Threat model and hazard analysis gap assessment

How it works

1. 1

   Send what you have

   Your threat model, the cybersecurity-related rows of your hazard analysis, and the documents behind them: Instructions for Use, software architecture and any data flow diagrams. Drafts are fine.

2. 2

   We check the threat model

   Scope and trust boundaries, the four architecture views, STRIDE coverage of every interface, the Threat Table, named controls, and stated assumptions.

3. 3

   We check the cybersecurity hazards

   Whether each threat that could hurt a patient traces to a hazard and harm in your ISO 14971 file, with severity taken from your safety scale and exploitability scored separately.

4. 4

   We check the link between them

   Acceptance criteria set before scoring, controlled vs uncontrolled residual risk, and whether a reviewer can follow one line from threat to control to test to residual risk.

5. 5

   You get a gap list

   Each gap ranked by priority, with what to fix and why it matters for FDA review. A call to walk through it, then you fix it yourselves or we close it for you.

What we check

• Threat model reflects the device you plan to submit, not an early design
• Every external interface, radio, port, app and cloud service is in scope
• Threats are tied to specific entry points and specific harms
• Each control is a named design control, not a labeling note
• Security risks that could harm a patient appear in the ISO 14971 file
• One harm taxonomy, referenced by both the safety and security sides
• Exploitability is used in place of probability for security risks
• The threat model can drive a penetration test plan

For how the threat model and the ISO 14971 file fit together, read ISO 14971 and AAMI SW96. For the full method we check against, see our risk methodology. Building your own first? Download our free threat model template (Excel). For what a complete threat model contains, see the threat model template.

Only cybersecurity-related hazards

We look at hazards where a deliberate attacker could cause patient harm, such as a spoofed dose command or a tampered result. Mechanical, electrical, biocompatibility and use-error hazards stay with your safety team. Severity comes from your existing safety scale; we don't redefine it.

After the assessment

Fix the gaps yourselves, or have us close them. Once both documents are ready, they drive our medical device penetration testing. No threat model yet? Start with threat modeling instead.

FAQ

What is a threat model and hazard analysis gap assessment?

A review of the threat model and the cybersecurity-related hazards you already have, checked against Section 524B and the February 3, 2026 FDA premarket cybersecurity guidance. You get a list of what is missing or weak and what to do about each item.

Do you review our whole hazard analysis?

No. We focus only on cybersecurity-related hazards: the ones where an attacker, rather than a random failure, could cause patient harm. Mechanical, electrical, biocompatibility and use-error hazards stay with your safety team.

Do we need this before penetration testing?

Testing starts only once a threat model and hazard analysis exist, because they tell us what to test and which findings could hurt a patient. If you already have both, a gap assessment confirms they are ready to drive the test plan.

What if we don't have a threat model yet?

Then a gap assessment has nothing to review. We can build the threat model and the cybersecurity input to your hazard analysis instead. See our threat modeling service.

How do we send you our threat model?

After scoping, we send you a private upload link. You upload your threat model, get an automated first-pass gap check right away, and our team then reviews the file and sends the confirmed gap list. Files are stored privately and only our team can open them.

How is it priced?

We scope it on a short call and quote a fixed fee. A light review is part of scoping any pen test; a full gap assessment or rework is quoted separately.