Medical Device Penetration Testing for Imaging AI & SaMD

Imaging AI and SaMD devices are software products that present as cloud services or PACS-integrated workstations, and their attack surface is mostly cloud, mostly DICOM, and mostly model-adjacent. The naive pen test treats them as web apps. The right pen test treats them as a pipeline: DICOM in → preprocessing → model inference → results out → PACS / EHR. Each hop has its own failure modes, and reviewers under FDA's evolving AI/ML guidance expect to see the whole pipeline modeled.

We test the DICOM ingestion path for malformed-tag handling (the historic source of imaging zero-days), C-STORE vs. STOW-RS authentication, and whether the de-identification step can be bypassed. On the model side we evaluate the inference path for adversarial-input behavior at the boundaries that matter clinically (not academic adversarial examples - clinically plausible perturbations the device must reject or flag), prompt-injection-style bypasses for any LLM-augmented reporting, and whether confidence/uncertainty outputs can be manipulated to suppress flags. We test cloud APIs for tenancy isolation across hospital customers (the most common high-severity finding in this segment), service-account scope creep, and storage permissions on intermediate buffers. Finally, the results-write path: how does the device write back to PACS, who can spoof results, and what audit trail survives a compromise? Findings are mapped to FDA's AI/ML PCCP expectations and ANSI/AAMI SW96.