Penetration testing for pacemakers, ICDs, CRT-Ds, leadless pacers, ILRs, in-clinic programmers, and home monitors. Conexus / CareLink / Merlin@home reference patterns.
Last reviewed March 2026 · Reviewed against the FDA Feb 3, 2026 final premarket cybersecurity guidance.
Cardiac Rhythm Management is the device class with the most extensive public cybersecurity history in MedTech, and reviewers test submissions against named incidents. A CRM pen test that doesn't explicitly exercise the Conexus telemetry pattern (ICSMA-19-080-01, CVE-2019-6538/6540), the CareLink 2090 programmer update path (ICSMA-18-128-01), and the Merlin@home backhaul (FDA Safety Communication, Jan 2017) leaves obvious gaps that any FDA cyber reviewer will flag.
We test CRM systems as one connected system, not as an implant plus accessories. On the implant link we characterize the telemetry protocol (inductive, MICS-band, or BLE) with SDR-based tooling, then exercise mutual authentication, session establishment, replay, downgrade, pairing-mode abuse, and parameter-write authorization on staging hardware. On the in-clinic programmer we test it as a full networked computing system: OS hardening, signed software updates, maintenance/service interfaces, USB/serial ports, session and audit controls. On the home transmitter we test cellular and Wi-Fi configuration, certificate pinning, secure boot, anti-rollback, and the cloud APIs it calls - and we treat the cellular fleet-management plane as a high-impact multi-patient surface, because a compromise there has the largest documented blast radius in CRM. Findings are mapped to the IEC 14971 risk file, AAMI SW96 controls, and the FDA's 2026 premarket cybersecurity guidance so your regulatory team can defend them in submission.
Four phases, fixed fee, scoped to cardiac rhythm management architecture from kickoff onward.
Architecture review, attack-surface walkthrough, and threat-model alignment with your team. Written scope in 24 hours.
Every STRIDE entry in your threat model is matched to a planned test case so reviewers see one-to-one coverage.
Device, cloud, mobile, BLE/RF, and OTA channels exercised in parallel by senior engineers - not a single web-app scan.
eSTAR-format report with findings, CVSS, remediation, and retests until every finding is closed.
The patterns we hit in this segment, this service, again and again.
Wireless interrogation accepts read/write commands without mutual authentication or replay protection. We've demonstrated parameter reads on staging hardware in under a session - the exact root-cause pattern of ICSMA-19-080-01.
In-clinic programmer fetches software updates over a deployment network without certificate validation or signed-package verification - same root cause as ICSMA-18-128-01.
Home-monitor accepts validly-signed but older firmware images, enabling a downgrade to a known-vulnerable build. Signed but not anti-rollback is the single most common CRM finding.
API endpoints intended for one device's management accept tokens from another - BOLA at fleet scale. The blast radius here is every paired patient device, not one.
Recovery flow returns deterministic tokens or allows email change without re-authentication - account takeover exposes longitudinal arrhythmia telemetry across many patients.
Programmer or home-monitor includes a VxWorks IPnet stack version covered by URGENT/11 (CISA ICSMA-19-274-01) without a documented exposure analysis. Reviewers ask for the disclosure explicitly.
"Blue Goat Cyber helped us navigate our first end-to-end cybersecurity testing for our wearable medical device. Their communication was excellent, their timeline exceeded expectations, and their report helped us achieve FDA clearance without any additional questions. It was a truly seamless experience."
The same deliverables the parent Medical Device Penetration Testing service ships with - tuned to your cardiac rhythm management architecture.
Reviewer-format documents ready to drop straight into the cybersecurity attachments of your submission - no reformatting on your side.
The Cardiac Rhythm Management baseline, plus the call-outs that matter for medical device penetration testing in this segment.
Findings must trace to specific hazard entries in the IEC 14971 risk file with SW96 controls applied - 'IT bug' framing fails CRM reviews.
Cyber findings that affect pacing, defibrillation, or CRT delivery must be analyzed against the essential performance requirements for active cardiac implants, not just as software defects.
We scope tightly on purpose. These items are either out-of-scope by design or belong in a separate engagement - we'll tell you up front, not after kickoff.
A practical, ungated buyer's guide for medical device manufacturers evaluating cybersecurity partners, what goes wrong, why it costs you, and what to demand from your next engagement. Aligned to the FDA February 2026 premarket guidance.
The most common high- and critical-severity findings we surface in medical device penetration tests, what each one looks like in the field, and how to fix it before your FDA submission.
A practical, ungated guide to the threat modeling gaps that trigger FDA cybersecurity questions in 510(k), De Novo, and PMA submissions - and exactly how to close them before reviewers find them.
What is MedTech, and how does it differ from a medical device or life sciences? Clear definitions, from scalpels and sutures to connected cyber devices.
Ransomware and medical devices: how attacks reach connected devices, what the FDA's 2026 premarket guidance expects, and the design controls that limit harm.
What is a cyber device under FDA Section 524B? The three-part legal test, how the FDA reads internet connection, and a quick check for your own device.
Teams in this segment commonly bundle these alongside medical device penetration testing.
A 30-minute call with a senior engineer who has done this in cardiac rhythm management before - not a sales rep.
