Struggling to meet the FDA's cybersecurity testing requirements? We identify vulnerabilities and deliver FDA-ready reports - fast, accurate, and aligned with current guidance. We recommend white-box testing for medical devices, and so does the FDA.
The short answer
Medical device penetration testing is white-box security testing of a device and everything it connects to - firmware, hardware debug interfaces, wireless radios, the companion app, the APIs, and the cloud back end - run against your source code, architecture, and threat model. For an FDA submission it has to do four things the 2026 premarket guidance calls out: verify security requirements, verify threat mitigations, run vulnerability testing, and run true penetration testing. The deliverable is an FDA-formatted report with CVSS and ISO 14971 patient-harm ratings, threat-model traceability, and documented tester independence, scope, methods, and results.
275+ Devices Secured. Mostly Manual, Expert-Led Testing.
Trusted by leading MedTech companies
The scope of a connected-device test
We agree the device version, interfaces, test environment, access, and rules of engagement before work begins. Your threat model and cybersecurity hazard analysis determine the attack paths we test, not an asset count alone.
Firmware · stored keys · debug ports
Secure boot & signed updates
Bluetooth · Wi-Fi · pairing
Authentication & replay resistance
Local data · sessions · commands
Authorization & secure storage
APIs · accounts · update delivery
Access control & tenant isolation
Hardware and debug ports, firmware and update paths, BLE and Wi-Fi, companion mobile apps, APIs, web portals, and cloud services. Clinical protocols such as DICOM, HL7, and FHIR are included when relevant to your device and agreed scope.
Penetration testing includes dynamic, adversarial testing and the Test Plan, Test Cases, and Test Report. SAST, software composition analysis, SBOM work, and threat-model rework are scoped separately or bundled explicitly. This is security testing, not general software testing.
Unlimited retests until every finding with uncontrolled risk is closed. Risk disposition remains a documented manufacturer decision.
Generic penetration testing firms lack the understanding of unique device architecture, patient risks, and regulatory demands. Their reports may be thorough, but not FDA-compliant - and they almost always default to black-box only.
The FDA expects testers to leverage source code, threat models, and architecture (white-box). Black-box-only engagements miss the deep flaws reviewers ask about - and lead to deficiencies.
Generic vendors miss firmware, wireless, and embedded paths unique to medical devices.
Reports without FDA-aligned structure, traceability, and evidence get rejected by reviewers.
"Blue Goat Cyber's depth of expertise was impressive. We had no in-house cybersecurity experience, and their team guided us through every step of the FDA process. The penetration testing and SBOM testing were thorough and gave us complete confidence."
The FDA's February 3, 2026 premarket cybersecurity guidance describes security requirement verification, threat mitigation verification, vulnerability testing, and penetration testing. We define the applicable security checks and interfaces in your scope; SAST, software composition analysis, and SBOM work are separate unless explicitly bundled.
The full stack a connected medical device exposes - from the clinician portal down to the implant firmware. Every layer is in scope when it matters to patient safety or regulatory submission.
Layers shown outermost (top) to innermost (bottom). Dashed rows are part of the surrounding system but out of scope for this view.
Every project gets a dedicated project manager from kickoff to final report, so you always know what is happening and what we need from you.
Once the contract is signed, we assign your project manager and hold a kickoff call to confirm scope, dates, and contacts.
We set up a private Slack channel for day-to-day questions and secure shares for exchanging documents.
We collect the Instructions for Use (IFU), Software Architecture Document (SAD), hazard analysis and threat model. Testing starts only once a threat model and hazard analysis exist. No threat model or hazard analysis yet? We can build them. Already have them? We can run a gap assessment of both.
We confirm whether devices ship to our lab or we travel to you, and that units, accounts, tools and the test setup are ready.
We run the test plan against the exact device version you plan to submit.
You get a short findings summary right after testing, so engineering can start fixing before the full report is done.
Test Plan, Test Cases and Test Report, with every finding traced to a threat and a patient harm.
Your engineering team makes the fixes. We verify them and update the evidence, with unlimited retests until every finding with uncontrolled risk is closed. Risk disposition remains your documented decision.
Every medical device penetration testing engagement ships with the artifacts FDA reviewers expect to see - traceable, complete, and aligned with current guidance.
A simple device starts at about $15,000, with a reasonable turnaround and no travel. After the scoping call, you receive a fixed-fee quote in writing within 24 hours. The agreed scope includes the Test Plan, Test Cases, Test Report, and unlimited retests until every finding with uncontrolled risk is closed.
Fixed fee after scoping
A targeted scope for a simple device or a specific attack surface, such as firmware, BLE, or a cloud API. Suitable for vulnerability investigation or closing a defined evidence gap; it is not a substitute for full-system submission coverage.
Fixed fee after scoping
Typical Class II connected device: firmware, hardware interfaces, BLE or Wi-Fi, companion app, REST APIs, and cloud back end. Full-attack-surface coverage for a 510(k) or De Novo.
Fixed fee after scoping
Class III and PMA submissions, implantables, surgical platforms, multi-device ecosystems, AI/ML inference services, or several products tested in parallel.
Larger scopes are priced after the scoping call. Timeline is 3 to 5 weeks for most engagements and 6 to 8 weeks for large ecosystems.
How much does medical device penetration testing cost? Full breakdown
Every medical device penetration testing engagement produces evidence aligned to the regulatory and consensus standards FDA reviewers and notified bodies expect to see - traceable, complete, and ready to drop into your ISO 13485 quality system.
Recommends risk-based cybersecurity evidence, including threat modeling, architecture views, and testing. An SPDF is encouraged, not mandatory; Section 524B separately establishes statutory duties for covered cyber devices.
The consensus standard for medical device security risk management - asset, threat, vulnerability, likelihood, severity, and residual risk acceptability.
Foundational risk management standard. Cybersecurity risk is tied directly to patient-safety risk in the 14971 file.
Industrial-strength secure-development-lifecycle requirements applied to connected medical devices.
Reference methodology for planning, executing, and reporting security testing.
Recalls, CISA ICS-MA advisories, and disclosed research that shape what reviewers ask about - and what this engagement is built to cover.
Conexus RF protocol lacked encryption and authentication, allowing nearby attackers to read or modify implant communications. Drove industry-wide expectations on telemetry confidentiality and integrity.
Multiple advisories spanning auth bypass, hard-coded credentials, and improper input validation. Reinforced reviewer scrutiny of in-hospital network-exposed devices.
Improper auth between monitor and cloud allowed certain monitor functions to be impersonated. Demonstrates why home-monitor + cloud must be tested together, not separately.
Wi-Fi credential persistence and improper access control. Drove the FDA's continued focus on credential lifecycle and decommissioning in hospital-deployed devices.
Imaging device, PACS, or viewer? Answer these and get a one-page scoping sheet for your DICOM security test. Takes about two minutes.
Which DICOM services does it expose?
Pick everything the device answers on its DICOM port.
Which transfer syntaxes does it support?
What role does it play on the imaging network?
What sits in front of the DICOM port?
What test environment can you give us?
Please don't enter confidential details here.
We'll email you a link to book a free discovery call; the fixed-fee proposal follows the call. Want to try the protocol yourself first? Download the DICOM seed corpus and read the DICOM fuzzing guide.
Testing for a hospital, health system, or connected health product? See our healthcare penetration testing overview for how scope differs for healthcare organizations and medical device makers. For what the FDA expects around testing, read FDA cybersecurity requirements for medical devices.
Secure your Wi-Fi and wireless attack surface.
View Wireless Penetration TestingOne package for applicable FDA cybersecurity documentation, threat modeling, SBOMs, testing, and submission support.
View FDA Premarket Cybersecurity PackageGot an FDA hold or AI letter? We close cybersecurity deficiencies fast.
View FDA Deficiency ResponseSee how this service applies to your specific MedTech segment.
Curated reading for teams working on medical device penetration testing - grouped by format so you can jump to what you need.
Long-form reference reading - architecture, frameworks, and end-to-end how-tos.
Shorter posts on the specific gotchas, deficiencies, and reviewer expectations we see most.
Pressure-test the work yourself before you scope an engagement. No signup, results are yours to keep.
Struggling to meet the FDA's cybersecurity testing requirements? We identify vulnerabilities and deliver FDA-ready reports - fast, accurate, and aligned with current guidance. We recommend white-box testing for medical devices, and so does the FDA.
For medical devices, both Blue Goat and the FDA recommend white-box testing. Reviewers expect testers to leverage source, firmware, and threat models - black-box alone routinely leads to deficiencies.
| Capability | Black-box | Gray-box | White-box |
|---|---|---|---|
| Source code access | |||
| Firmware / binaries | |||
| Threat model & architecture | |||
| Authenticated test paths | |||
| Deep logic + business-flow flaws | |||
| Aligned with FDA expectations | |||
| Scope coverage per test-day |
Premarket guidance and consensus standards both expect testers to leverage source code, design artifacts, and threat models, not just an external view of the device.
Calls for security testing that demonstrates device resilience using design documentation, threat models, and source-level analysis, not black-box probing alone.
Requires sponsors to provide reasonable assurance that the device and related systems are cybersecure - which reviewers read as evidence-backed, white-box-informed testing.
Frames security testing as an output of threat modeling and architecture analysis. That is white-box by definition.
Postmarket monitoring and vulnerability handling assume testers have access to internals - the same access white-box pen testing uses premarket.
How an engagement runs
Every project gets a named project manager. The intake documents in step 2 let us trace each finding to your threat model and rate its risk in terms of patient harm, which is what FDA reviewers look for.
Contract signed, project manager assigned, shared Slack channel and secure file shares set up.
You send the documents below so every finding traces to a threat and a hazard.
Test setup, device shipping or on-site travel agreed.
Mostly manual, white-box testing of device, firmware, radios, app and cloud.
Early summary of findings so your engineers can start fixing right away.
Test Plan, Test Cases, and FDA-formatted Test Report with CVSS and patient-harm ratings.
We retest your fixes until the findings are closed.
Step 2: what we ask for before testing
Instructions for Use (IFU)
How the device is used and by whom
System architecture
What connects to what
Threat model
What we test against. We can build it if you don't have one.
Hazard analysis
Links each finding to patient harm
See the full engagement, from first call to postmarket support →
Traceability
A CVSS score says how easy an attack is. It doesn't say whether a patient could be hurt. We link every finding to your threat model and hazard analysis, so its risk is rated in terms of patient harm and FDA reviewers can follow the chain from threat to fix.
Names the threats and attack paths. Each test case traces back to a threat.
Threat: an attacker nearby sends commands over Bluetooth without pairing.
Names what could hurt a patient if the device misbehaves (ISO 14971).
Hazard: the device delivers the wrong therapy setting.
What we proved during testing, tied to the threat it came from.
Finding: therapy settings can be changed over Bluetooth without authentication.
How easy the attack is, scored with CVSS.
Low skill needed, attacker must be within Bluetooth range.
Exploitability combined with the linked hazard's severity. This rating, not CVSS alone, sets priority.
Rated high: a wrong therapy setting can harm the patient.
The fix is verified in a retest, and the full chain goes into your FDA report.
Pairing and command authentication added, retest passes.
The example lines show an illustrative case, not a specific client engagement.
White-box is our default for premarket cyber devices - it's the only depth that gives FDA reviewers full coverage evidence. Gray-box adds credentialed ecosystem testing where it matters. Black-box is reserved for specific post-market or adversary-simulation scenarios.
Full source, firmware, and architecture access. The only depth that gives FDA reviewers full coverage evidence for cyber devices.
See White-box pen testing pen testingPartial credentials and architecture insight. A credentialed ecosystem add-on alongside white-box.
See Gray-box pen testing pen testingZero prior knowledge. Reserved for adversary-simulation drills and specific post-market scenarios - not sufficient on its own for FDA.
See Black-box pen testing pen testingAligned to FDA Feb 2026 guidance, §524B, AAMI TIR57, ANSI/AAMI SW96, with CVSS v4.0 scoring.
See Our 7-phase methodology pen testingFDA penetration testing does not need a letter of attestation. We deliver three traceable documents: the Test Plan, Test Cases, and Test Report. The evidence documents tester independence and expertise, scope, duration, methods, findings, and retest results.
Scope anchored to the threat model, the device build and environment, methods, tools, schedule, rules of engagement, and tester independence. Agreed before testing begins.
Each case links a threat scenario and security requirement to the test method, expected and actual results, and any finding. Stable identifiers connect the plan to the evidence.
Tester independence and expertise, scope, duration, methods, findings, patient-harm context, and retest status. Unresolved findings and the manufacturer's documented risk disposition remain visible.
A transparent, side-by-side look at what you actually get - no vague promises.
Pre-submission penetration test required, with a tight 6-week window before FDA filing. Prior vendor returned a generic scan report that wouldn't satisfy 2026 guidance.
Complex multi-component system (implant, programmer, clinician portal) with PMA filing under FDA 2026 guidance. Needed full SBOM, threat model, and pen test evidence.
A sample of the kinds of issues we surface during medical device penetration tests. Devices and identifiers are redacted.
Allowed any nearby attacker to pair and exfiltrate ECG telemetry without user consent.
Remote attacker on hospital network could push unsigned firmware, altering dosing logic.
Patient identifiers and readings recoverable from a lost or stolen phone with no jailbreak.
Session prediction allowed cross-tenant access to clinician dashboards.
JTAG/UART left open allowed local code extraction and reverse engineering.
TLS 1.0 fallback exposed device-to-cloud channel to downgrade attacks.
Plug in your monthly burn, expected launch revenue, and delay window. Most manufacturers see $1M+ exposure on a single cyber hold. Most engagements are a small fraction of that.
Answer a few quick questions about your device classification, connectivity, and FDA path. We'll suggest the right testing track and surface the fastest wins for your submission.
Our team holds the offensive security certifications real attackers respect, backed by hands-on U.S. government red team and military cyber operations experience.
Our work has been honored by the leading voices in medical device cybersecurity.
Medical Tech Outlook
Cover story profiling Blue Goat Cyber as a top industry leader
MedTech World Malta 2025
Sponsored by the Malta Medicines Authority
MedTech World North America
Inaugural North America Awards, in collaboration with CS Lifesciences
