Pick the interfaces your device exposes and the assets it protects. We generate a STRIDE threat register with abuse cases, safety impact, and mitigations mapped to ANSI/AAMI SW96 (FDA-recognized) and AAMI TIR57 control IDs, then download a STRIDE guide you can use as the starting point for your formal threat model.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
Who uses it?
Communication and physical interfaces
Each interface adds its own seeded STRIDE threats with mitigations and control IDs.
Wireless
Wired / physical
Cloud / app
Update / service
High-value assets
Adds asset-centric threats (e.g. signing-key disclosure, model poisoning, audit-log tampering).
Please don't enter confidential details. Everything stays in your browser until you download.
What you'll see after you submit
Common misconceptions
Myth: Threat modeling is a one-time premarket deliverable.
Reality: The FDA expects the threat model to be a living artifact - updated on architecture changes, new interfaces, and significant CVEs. Submit the latest version with every supplement.
Myth: STRIDE is for IT systems, not medical devices.
Reality: AAMI TIR57 and the current FDA premarket cybersecurity guidance explicitly cite STRIDE (and DREAD / attack trees) as acceptable medical-device threat-modeling frameworks. The categories map cleanly to safety and effectiveness.
Myth: If we have a risk file (ISO 14971), we don't need a threat model.
Reality: ISO 14971 captures safety risk from hazards. A threat model captures security risk from adversaries. The FDA expects the two to be linked but distinct artifacts, with traceability between them (TIR57 §6.2).
Myth: An exported diagram is enough.
Reality: Reviewers want the rationale: why each interface is in scope, why each threat is rated, and which control mitigates it. Diagrams without a narrative get deficiency letters.
Myth: Wireless threats only matter for Wi-Fi and Bluetooth.
Reality: NFC tap-to-configure, UHF RFID consumable authentication, and rogue cellular base stations are all reviewer-relevant attack surfaces. If your device exposes them, they belong in the threat register.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
What the starter guide includes, how it differs from a submission, and why it's free.
Read Starter FAQSTRIDE/PASTA threat models with traceability into design inputs and the risk file.
Read Threat modeling servicesHow reviewers expect STRIDE applied to a cyber device.
Read STRIDE for medical devicesFull SPDF + eSTAR-ready submission.
Read FDA premarket cybersecurityPCCP, §524B checker, SBOM readiness, pen-test scope.
Read More tools