hubGlossary74
AAMI SW87
Standard for application of quality management system concepts to medical device data systems.
Read glossary Standards (AAMI/ISO/IEC/NIST)AAMI TIR97
AAMI TIR97:2019 - Principles for medical device security - Postmarket risk management for device manufacturers.
Read glossary FDA GuidanceAdditional Information (AI) Letter
FDA correspondence sent during review listing deficiencies the sponsor must address before clearance. Different from the AI in 'AI/ML'.
Read glossary AI/ML DevicesAdversarial Input
Crafted input designed to cause an ML model to misclassify or behave incorrectly while appearing normal to humans.
Read glossary Threat Modeling & RiskAttack Surface
Sum of all points where an unauthorized user can attempt to enter, extract data from, or interact with a device or system.
Read glossary Threat Modeling & RiskAttack Tree
Tree-structured diagram of how an attacker might achieve a specific goal, with nodes representing attack steps or sub-goals.
Read glossary Testing & ValidationBoundary Analysis
Security testing focused on inputs and behaviors at the edges of valid input ranges, often combined with fuzzing.
Read glossary Cryptography & IdentityCode Signing
Cryptographic signature applied to firmware or software so that a device or system can verify authenticity and integrity before installation.
Read glossary SBOM & Supply ChainCommon Platform Enumeration (CPE)
NIST identifier scheme for IT products and platforms. Used to map components to vulnerabilities in the NVD.
Read glossary Postmarket & LifecycleCommon Security Advisory Framework (CSAF)
OASIS standard for machine-readable security advisories. Increasingly expected for postmarket disclosures.
Read glossary Threat Modeling & RiskControlled vs Uncontrolled Risk
FDA postmarket framework distinguishing 'controlled' (acceptable residual) from 'uncontrolled' risk. Uncontrolled risk requiring action triggers reporting and remediation timelines.
Read glossary Core ConceptsCovert Channel
Unintended communication path that allows information to move in violation of policy or controls.
Read glossary Regulation & StatuteCyber Device
Per Section 524B, a device that (1) includes software validated/installed/authorized by the sponsor, (2) has the ability to connect to the internet, and (3) contains technological characteristics that
Read glossary Threat Modeling & RiskData Flow Diagram (DFD)
Diagram showing how data moves through a system, including processes, data stores, external entities, and trust boundaries.
Read glossary Core ConceptsDefense in Depth
Layered security strategy in which multiple controls protect against a given threat so that failure of one does not compromise the system.
Read glossary Threat Modeling & RiskDREAD
Legacy threat-rating method (Damage, Reproducibility, Exploitability, Affected users, Discoverability). Largely superseded by CVSS for scoring.
Read glossary Testing & ValidationDynamic Application Security Testing (DAST)
Testing of a running application by sending crafted inputs to find runtime vulnerabilities.
Read glossary Postmarket & LifecycleEnd-of-Life / End-of-Support (EOL/EOS)
Defined points at which a manufacturer stops shipping (EOL) or supporting (EOS) a product. Cybersecurity expectations include planning and customer notification well before EOS.
Read glossary EU & GlobalEU Cyber Resilience Act (CRA)
EU regulation imposing cybersecurity requirements on products with digital elements. Medical devices are largely carved out, but the interaction with MDR matters.
Read glossary Core ConceptsExploit Prediction Scoring System (EPSS)
Data-driven estimate of the probability that a CVE will be exploited in the wild within the next 30 days.
Read glossary FDA GuidanceFDA AI/ML Lifecycle Guidance
FDA's evolving framework for AI/ML-enabled device software, including Predetermined Change Control Plans (PCCPs) and Good Machine Learning Practices.
Read glossary FDA GuidanceFDA Postmarket Cybersecurity Guidance (2016)
FDA guidance on managing cybersecurity vulnerabilities and exploits in marketed and distributed medical devices, including the controlled-vs-uncontrolled risk framework.
Read glossary FDA GuidanceFDA Premarket Cybersecurity Guidance (Feb 2026)
FDA's final premarket cybersecurity guidance, effective February 3, 2026. Defines the seven-section cybersecurity submission format reviewers enforce at Technical Screening.
Read glossary Cryptography & IdentityFIPS 140-2 / 140-3
US federal standards for cryptographic modules. Often referenced for cloud-connected device backends.
Read glossary Regulation & StatuteFood, Drug, and Cosmetic Act (FD&C Act)
The federal statute that gives FDA its authority over food, drugs, devices, and cosmetics in the United States.
Read glossary Testing & ValidationFuzz Testing
Automated testing technique that supplies malformed or unexpected inputs to find crashes, hangs, or memory-safety bugs. Expected for protocol parsers and exposed interfaces.
Read glossary Cryptography & IdentityHardware Root of Trust
Tamper-resistant hardware element (TPM, secure element, HSM) that provides the foundation for secure boot, attestation, and key storage.
Read glossary EU & GlobalHealth Canada
Canadian medical-device regulator. Publishes premarket cybersecurity guidance broadly aligned with FDA.
Read glossary Standards (AAMI/ISO/IEC/NIST)IEC 60601 series
Family of standards covering basic safety and essential performance of medical electrical equipment.
Read glossary Postmarket & LifecycleIncident Response (IR)
Coordinated process to detect, contain, eradicate, and recover from a cybersecurity incident.
Read glossary Postmarket & LifecycleISO/IEC 29147
International standard for vulnerability disclosure processes.
Read glossary Postmarket & LifecycleISO/IEC 30111
International standard for vulnerability handling processes inside an organization.
Read glossary Cryptography & IdentityKey Management
Lifecycle of cryptographic keys: generation, distribution, storage, rotation, revocation, and destruction.
Read glossary Core ConceptsKnown Exploited Vulnerabilities Catalog (KEV)
CISA-maintained catalog of vulnerabilities known to be actively exploited. Useful prioritization input for postmarket monitoring.
Read glossary Core ConceptsLeast Privilege
Principle that every component, user, and process should operate with the minimum permissions necessary.
Read glossary AI/ML DevicesMachine Learning Bill of Materials (ML-BOM)
Inventory of model artifacts, datasets, and dependencies - a CycloneDX extension applicable to AI/ML medical devices.
Read glossary EU & GlobalMDCG 2019-16
Medical Device Coordination Group guidance on cybersecurity for medical devices under the EU MDR/IVDR.
Read glossary Core ConceptsMemory Safety
Property of code that prevents access to memory in unintended ways. Lack of memory safety is the root cause of a large share of CVEs.
Read glossary SBOM & Supply ChainMinimum Elements for an SBOM (NTIA)
NTIA-defined baseline data fields for any SBOM: supplier, component name, version, unique identifier, dependency relationship, author, and timestamp.
Read glossary Threat Modeling & RiskMITRE ATT&CK
Globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs). Useful for threat modeling and detection engineering.
Read glossary Threat Modeling & RiskMITRE CAPEC
Common Attack Pattern Enumeration and Classification - catalog of common attack patterns used to model threats.
Read glossary Threat Modeling & RiskMITRE CWE
Common Weakness Enumeration - community-developed list of common software and hardware weakness types.
Read glossary AI/ML DevicesModel Drift
Degradation of model performance over time as real-world data diverges from training data. A key postmarket monitoring concern for AI/ML devices.
Read glossary AI/ML DevicesModel Poisoning
Attack in which an adversary injects malicious data into model training to degrade accuracy or insert backdoors.
Read glossary Cryptography & IdentityMulti-Factor Authentication (MFA)
Authentication that requires two or more independent factors (something you know, have, or are).
Read glossary Cryptography & IdentityMutual TLS (mTLS)
TLS variant requiring both client and server to present X.509 certificates. Common for device-to-cloud authentication.
Read glossary Core ConceptsNational Vulnerability Database (NVD)
NIST-maintained database that enriches CVE entries with CVSS scores, CWE mappings, and CPE identifiers.
Read glossary EU & GlobalNIS2 Directive
EU directive on measures for a high common level of cybersecurity across the Union. Touches healthcare operators that may use medical devices.
Read glossary Standards (AAMI/ISO/IEC/NIST)NIST SP 800-30
Guide for conducting risk assessments. Useful baseline for IT-side risk methodology, complementary to AAMI SW96 on the device side.
Read glossary Core ConceptsOWASP Top 10
Industry-standard list of the most critical web application security risks. The Mobile and API Top 10 lists are also frequently cited.
Read glossary SBOM & Supply ChainPackage URL (purl)
Standardized URL format for identifying software packages across ecosystems (npm, PyPI, Maven, etc.). Common identifier in SBOMs.
Read glossary Threat Modeling & RiskPASTA
Process for Attack Simulation and Threat Analysis - risk-centric, seven-stage threat modeling methodology.
Read glossary Regulation & StatutePATCH Act
Protecting and Transforming Cyber Health Care Act - the legislative vehicle that became Section 524B inside the Consolidated Appropriations Act, 2023.
Read glossary Postmarket & LifecyclePatch Management
Process for identifying, testing, releasing, and tracking software updates to remediate vulnerabilities and bugs over a device's supported life.
Read glossary Threat Modeling & RiskPatient Harm Linkage
Discipline of tracing each cybersecurity threat to a possible patient-safety consequence - the bridge between cyber risk and ISO 14971 risk.
Read glossary Testing & ValidationPenetration Test
Authorized simulated attack on a device or system to find exploitable vulnerabilities. Required testing artifact in FDA cybersecurity submissions.
Read glossary Cryptography & IdentityPost-Quantum Cryptography (PQC)
Cryptographic algorithms resistant to attack by large-scale quantum computers. NIST has standardized initial PQC algorithms; long-lived devices need a migration plan.
Read glossary Postmarket & LifecyclePostmarket Cybersecurity Monitoring Plan
Documented plan describing how the manufacturer monitors for new vulnerabilities and threats affecting marketed devices, and how decisions get made.
Read glossary Postmarket & LifecycleProduct Security Incident Response Team (PSIRT)
Team responsible for receiving, triaging, and responding to security issues affecting an organization's products.
Read glossary Regulation & StatuteProtected Health Information (PHI)
Individually identifiable health information protected under HIPAA.
Read glossary Cryptography & IdentityPublic Key Infrastructure (PKI)
System of certificate authorities, certificates, and revocation that binds public keys to identities.
Read glossary Testing & ValidationRed Team Exercise
Goal-based adversary simulation across people, process, and technology - broader in scope than a scoped penetration test.
Read glossary Testing & ValidationSecure Code Review
Manual or tool-assisted review of source code focused on security defects - auth flaws, crypto misuse, input validation, memory safety.
Read glossary Core ConceptsSecure Coding Standards
Language- and platform-specific guidance (e.g., CERT C, MISRA) for writing software that resists common security defects.
Read glossary Core ConceptsSecure Software Development Framework (NIST SSDF)
NIST SP 800-218 - set of practices for integrating security into the software development lifecycle. Maps cleanly to FDA SPDF expectations.
Read glossary Testing & ValidationSoftware Composition Analysis (SCA)
Automated identification of open-source and third-party components and their known vulnerabilities. Inputs into SBOM and VEX.
Read glossary SBOM & Supply ChainSoftware Identification Tag (SWID)
ISO/IEC 19770-2 tags identifying installed software. One of the SBOM-compatible identifier formats.
Read glossary Testing & ValidationStatic Application Security Testing (SAST)
Analysis of source code or binaries without executing them, to identify security defects.
Read glossary SBOM & Supply ChainSupply Chain Risk Management (SCRM)
Discipline of identifying, assessing, and mitigating risks from third-party software, firmware, hardware, and services in the device supply chain.
Read glossary SBOM & Supply ChainThird-Party / OTS Component
Off-the-shelf software, firmware, or hardware integrated into the device that the manufacturer did not author. Subject to FDA documentation expectations.
Read glossary Cryptography & IdentityTransport Layer Security (TLS)
Cryptographic protocol providing confidentiality and integrity for network communications. TLS 1.2+ is the floor for medical device cloud links.
Read glossary Threat Modeling & RiskTrust Boundary
Line in a system architecture across which the level of trust changes. Common locations for security controls and threat enumeration.
Read glossary Standards (AAMI/ISO/IEC/NIST)UL 2900 series
UL standards for software cybersecurity for network-connectable products, including UL 2900-2-1 specific to medical devices.
Read glossary Testing & ValidationVulnerability Assessment
Systematic identification of known vulnerabilities (typically via automated scanners) without active exploitation.
Read glossaryPages16
About Blue Goat Cyber
--- title: "About Blue Goat Cyber" description: "Blue Goat delivers full-service medical device cybersecurity, including secure design, FDA-submission-ready documentation/testing, and postmarket manag
Read page PageAccelerate FDA & Regulatory Clearance with Full-Service Medical Device Cybersecurity
--- title: "Medical Device Cybersecurity Services | FDA Submission Experts" description: "Full-service total lifecycle medical device cybersecurity for FDA & global submissions: pen testing, SPDF, SBO
Read page IndustriesAccelerate FDA & Regulatory Clearance with Full-Service Medical Device Cybersecurity
--- title: "Medical Device Cybersecurity Services | FDA Submission Experts" description: "Full-service total lifecycle medical device cybersecurity for FDA & global submissions: pen testing, SPDF, SBO
Read page IndustriesAccelerate FDA & Regulatory Clearance with Full-Service Medical Device Cybersecurity
--- title: "Medical Device Cybersecurity Services | FDA Submission Experts" description: "Full-service total lifecycle medical device cybersecurity for FDA & global submissions: pen testing, SPDF, SBO
Read page AboutAwards & Recognition
--- title: "Awards" description: "Awards & Recognition At Blue Goat Cyber, we take pride in delivering best-in-class cybersecurity services to medical device manufacturers worldwide. Our work has earn
Read page AboutBlue Goat Cyber Leadership
--- title: "Leadership" description: "Blue Goat Cyber's Leadership team brings decades of experience in medical device cybersecurity and regulatory compliance." slug: "leadership" path: "about-us/lead
Read page PageChristian Espinosa
--- title: "Christian Espinosa" description: "Founder & CEO · Blue Goat Cyber Christian Espinosa Medical device cybersecurity, treated as patient safety. Not a compliance checkbox. LinkedIn · Forbes C
Read page PageCoordinated Vulnerability Disclosure (CVD)
--- title: "Coordinated Vulnerability Disclosure (CVD)" description: "Coordinated Vulnerability Disclosure (CVD) Email: cvd@bluegoatcyber.com Phone: (844) 939-4628 (GOAT)" slug: "cvd" path: "cvd" sour
Read page Pageform submission confirmation
--- title: "Form Submission Confirmation" description: "Thanks for Your Submission! We will be in touch as soon as possible. Feel free to grab some time on our calendar as well.We look forward to work
Read page PageFrequently Asked Questions (FAQs)
--- title: "FAQs" description: "Frequently Asked Questions (FAQs) Common questions asked about Blue Goat Cyber and our services. General FAQs About Blue Goat Cyber What does Blue Goat Cyber specialize
Read page PageGet Expert Medical Device Cybersecurity Support Today
--- title: "Contact Us" description: "We offer outstanding cybersecurity services. We specialize in penetration testing, medical device security, and fractional CISO services. Contact us today." slug:
Read page PageMedical Device Cybersecurity Resources
--- title: "Medical Device Cybersecurity Resources" description: "Medical device cybersecurity resources, guides, and tools to support FDA premarket, postmarket, SBOM, and secure product development l
Read page Pagemeeting confirmation
--- title: "Meeting Confirmation" description: "Thanks for Booking a Discovery Meeting We just sent you a calendar invite for a Zoom meeting.We are excited to meet with you and learn more about your r
Read page PagePartners
--- title: "Partners" description: "We believe we can achieve more together than we can alone. We seek potential partnerships with organizations that share our values, passion, and commitment." slug:
Read page PagePrivacy Policy
--- title: "Privacy Policy" description: "Blue Goat Cyber Privacy Policy." slug: "privacy-policy" path: "privacy-policy" sourceUrl: "https://bluegoatcyber.com/privacy-policy" image: "/imported-images/
Read page PageThe Med Device Cyber Podcast
--- title: "The Med Device Cyber Podcast" description: "Med Device Cyber Podcast: practical medical device cybersecurity insights, real-world threats, and global regulatory updates for MedTech teams."
Read pageGet FDA cleared without the cybersecurity headaches.
30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ submissions.