Threat Modeling for Medical Devices

Threat modeling is the foundation of every credible cybersecurity submission - and the section reviewers scrutinize most. This hub collects our threat modeling service, FDA-aligned methodology, the 12 gaps we see most often, and how STRIDE maps to AAMI SW96 risk management. A submission-grade threat model produces traceable artifacts at four layers: a system and data-flow decomposition that names every trust boundary, asset, and external interface; a STRIDE-per-element analysis that enumerates spoofing, tampering, repudiation, information disclosure, denial-of-service, and elevation-of-privilege threats against each component; a risk evaluation that scores likelihood and harm severity using the device's intended-use and use-environment context, including multi-patient and fleet-level harm scenarios reviewers now expect under the FDA February 2026 final guidance; and a mitigation traceability matrix that maps every accepted threat to a security control, a verification test, and a residual-risk entry in the ISO 14971 risk file. Threat models that skip the trust-boundary map, treat the device as a single black box, or omit multi-patient harm are the single most common driver of first-cycle cybersecurity Additional Information letters. AAMI SW96 is now the bridge reviewers expect between the security threat analysis and the safety risk file, and a threat model that doesn't carry threats into the SW96 risk register reads as incomplete regardless of how thorough the STRIDE work is.

Services

• Medical Device Threat Modeling

  Comprehensive threat modeling per FDA Section V.A.1 - covering supply chain, deployment, environment of use, and decommission risks for the full device system.

• Secure MedTech Product Design

  Architecture review, control selection, and secure development guidance from concept through V&V - aligned with FDA's Secure Product Development Framework.

• Full-Service FDA Premarket Cybersecurity

  Full-service, end-to-end: we deliver 100% of the artifacts FDA reviewers expect for 510(k), De Novo, PMA, PDP, and HDE submissions under §524B, plus IDE applications under 21 CFR 812 and the FDA's February 3, 2026 premarket guidance - traceable, complete, and current.

In-depth guides

• 12 Critical Threat-Modeling Gaps in SubmissionsA practical, ungated guide to the threat modeling gaps that trigger FDA cybersecurity questions in 510(k), De Novo, and PMA submissions - and exactly how to close them before reviewers find them.
• The SPDF PlaybookA practical, ungated guide to building a Secure Product Development Framework (SPDF) that FDA accepts, the eight pillars, the artifacts each one produces, and a pre-submission readiness checklist you can score yourself against.

Standards & guidance

Defined entries from our MedTech Cybersecurity Standards Glossary.

• ANSI/AAMI SW96Medical Device Security Risk ManagementThe consensus standard for medical device security risk management - asset, threat, vulnerability, likelihood, severity, and residual risk acceptability.
• AAMI TIR57Principles for Medical Device Security - Risk ManagementThe MedTech-specific extension of ISO 14971 for cybersecurity. Defines how to identify cybersecurity assets, threats, and vulnerabilities, then estimate, evaluate, and control the resulting risk.
• ISO 14971Medical Device Risk ManagementThe umbrella risk-management standard for medical devices. Defines hazard identification, risk estimation, risk evaluation, risk control, and residual risk evaluation. Cybersecurity risks must be reconciled here so a security control never silently introduces a safety hazard.
• SPDFSecure Product Development FrameworkA documented framework that shows security activities are integrated across the device lifecycle - not bolted on at the end. Includes secure requirements, threat modeling, secure coding, V&V, vulnerability management, and post-market response.
• FDA 2026 GuidanceFDA Premarket Cybersecurity Guidance (Feb 3, 2026)The FDA's final premarket cybersecurity guidance, effective February 3, 2026. Defines the seven-section cybersecurity submission format reviewers now enforce at Technical Screening, replacing the 2023 draft. Operationalizes Section 524B of the FD&C Act.

From the blog

• Threat Modeling Connected & Implantable DevicesA short orientation to threat modeling connected and implantable medical devices, with a pointer to the full STRIDE pillar guide for FDA-ready methodology.
• AAMI TIR57 Risk Management for Medical Devices
• FMEA vs Threat Modeling for MedicalFMEA covers random and systematic failure modes; threat modeling covers adversarial action.

Related FDA deficiencies

The deficiency letters reviewers most often write on submissions in this topic area. Each links to the full response playbook.

• Incomplete Threat Model

  Reviewers say your STRIDE/attack-tree analysis misses interfaces, trust boundaries, or post-market threat surfaces.

  Response playbook
• Missing Cybersecurity Risk Assessment

  Reviewers cannot find a cybersecurity risk assessment distinct from the ISO 14971 safety risk file, or the integration is unclear.

  Response playbook
• Missing Security Architecture Views

  Your submission is missing one or more of the architecture views FDA 2026 expects (global system, multi-patient, updateability).

  Response playbook
• Insufficient Penetration Testing Evidence

  Reviewers find your penetration test scope too narrow, methodology unclear, or testers insufficiently independent.

  Response playbook

Related topics

Adjacent hubs in the same regulatory lifecycle, with the guides, articles, tools, and questions they cover that this hub does not.

• IDE CybersecurityShares ANSI/AAMI SW96, AAMI TIR57, ISO 14971 · Same service track: Medical Device Threat Modeling

  Section 524B(a) does not list IDEs, so the statute's premarket cybersecurity content requirements do not attach to an investigational device exemption.

  • IDE Cybersecurity Requirements: The Investigational Device Guide (2026)GuideWhat cybersecurity documentation an IDE application needs under 21 CFR 812 and the FDA February 3, 2026 premarket guidance, and why Section 524B does not apply.
  • FDA IDE Cybersecurity Requirements: 2026ArticleWhat the FDA's Feb 2026 guidance recommends for IDE cybersecurity: informed consent, architecture views, SBOM, labeling, and what's not required yet.
  • Pathway crosswalkToolCompare what IDE, 510(k), De Novo, and PMA each expect on cybersecurity evidence.

  Does Section 524B apply to IDE submissions?

  No. Section 524B(a) enumerates 510(k), De Novo, PMA, PDP, and HDE; an IDE is submitted under a different section of the FD&C Act. Cybersecurity still applies through binding regulation: 21 CFR 812.25 requires the investigational plan to describe the device, the methodology, and the risks to subjects, and the February 3, 2026 guidance describes the cybersecurity content FDA expects there. The distinction matters because the content lands in the investigational plan rather than in an eSTAR cybersecurity section.

  More IDE Cybersecurity FAQs
• MedTech Cybersecurity StandardsShares ANSI/AAMI SW96, AAMI TIR57, ISO 14971 · Same service track: Medical Device Threat Modeling

  The standards MedTech teams actually need are a short list: ISO 14971 for safety risk management, ANSI/AAMI SW96:2023 for security risk management, AAMI TIR57 as its predecessor and companion, IEC 62304 for software lifecycle, IEC 81001-5-1 for secure development, and UL 2900 series where a certification is contractually required.

  • The MedTech Cybersecurity Standards DecoderGuideA plain-English field guide to FDA Section 524B, IEC 81001-5-1, AAMI TIR57, ANSI/AAMI SW96, ISO 14971, and 8 more medical device cybersecurity standards, what they require, how they connect, and what FDA expects in your eSTAR premarket submission.
  • 21 CFR Part 820 and Medical Device CybersecurityArticleHow 21 CFR Part 820 (and the 2026 QMSR update aligning it to ISO 13485) governs cybersecurity: design controls, CAPA, document controls, and Section 524B evidence.
  • EU MDR vs FDA Medical Device Cybersecurity: A Side-by-Side CrosswalkGuideHow EU MDR/IVDR cybersecurity requirements compare to FDA Section 524B and the February 2026 guidance - Annex I §17.2, MDCG 2019-16, SBOM, vulnerability handling, and postmarket obligations.

  Which standards does the FDA actually require?

  The FDA requires compliance with statute (Section 524B) and 21 CFR Part 820 / QMSR. They recognize - but don't strictly mandate - consensus standards like AAMI SW96, IEC 81001-5-1, and ISO 14971. In practice, declaring conformance to those standards is the cleanest path through review.

  More MedTech Cybersecurity Standards FAQs
• PMA CybersecurityShares ANSI/AAMI SW96, ISO 14971, SPDF · Same service track: Medical Device Threat Modeling

  PMA cybersecurity is the same Section 524B content set as any other pathway, applied at greater depth because Class III devices are life-sustaining or life-supporting.

  • FDA PMA Cybersecurity Requirements: Expert Guide (2024)GuideMaster FDA PMA cybersecurity requirements. Learn the technical documentation, risk management, and SPDF requirements needed for a successful Class III submissio
  • FDA Cybersecurity Deficiencies TriggersArticleUnderstanding what causes the FDA to issue a cybersecurity deficiency for medical devices starts with one uncomfortable truth: most deficiencies have.
  • Pathway crosswalkToolSee how PMA cybersecurity evidence expectations differ from 510(k), De Novo, and IDE, side by side.

  How is PMA cybersecurity different from a 510(k)?

  PMA cybersecurity packages go deeper on every section. Threat models cover safety-critical clinical scenarios end-to-end, not just connected interfaces; pen testing typically includes white-box review of safety-critical firmware paths; the postmarket plan must defend the device through its full intended lifetime, not just the next clearance cycle. Reviewers also issue more cybersecurity deficiencies on PMAs than on any other pathway, so the bar for evidence quality is higher.

  More PMA Cybersecurity FAQs

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 250+ FDA submissions.