Medical Device Penetration Testing for Cardiac Rhythm Management
Penetration testing for pacemakers, ICDs, CRT-Ds, leadless pacers, ILRs, in-clinic programmers, and home monitors. Conexus / CareLink / Merlin@home reference patterns.
Aligned to FDA's February 3, 2026 premarket cybersecurity guidance.
Cardiac Rhythm Management has an extensive public cybersecurity history in MedTech. A CRM pen test exercises the Conexus telemetry pattern (ICSMA-19-080-01, CVE-2019-6538/6540), the CareLink 2090 programmer update path (ICSMA-18-058-01), and the Merlin@home backhaul (FDA Safety Communication, Jan 2017).
We test CRM systems as one connected system, not as an implant plus accessories. On the implant link we characterize the telemetry protocol (inductive, MICS-band, or BLE) with SDR-based tooling, then exercise mutual authentication, session establishment, replay, downgrade, pairing-mode abuse, and parameter-write authorization on staging hardware. On the in-clinic programmer we test it as a full networked computing system: OS hardening, signed software updates, maintenance/service interfaces, USB/serial ports, session and audit controls. On the home transmitter we test cellular and Wi-Fi configuration, certificate pinning, secure boot, anti-rollback, and the cloud APIs it calls - and we treat the cellular fleet-management plane as a high-impact multi-patient surface, because a compromise there has the largest documented blast radius in CRM. Findings are mapped to the ISO 14971 risk file, AAMI SW96 controls, and the FDA's 2026 premarket cybersecurity guidance so your regulatory team can defend them in submission.
Medical Device Penetration Testing Services engagement, end to end
Four phases, fixed fee, scoped to cardiac rhythm management architecture from kickoff onward.
- 01
Scope + kickoff
Architecture review, attack-surface walkthrough, and threat-model alignment with your team. A written proposal within 24 hours.
- 02
Threat-model alignment
Every STRIDE entry in your threat model is matched to a planned test case so reviewers see one-to-one coverage.
- 03
Test execution
Device, cloud, mobile, BLE/RF, and OTA channels exercised in parallel by senior engineers - not a single web-app scan.
- 04
Submission-formatted report plus retest
eSTAR-format report with findings, CVSS 4.0 scores, remediation, and retests until every finding with uncontrolled risk is closed.
Findings we test for
Attack paths that can affect cardiac rhythm management systems.
Implant telemetry can lack authentication or integrity (Conexus-class)
Wireless interrogation can accept read/write commands without mutual authentication or replay protection. This can permit parameter reads on staging hardware, following the root-cause pattern of ICSMA-19-080-01.
Programmer software updates can use an unauthenticated network path (CareLink 2090-class)
An in-clinic programmer can fetch software updates over a deployment network without certificate validation or signed-package verification, following the root-cause pattern of ICSMA-18-058-01.
Home transmitter can accept firmware without anti-rollback
A home monitor can accept validly signed but older firmware images, enabling a downgrade to a known-vulnerable build.
Cellular fleet-management plane can have multi-tenant authorization gaps
API endpoints intended for one device's management can accept tokens from another device. Broken object-level authorization at fleet scale can affect multiple paired patient devices.
Account-recovery flow can allow clinician portal account takeover
A recovery flow can return deterministic tokens or allow an email change without re-authentication. Account takeover can expose longitudinal arrhythmia telemetry across patients.
URGENT/11 exposure can be undisclosed
A programmer or home monitor can include a VxWorks IPnet stack version covered by URGENT/11 (CISA ICSMA-19-274-01) without a documented exposure analysis.
"Blue Goat Cyber helped us navigate our first end-to-end cybersecurity testing for our wearable medical device. Their communication was excellent, their timeline exceeded expectations, and their report helped us achieve FDA clearance without any additional questions. It was a truly seamless experience."
Standard Medical Device Penetration Testing Services deliverables
The same deliverables the parent Medical Device Penetration Testing Services service ships with - tuned to your cardiac rhythm management architecture.
- Device, firmware, and embedded testing: hardware teardown, JTAG/UART/SPI bus access, firmware extraction and reverse engineering, and exploitation of the secure boot, debug, and update paths. Done by operators who have tested infusion pumps, monitors, surgical robots, and implantables.
- Companion app and cloud API coverage: iOS/Android binary analysis, BLE pairing/GATT attacks, REST/MQTT/gRPC fuzzing, authentication and authorization testing, and tenant-isolation checks. We test the device as patients and clinicians actually use it, not in isolation.
- penetration test reports structured for FDA premarket submissions: executive summary, methodology, CVSS-scored findings tied to your threat model, reproduction steps, and documented tester independence, scope, methods, and results. Reviewer-ready, not a generic IT security PDF.
- Remediation guidance and re-test included: written fix recommendations per finding, engineer-to-engineer support during remediation, and unlimited retests until every finding with uncontrolled risk is closed, inside the fixed fee. Accepted residual risks remain documented in your risk file.
What lands in your eSTAR submission
Documents structured for the cybersecurity attachments of your submission - no reformatting on your side.
- Device, firmware, and embedded testing: hardware teardown, JTAG/UART/SPI bus access, firmware extraction and reverse engineering, and exploitation of the secure boot, debug, and update paths. Done by operators who have tested infusion pumps, monitors, surgical robots, and implantables.
- Companion app and cloud API coverage: iOS/Android binary analysis, BLE pairing/GATT attacks, REST/MQTT/gRPC fuzzing, authentication and authorization testing, and tenant-isolation checks. We test the device as patients and clinicians actually use it, not in isolation.
- penetration test reports structured for FDA premarket submissions: executive summary, methodology, CVSS-scored findings tied to your threat model, reproduction steps, and documented tester independence, scope, methods, and results. Reviewer-ready, not a generic IT security PDF.
- Remediation guidance and re-test included: written fix recommendations per finding, engineer-to-engineer support during remediation, and unlimited retests until every finding with uncontrolled risk is closed, inside the fixed fee. Accepted residual risks remain documented in your risk file.
Standards that apply
The Cardiac Rhythm Management baseline, plus the call-outs that matter for medical device penetration testing services in this segment.
Segment-specific call-outs
AAMI TIR57 + AAMI SW96
Findings must trace to specific hazard entries in the ISO 14971 risk file with SW96 controls applied - 'IT bug' framing fails CRM reviews.
ISO 14708-2 / 14708-6 + IEC 60601-2-31
Cyber findings that affect pacing, defibrillation, or CRT delivery must be analyzed against the essential performance requirements for active cardiac implants, not just as software defects.
What's not in scope
We scope tightly on purpose. These items are either out-of-scope by design or belong in a separate engagement - we'll tell you up front, not after kickoff.
- Hospital enterprise IT network penetration testing
- Clinical efficacy or human-factors validation
- Physical security of manufacturing sites
- Source-code review (unless explicitly added as a separate engagement)
Go deeper on Cardiac Rhythm Management and premarket
A practical, ungated buyer's guide for medical device manufacturers evaluating cybersecurity partners, what goes wrong, why it costs you, and what to demand from your next engagement. Aligned to the FDA February 2026 premarket guidance.
The most common high- and critical-severity findings we surface in medical device penetration tests, what each one looks like in the field, and how to fix it before your FDA submission.
A practical, ungated guide to the threat modeling gaps that trigger FDA cybersecurity questions in 510(k), De Novo, and PMA submissions - and exactly how to close them before reviewers find them.
Medical device cybersecurity should scale with device risk. Christian Espinosa argues why meeting only the Section 524B minimum leaves patients and submissions exposed.
VEX resources for medical device teams: a document guide, SBOM comparison, and common assessment mistakes, with evidence-based status and regulatory context.
Medical device cybersecurity for nanotech neurostimulation: a fictional STRIDE threat model linking controller risks, patient harms, controls, and testing.
Other engagements for Cardiac Rhythm Management
Teams in this segment commonly bundle these alongside medical device penetration testing services.
Keep going
Scope a Medical Device Penetration Testing Services engagement for your cardiac rhythm management program.
A 30-minute discovery call with Christian Espinosa, Founder and CEO, and Kristy Kennedy, VP of Sales.