Medical device cybersecurity consulting from design through postmarket
Start with a scoped consulting engagement for the design questions, threat model, architecture review, or cybersecurity documentation you need now. No monthly retainer is required. If your team needs ongoing support, choose an optional retainer. The manufacturer owns risk acceptance, patch, and customer-notice decisions.
Monthly retainer: Starting at $5,000 a month. Final monthly fee is fixed after scoping. Specific deliverables are quoted separately at a fixed fee.
275+ FDA submissions supported, zero cybersecurity rejections.
- Monthly retainer
- Scoped deliverables
- Product cybersecurity
- Fixed fees after scoping
Tell us about your project in the form below. Bring your intended use and a system sketch; no prototype is required.
- Free 30-min call
- No obligation
- Senior expert, not a sales rep
- Fixed-fee quote in 24 hours
- NDA available on request
Start with the consulting work you need
You do not need a retainer to work with Blue Goat. Start with a specific design question, a documentation gap, or an agreed set of deliverables. Ongoing support is an option, not a prerequisite.
Scoped consulting engagement
A focused engagement for the decisions or documents your team needs now. Agree on the work and outputs without committing to a monthly retainer or a later full submission package.
Fee and scope agreed before work begins.
Your proposal defines the inputs, priorities, deliverables, review terms, and exclusions. Additional work requires your agreement.
Optional monthly retainer
A Fractional Product Security Officer for recurring design questions, reviews, and agreed documentation work. Up to 20 hours a month of expert access.
Starting at $5,000 a month. Final monthly fee is fixed after scoping.
This starting price applies to the retainer, not to standalone projects. Larger projects and additional help require separate agreement.
Focused consulting scopes
- Architecture and interface decisions. Compare connectivity options, authentication, remote configuration, cloud boundaries, and update approaches before the design is settled.
- Early threat modeling. Document data flows and trust boundaries, build a preliminary threat model, or update an existing model for new connectivity.
- Cybersecurity requirements. Draft requirements or review your team's draft, with recommendations and open questions recorded.
- Documentation and procedure gap analysis. Review existing cybersecurity documents, SOPs, and work instructions to identify what needs updating. Procedure changes require separately agreed scope and manufacturer approval.
These are scope options, not a bundle included in every engagement. We agree on the work your team needs. Blue Goat advises; your engineering team implements. Penetration testing and full submission packages are separately scoped, with no obligation to purchase follow-on work. See the framework behind this work: Secure Product Development Framework (SPDF) consulting.
Bring us in at design, not 60 days before submission
Most manufacturers call us about 60 days before their premarket submission. By then, the architecture is locked. The processor is chosen. The wireless stack, the debug ports, the update mechanism, and the cloud design are all settled. We can document and test what was built. We can't change what it is.
The right time to bring us in is the design phase, while the decisions that determine your device's security are still open.
Decisions at the whiteboard decide what an attacker can reach
What an attacker can do to a patient's device is settled long before the submission. It's settled when your team chooses how the device authenticates, how firmware updates are signed, which ports stay open, and how the cloud separates one hospital's data from another's. Patients carry the risk of those decisions.
Why early matters
- The threat model is a design input. Under FDA's Quality Management System Regulation, the threat model and security requirements are design inputs. Design inputs exist before the design they shape.
- Security requirements are approved as design inputs. They tell engineering what to build. Written after the fact, they only describe what was built.
- Controls chosen at design are stronger than controls added later. A weakness found during design can be designed out. The same weakness found during testing often can only be mitigated, and sometimes only through labeling. Design controls are stronger than labeling, and labeling is stronger than nothing.
- FDA expects security across the lifecycle. FDA's February 2026 premarket guidance asks for a Secure Product Development Framework, a threat model, and security architecture views. Those documents describe design decisions. If security wasn't part of the decisions, the documents describe the gaps.
What a design-phase review catches
In 2026, Blue Goat reviewed version 1 of a surgical robot's software architecture document, while the design was still open. The review covered three of the security architecture views FDA's February 2026 premarket guidance describes: the multi-patient harm view, the updatability and patchability view, and the security use case views.
It raised 26 findings. Each one stated what was missing, the guidance basis for it, and the change requested. Among them:
- No update mechanism existed for any part of the system. A device that can't be updated can't be patched when a vulnerability is found in the field.
- The update flow had no signature verification step.
- Third-party components had no path to be patched in the field.
- A networking component's firmware gave its vendor a separate update channel into the system.
- No security use case covered commanding the robot's instrument motion, the function closest to the patient.
- No threat model or risk assessment was referenced anywhere in the architecture document.
At version 1, each of these is a design decision the team can still make. After design freeze, the same issues go through design change control and re-verification. Some, like adding an update mechanism, can reach into hardware.
That is the difference between bringing us in at design and bringing us in 60 days before submission.
Bring us in at design"We're not ready for cybersecurity yet."
We hear this more than any other objection. It usually means there's no prototype yet, no budget for a security team yet, or the submission feels far away. None of them is a reason to wait.
Once a design is locked, every security change goes through design change control and re-verification. The cheapest time to get security right is before anything is built.
Podcast · Episode 89
When Should You Start Medical Device Cybersecurity?
What "ready" actually looks like
You need two things to start: your intended use, and a sketch of how the system fits together, meaning the device, the app, the cloud, and how data moves between them. That's enough for a first threat model. It costs far less to change a whiteboard than a circuit board.
Why choose Blue Goat
- Medical device cybersecurity is all we do. Patient safety drives every recommendation.
- 275+ FDA submissions supported, zero cybersecurity rejections.
- One documented methodology links threat modeling, risk scoring, and testing.
- Fixed-fee pricing, agreed before work starts.
- We advise. Your team keeps ownership of risk and release decisions.
Choosing a consulting partner
Medical Device Cybersecurity Consulting: Buyer's Guide
Compare deliverables, retainer scope, pricing, exclusions, and manufacturer responsibilities before requesting a proposal.
Related penetration-testing case study
510(k) penetration testing for an AI-enabled cloud SaMD
This case study covers penetration testing, not a consulting-retainer engagement. Penetration testing is scoped separately.
The retainer model: a fractional product security officer
A fractional product security officer is a part-time product security lead for your device. Blue Goat delivers it through medical device cybersecurity consulting, with a monthly retainer for product security. For a fixed monthly fee, a named senior advisor who knows your device works with your team every week: answering FDA, Notified Body, and hospital security questions, keeping your threat model, SBOM, and security risk file current, and rating new vulnerabilities for patient harm. Because the advisor already knows your device, questions get answered quickly instead of waiting for a new project, and your next submission or hospital review starts from current files instead of a rebuild.
Cybersecurity QMS integration
We can help connect cybersecurity work to your existing quality procedures. Your team owns and approves the QMS.
See how QMS integration worksWhy security work stalls between submissions
Clearance is not the finish line. The work that keeps a device secure is easy to put off when nobody owns it.
Files go stale
The threat model, SBOM, and risk file describe the device as it was cleared. Every software change, new component, and new vulnerability makes them less accurate, and the next submission or audit finds the gap.
Ask about ongoing consulting supportQuestions with no one to answer them
Hospital security questionnaires, the FDA, Notified Bodies, and customers all ask security questions. Without a security lead, engineers guess or deals wait.
Passing hospital security reviewsVulnerabilities pile up
New CVEs land in your components every week. Someone has to decide which ones matter for patients, which need a patch, and which need a customer notice.
Postmarket monitoring guideRetainer scope
Up to 20 hours a month of expert access for agreed product cybersecurity work. We confirm priorities and scope with your team.
Meetings and questions
- Joins design reviews, standups, and planning
- Answers FDA, Notified Body, and hospital security questions
- Reviews hospital security questionnaires and MDS2 answers
- Second opinion on vendor and component choices
Files kept current
- Threat model updates when the design changes
- SBOM refresh and component review
- Security risk file updates tied to ISO 14971
- Change reviews against your SPDF
Vulnerabilities
- Weekly review of new CVEs in your components
- Patient-harm rating for each one that applies
- Recommendations for manufacturer patch and customer-notice decisions
- Coordinated disclosure handling
Submission support
- Document review within the agreed retainer scope
- Scoping for separate penetration tests, submission packages, and deficiency responses
- Training for your engineers on secure design
Ongoing cybersecurity support within your agreed retainer
Your advisor maintains the agreed cybersecurity files and supports your team. Full submission packages, penetration testing, and larger QMS integration projects require separately agreed scope.
- A senior medical device cybersecurity advisor every week
- FDA, Notified Body, and hospital security questions answered
- Threat model, SBOM, and risk file kept current
- New vulnerability triage and recommendations for manufacturer patch decisions
Retainer pricing
One monthly retainer at a fixed fee. No surprise invoices.
Fractional Product Security Officer
Starting at $5,000 a month. Final monthly fee is fixed after scoping.
You need a senior device security lead every week, but not full time.
- A named senior advisor who learns your device
- Weekly time for meetings, questions, and file upkeep
- Weekly vulnerability review with patient-harm ratings
- Short weekly summary of work done
- Help scoping pen tests, submissions, and deficiency responses
What drives the price
- Why a retainer pays off: no restarting from zero each project, faster answers for FDA and hospital questions, and files that are ready when the next submission or review starts
- Penetration testing, full submissions, and deficiency responses are scoped separately
- Need extra help some weeks? Ask, and we'll agree on it first
Clearance and approval decisions belong to the FDA, Notified Bodies, and hospitals. Your advisor makes sure your security evidence is complete and current.
We discuss your device, team, and consulting scope. See what you need to start.
Try the free tool first.
Pressure-test the work yourself before you scope an engagement. No signup, results are yours to keep.