Field notes from a team that has taken more than 600 vulnerability reports through FDA review. Guidance, regulation, and where medical device security is going. 38 articles and counting.
AI collapsed the cost of finding vulnerabilities to almost nothing. CVE volume is going exponential. Here is the response.
With final cybersecurity guidance in effect and QMSR taking hold, a cyber device submission carries nine distinct deliverables through eSTAR.
The 2027 CVSSv4 expectation is closer than it looks, and it rewards exactly the chained analysis most programs do not do yet.
Attackers chain unimpressive bugs into critical outcomes. FDA 2025 guidance expects your analysis to follow the path, not the score.
The most expensive mistake in device security is fixing a vulnerability that never needed it. The patch everything reflex has risk backwards.
Model, discover, verify, prove, monitor. One loop from QMS documentation to evidenced dispositions, kept current for every release.
A major quality-system shift, but it does not change your cybersecurity obligations. Here is what actually changed.
Nearly 100 unresolved SBOM CVEs, an FDA AI letter, one response window. Evidence, not opinion, carried the submission.
A decade of device pentesting, 2,000+ tests, 600+ submissions. Credibility in this field is accumulated, not claimed.
An AI letter starts a 180-day clock. What the FDA's cybersecurity deficiencies actually say, and how to answer them with evidence that agrees.
Cleared before 2023? If it still ships, the obligations still run. Commercial status, not clearance date, decides what you monitor and test.
One annual pentest stretched across versions is evidence for none of them. Every release needs its own testing record. Automation makes it viable.
Regulators moved from isolated findings to completeness, traceability, and defensibility across the full lifecycle. One point-in-time pentest cannot show that.
China's 2018 CFDA guidelines ask for five artifacts. All five are views of one system model. Build the model and the paperwork falls out.
Devices CE marked years ago now face cybersecurity questions nobody asked at design time. The recertification gap is continuity, not testing.
A vulnerability is a quality event. How findings flow through 21 CFR 820.100 CAPA with evidence, and what changes under QMSR and ISO 13485.
A 9.8 on NVD is not a 9.8 on your device. Inside the FDA-qualified MITRE CVSS rubric, and how ELTON runs it automatically.
FDA AI letters recycle the same questions: threat models, testing evidence, SBOMs, scoring. All are traceability complaints in disguise.
Audits test records, not intentions. Why fragmented programs fail and how a system of record makes the answer predate the question.
Fixed annual price. Every testing class. No per-engagement quotes. Continuous testing, delivered by the platform instead of a bench.
Static reports go stale the day they're signed. Continuous, context-scored vulnerability management is now the FDA's baseline expectation.
We automate the FDA's 524B vulnerability testing and management work, premarket and postmarket. The claim is bounded on purpose.
The same CVE deserves different ratings on different devices. The difference is the path an attacker has to walk through yours.
The SPDF isn't a checklist. It's five practices spanning the lifecycle, and vulnerability testing and management are two of the pillars.
Japan adopted IEC 62304 and IEC 81001-5-1 as JIS T 2304 and JIS T 81001-5-1. One process, one evidence trail, and it travels.
A working risk assessment SOP: score exploitability with CVSS, pull harm from ISO 14971, mitigate, rescore, and defend the residual.
One SOP to govern the lifecycle: planning, threat modeling, SBOM, testing, traceability, and postmarket vulnerability response.
Monitor, assess, respond, patch, re-test. A postmarket vulnerability SOP with the clocks FDA expects you to commit to.
Four numbers prove your program runs: total vulnerabilities, percent patched, time to patch release, and time to install.
Dynamic dispatch, IPC, and closed binaries break static certainty. A not reachable verdict without runtime proof is a claim, not evidence.
Attackers don't read your source. They probe what's exposed. Path-based analysis asks the same question they do: can I get there?
1,300 redlines, few new obligations. The 2025 revision clarifies scope, SBOM format, and risk modeling. What changed was the ambiguity.
Your Vulnerability Management Plan named seven metrics. The FDA reads it as a contract. Manual collection dies within two release cycles.
The question is no longer whether you know every vulnerability. It is whether you already know how a new one would be rated, and can justify why.
The FDA names seven AI-specific threats. Only one lives at runtime. Most programs test one-seventh of what is being asked.
The same CVE in three releases can carry three different ratings, and all three are correct.
Interpreting the FDA's 2016 postmarket guidance: most SBOM findings do not require a patch, if you can evidence why.
If a tool produces evidence for an FDA submission, it lives inside your quality system, and the FDA can ask whether it was validated.
Start with one device. We build the twin from documentation your quality system already produces, run AI discovery remotely, and show you the graph: the handful to fix, and the evidence for everything else.