Are you Mythos-Secure?

A trusted community, not a vendor list

Health-ISAC (Health Information Sharing and Analysis Center) exists to help the health sector prevent, detect and respond to cyber and physical security events. Its membership spans providers, payers and the manufacturers who build the devices sitting on hospital networks. Medical device security is one of the areas it organizes around, because a device vulnerability lands on the manufacturer and the hospital at the same time.

One product, tested end to end, at no cost

ELTON is opening its pipeline to Health-ISAC member organizations. One product per member gets the full test, a report written for a 510(k) or PMA submission, and 30 days inside the exploitability management platform to work the results. ELTON has not given away testing or platform access before this program, and it is not being offered anywhere else.

Days 0 to 15

• A digital twin of your product, built from documentation you already hold. Interfaces, components, trust boundaries, and the attack surface an adversary can actually reach.
• SBOM generation, or validation of the SBOM you have, with component and CVE mapping.
• SAST and SCA on any source code provided.
• DAST against the product's running interfaces.
• Protocol and interface fuzzing across the exposed attack surface.
• Exploitability verification on every finding, landing each one in one of the four states above.
• Root cause collapse. Thousands of findings reduced to the handful of root causes that produce them.
• A prioritized remediation plan, ordered so the fixes that close the most exploit paths come first.
• A penetration test report ready for internal use or for a 510(k) or PMA submission. Scope, methods, coverage, findings, exploitability evidence, and the reasoning behind every dismissal, in the report format this team has used across more than 1,000 FDA submissions since 2013.
• A live readout with the ELTON team.

Days 15 to 45

• Your digital twin and its dependency graph, live. Every finding in its state, with the conditions that make it reachable. Fix a root cause and watch the chain collapse.
• New CVEs published during the window are mapped to your SBOM and triaged against your twin, so you see which ones reach your product and which ones cannot.
• Re-verification. Ship a fix during the window and the pipeline retests it and updates the graph.
• Evidence generated as you go. VEX output, CVSS scoring using the MITRE rubric qualified under FDA's MDDT program (Q171974), and the written rationale behind every dismissal.
• Seats for your engineering, product security and regulatory teams.
• No credit card, no auto renewal, and nothing to uninstall when the 30 days end.

Health-ISAC member organizations

• One product per member organization.
• You either manufacture the product, or you own it and hold written authorization from the manufacturer to test it.
• Testing runs against a lab or bench unit, never a production or clinical environment.
• No cap on the number of members who can take this up.
• The offer closes December 31, 2026.

Paperwork, documents, and a build

• A mutual NDA or MSA, your preference, and a signed zero dollar SOW for the product.
• Product documentation. Architecture, interfaces, and a threat model if one exists.
• One of: a firmware image, source code, or a deployable software build.
• Physical device testing through ELTON TestLink, which runs out of band over 5G and never touches your enterprise network, may be available depending on the product and current lab capacity. It is not guaranteed and is confirmed case by case at kickoff.
• A named engineering contact for two calls, kickoff and readout.

ELTON works with 6 of the top 10 medical device manufacturers and hundreds of smaller ones. Your source code, firmware, documents and findings stay inside the pipeline. AI builds the testing tools and decides which ones to run. Your data does not go into a public model.