Rehearse a cybersecurity incident on your marketed device before it happens. Part of our postmarket program, scoped to your device and response plan.
Part of FDA postmarket cybersecurity services.
Each exercise uses one scenario adapted to your device. These are starting points, not a fixed menu.
A security researcher contacts you about a remotely exploitable vulnerability in a fielded device and plans to publish in 45 days.
Tests: Disclosure intake, triage, patient-harm assessment, and customer communication.
A component in your SBOM is added to the CISA Known Exploited Vulnerabilities catalog on a Friday afternoon.
Tests: Exploitability assessment, out-of-cycle patch decision, and compensating controls.
A hospital customer reports ransomware on its network and asks whether your devices are affected or spreading it.
Tests: Evidence preservation, containment guidance, and coordination with the customer.
Your update server or cloud platform shows signs of unauthorized access affecting many patients at once.
Tests: Multi-patient impact, service shutdown decisions, and recovery.
Agree objectives, participants, the device and versions in scope, your current response plan, and whether the session is remote or on-site.
We build a device-specific scenario with timed injects from your architecture, threat model, SBOM, and deployment environment.
A discussion-based session, usually half a day, with engineering, product security, regulatory, quality, and customer-facing teams.
Response gaps, decision points, action owners, and priorities for updating your incident response plan.
A typical half-day session. Timing and injects are adjusted to your scenario and team.
Objectives, ground rules, roles, and the device and versions in scope.
The initial report or alert arrives. Who receives it, how is it logged, and who is told?
Exploitability, affected versions, and patient-safety impact. Who decides severity?
The situation worsens. Containment, customer guidance, and communication with regulators and researchers.
Patch or mitigation, field rollout, and confirming the fix reached deployed devices.
What worked, what was unclear, and where the response plan did not match what people did.
Agree action owners and next steps for the after-action report.
A tabletop exercise can be included with your postmarket retainer by agreement. Additional or standalone exercises are priced on exercise scope, delivery location, on-site requirements. You get a written price after a short scoping call.
Tell us about your device, your team, and whether you want remote or on-site. We reply within one business day to schedule scoping.
