Blue Goat Cyber · Rev H / Rev P

Medical Device Risk Calculator

Separate security and patient-safety ratings. Manufacturer evidence and risk-acceptance criteria govern; these charts do not approve a device or accept its risk.

1. Attack factors

Attack Vector

How close does the attacker need to be to the device?

Attack Complexity

Must the attacker defeat a security control such as ASLR or encryption?

Attack Requirements

Does the attack depend on conditions outside the attacker's control, such as a pairing window?

Privileges Required

What access does the attacker need first?

User Interaction

Does a patient or clinician need to do something?

2. Security impact

Device Confidentiality

Impact on data in the vulnerable system (device, app, or cloud service).

Device Integrity

Can the attacker change data, settings or therapy parameters on the vulnerable system?

Device Availability

Can the attacker stop the vulnerable system from working?

Downstream Confidentiality

Impact on connected systems such as the EHR, gateway or hospital network.

Downstream Integrity

Can connected systems receive altered data or commands?

Downstream Availability

Can connected systems be taken down?

Listed in CISA KEV. Records known exploitation (E:A), not an automatic increase in matrix exploitability.

3. Patient-safety assessmentCan exploitation affect a patient?

PHI disclosure alone does not establish patient harm. An unclear pathway needs manufacturer review.

Your risk ratings

Unscored · 0 of 11 factors assessed. Missing factors are not Low risk.

Security risk · every finding

Security impact →
Exploitability ↑	Low	Medium	High
High	Medium	High	Critical
Medium	Low	Medium	High
Low	Low	Low	Medium

Patient-safety risk

Unscored: awaiting completed factors and manufacturer pathway, severity, and hazard evidence.

Manufacturer-assigned harm severity →
Exploitability ↑	Negligible	Minor	Serious	Critical	Catastrophic
High	Medium	High	High	Very High	Very High
Medium	Low	Medium	Medium	High	High
Low	Low	Low	Low	Medium	Medium

Matrix lookups, not score multiplication. STRIDE classifies threats, never scores them. A rating is not risk acceptance. Medium residual safety risk still needs reduction as far as practicable and documented justification; verified controls and manufacturer criteria govern residual decisions.

Assessment inputs are not saved or submitted by this calculator.

Read the risk-scoring methodology