AI/ML-enabled SaMD faces a new class of threats - data poisoning, evasion, model inversion, membership inference, and prompt injection - that traditional pen tests miss. We build the threat model, run the adversarial testing, and author the PCCP and transparency artifacts FDA reviewers expect - layered on top of our full SaMD Cybersecurity premarket package so the AI obligations and the underlying Section 524B submission ship as one accountable deliverable.
The short answer
Beyond the standard Section 524B deliverables, an AI/ML device needs its threat model and testing to cover attacks on the model itself: poisoned training data, adversarial inputs that change outputs, model theft and tampering with updates. If you use a Predetermined Change Control Plan (PCCP), the security of how model updates are built and deployed has to be covered too. We threat model and test these paths alongside the device.
Aligned to FDA PCCP, GMLP, the 2025 AI-Enabled Device Software Functions draft guidance, AAMI CR34971, and NIST AI RMF - extends our SaMD Cybersecurity service.
AI/ML systems fail in ways traditional security testing cannot detect. FDA reviewers know it - and they're starting to ask.
Pen testers probe APIs, ports, and OS. They don't fuzz the decision boundary, craft adversarial examples, or test for poisoned training data - the things that actually break a clinical AI.
A model trained on biased, incomplete, or tampered data can be perfectly 'secure' in the IT sense and still produce unsafe clinical outputs. ISO 14971 alone doesn't cover this - AAMI CR34971 does.
PCCP, GMLP, and the 2025 draft guidance expect you to document how the model is monitored, retrained, and re-validated. A one-time test won't satisfy reviewers.
Mapped to NIST AI RMF, MITRE ATLAS, and OWASP ML Top 10. Tailored to your device's modality, deployment, and clinical use.
AI/ML devices add surfaces traditional pen tests miss: model weights, training data integrity, inference paths, and the PCCP cybersecurity boundary. Each is covered explicitly.
Layers shown outermost (top) to innermost (bottom). Dashed rows are part of the surrounding system but out of scope for this view.
Threat model first, then test what matters, then document for FDA.
STRIDE + MITRE ATLAS view of your model, training pipeline, deployment, and clinical workflow. Trust boundaries, data flows, and ATLAS technique mapping.
Scoped attacks tied to your device's clinical risk - not a generic checklist. Justified methodology FDA reviewers can audit.
Adversarial ML testing, prompt-injection campaigns, privacy attacks, and supply-chain audit. Manual-led, with reproducible artifacts.
Predetermined Change Control Plan, transparency labeling per the 2025 draft guidance, model card, and risk-control traceability.
Drift detection, retraining triggers, performance monitoring, and incident response - so postmarket holds up.
Every ai/ml medical device security engagement ships with the artifacts FDA reviewers expect to see - traceable, complete, and aligned with current guidance.
Recalls, CISA ICS-MA advisories, and disclosed research that shape what reviewers ask about - and what this engagement is built to cover.
Established explicit cybersecurity expectations for AI/ML medical devices, including model-update channel integrity, training-data provenance, and adversarial robustness narratives tied to intended use.
Executable code embedded in DICOM file preambles can survive ingestion. For AI/ML SaMD that consumes DICOM as inference input, this is a first-class threat vector that must be modeled and tested.
AI/ML-enabled SaMD faces a new class of threats - data poisoning, evasion, model inversion, membership inference, and prompt injection - that traditional pen tests miss. We build the threat model, run the adversarial testing, and author the PCCP and transparency artifacts FDA reviewers expect - layered on top of our full SaMD Cybersecurity premarket package so the AI obligations and the underlying Section 524B submission ship as one accountable deliverable.
