AI has collapsed the cost of vulnerability discovery to nearly zero. Manufacturers now face more findings per product, per release, than any team can triage by hand, each one needing an evidenced disposition under FDA premarket (524B) and postmarket expectations.
The session has aired. Tell us where to send you and the recording and slides unlock on this page.
The questions below are representative of what came up during and after the session, with the answers as I gave them, tightened up. Every one of them maps back to a slide in the deck above.
In the US you have some room. In the EU you do not, and the reason has nothing to do with AI. GSPR 17.2 has required state of the art since 2021, and once a standard exists a notified body can cite it and Annex VII 4.5.1 obliges you to answer it. Five of the six AI standards on the slide landed in the last twelve months, so you end up addressing them in the file whether or not FDA finalizes its draft.
It covers one of the seven. Section XII of the January 2025 draft lists seven AI threat categories. Model evasion is a runtime threat against the deployed model, and a conventional pentest reaches that surface well. The other six, poisoning, inversion, stealing, leakage, overfitting, bias and drift, live in the data and the training pipeline, which never ships. Testing the box on the right covers about a seventh of what the section asks.
At model training, which inverts the normal schedule. Conventional cyber testing runs late on purpose because the surface is fixed. You cannot assess poisoning resistance on a frozen model, and overfitting and bias are properties of the training run. Capture that evidence while the training environment still exists, because after submission there is nothing left to go back to.
Data of Unknown Provenance, a term from IEC PAS 63621, the data management standard for AI-enabled devices published this year. It means data whose source, creation date, or validity cannot be confirmed. Ask what share of your training corpus has no provenance record. If the team cannot answer, you cannot rule out that someone placed data there on purpose, and a reviewer can ask the same question.
The numbers are public. XBOW took the top spot on HackerOne's US leaderboard in June 2025, and once you strip duplicates that is roughly four hundred real findings in ninety days from a machine. ARTEMIS, from Stanford, Carnegie Mellon and Gray Swan, outscored nine of ten professional pentesters on an eight thousand host network. The output of a ten year pentester now costs about eighteen dollars an hour in compute. The bar dropped, and it dropped for the unsophisticated attacker too.
The softest target is the device you already own, especially one past end of support. Legacy units sell on the resale market with no NDA and no rules of engagement. A researcher buys one, puts it on a bench, and runs the same agentic pipeline against it that I described in part three. Inventory the legacy fleet in clinical areas and assume someone has already looked at it.
Mostly no. The code really does what the finding says, and where the findings go wrong is the path. Split them three ways. Direct means exploitable on its own from a known entry vector, and on a real device that should be a handful. Conditional means real but only reachable while another root cause holds the door open. Everything else is a weakness with no path on that device today. Your regulatory exposure is the direct count.
A base CVSS score rates a component as if it floated in space. Attack vector, complexity, privileges required, user interaction and scope are each a statement about your deployed architecture. A buffer overflow in a service facing the hospital network is critical. The same overflow behind signed firmware is a footnote. Rate the path an attacker has to walk, and the score follows the device.
Rank fixes by how many exploit chains they kill. Findings depend on each other, so one change can collapse a whole set at once. Lock the kiosk shell and forty chains die. Authenticate the management port and twenty seven die. Patch the single CVE a scanner ranked first and you kill one. On a cleared device every change costs a validation cycle, so the fewest fixes that remove the most exploitable severity is the whole job.
The fixing loop is forming and it mirrors the finding loop. The exact reproduction from the finder becomes the specification for the fix, an agent drafts a patch tied to the root cause, and build, static analysis, fuzzing and regression tests loop until it passes. I would be honest about the limit. Nobody has published an audited number for fixes merged without a human edit. CodeMender, the strongest public example, has a human researcher review every patch. Ask any vendor for that number, and remember a device fix still needs a validation cycle.
Split it the way the deck is split. For the submission you are working on now, map your test cases to all seven Section XII categories with the pipeline in scope, ask data science the DOUP question, and capture the training-time evidence while it exists. For every release after that, point an agentic pipeline at one device on a bench you own, in a closed lab, and see what comes back. Half of this is a question you can put to your own team by Friday.
AI has collapsed the cost of vulnerability discovery to nearly zero. Manufacturers now face more findings per product, per release, than any team can triage by hand, each one needing an evidenced disposition under FDA premarket (524B) and postmarket expectations.
Discovery no longer has a barrier to entry. Volume per release keeps climbing while triage capacity stays flat.
Build your own AI analysis that determines which vulnerabilities are actually exploitable against a specific device, not theoretically present in it.
A practical path from manual, point-in-time testing to continuous AI-driven discovery and verification, with a CI/CD feedback loop that stays quality-system compliant.
You will leave with a transition strategy: where to start, what to automate first, and how to keep pace.
A methods session, not a product demo. Every technique covered can be built in-house, regardless of which tools you run today.
Why the cost of finding vulnerabilities collapsed, what the CVE curve does next, and what that means per product, per release.
FDA premarket (524B) and postmarket expectations do not care how many findings there are. Each one still needs a defensible call with evidence behind it.
Architecting automated analysis that tests reachability on the actual device: entry vectors, conditions, and when a finding is a weakness rather than a vulnerability.
Routing confirmed findings to the build pipeline in a quality-system-compliant manner, with the traceability your QMS expects intact.
A practical sequence from manual, point-in-time testing to continuous discovery and verification, sized for teams that cannot pause shipping to rebuild.
Open questions against the architectures in the room: firmware-heavy, SaMD, and connected platforms all run the same playbook differently.
AI tools tear through products at a speed humans can't match. Everyone can find your bugs now, including researchers, regulators, and attackers.
The bottleneck moved. The challenge is no longer finding vulnerabilities. It is knowing which ones are actually exploitable against your product.
How to develop automated analysis that determines real exploitability against a specific device, not theoretical presence in it.
How to route verified findings directly into your pipeline in a quality-system-compliant manner, so proof lands where the code is built.
Why every finding needs a defensible call under FDA 524B and postmarket expectations, and how to produce it at volume.
Why remediation is where AI pays off: full context produces a code-level fix that can be pushed and re-tested, instead of a high-level suggestion.
Where to start, what to automate first, and how to keep pace with discovery that no longer has a barrier to entry.
The reason to find everything is not the list. It is that you cannot make an informed decision about a product you only partly understand. Once you know the whole picture, you can rank it honestly, dismiss what is not reachable, and put the effort where it changes something.
Prescriptive fixes were always too expensive to write. A human tester had hours, not days, so you got a category of advice: sanitize input, improve the encryption, harden the interface. True, and almost impossible to act on without redoing the analysis yourself.
Remediation is the part AI is unreasonably good at. It holds the whole context at once: the finding, the surrounding code, the architecture, the constraints. So the output is not a category, it is the change, at the line, in your language and your codebase.
And it does not stop at writing the fix. The same loop can push it, test it, and confirm the finding is actually closed, then start over on the next release. That is the full agentic circle, and it is the part of this shift that pays for itself.
"AI has collapsed the cost of vulnerability discovery to nearly zero. The manufacturers who prepare now will spend next year shipping. The ones who don't will spend it explaining themselves to regulators."
Jason Sinchak, CEO and co-founder of ELTON Cyber, has spent more than a decade testing medical devices and has taken 1,000+ vulnerability reports through FDA review.
Recorded September 1, 2026. Forty five minutes plus Q and A, and the slide deck goes with it.
The session covers what happens when AI collapses the cost of vulnerability discovery to nearly zero: why the CVE curve keeps climbing, why every finding still needs an evidenced disposition under FDA premarket 524B and postmarket expectations, how to architect automated analysis that tests reachability on the actual device, and how to route verified findings into CI/CD.
This is a methods session, not a product demo. The material is vendor neutral, and every technique covered can be built in house regardless of which tools you run today. The agenda moves from the discovery trend to the disposition obligation, the analysis, the CI/CD loop, a migration sequence, and Q&A.
Product security and regulatory leaders at medical device manufacturers. The takeaways are aimed at teams who own the triage volume, who have to produce a defensible call on every finding, and who cannot pause shipping to rebuild their process. The recorded Q&A covers firmware heavy products, SaMD, and connected platforms.
Yes, this is the replay. The session aired Tuesday, September 1, 2026 and ran 45 minutes plus Q&A. The recording and the slide deck sit on this page behind one short form, and the page stays unlocked in your browser once you have filled it in. Anyone who registered for the live session can use the same form to get both.
Finding is no longer the bottleneck. AI tools tear through products at a speed humans cannot match, so findings per product per release have outrun manual triage. The harder question is which of them are actually exploitable against a specific device rather than theoretically present in it, and answering that takes device context.