Why ELTON · Why Subscription

Testing that keeps pace
costs less and proves more.

A point-in-time test restarts from zero every time, ends when the budget does, and goes stale in six months. A subscription accumulates evidence, tests only what changed, and gets deeper every release. That difference shows up in your submission, your invoice, and your ship date.

What FDA asks for

Frequent testing is not a choice.
It is the guidance.

The premarket guidance builds the submission on a framework that runs the length of the product. It says in plain words when testing should happen.

Secure Product Development Framework

Testing runs the length of the product

“An SPDF encompasses all aspects of a product’s lifecycle, including design, development, release, support, and decommission.”

Section V

“FDA recommends that cybersecurity testing should occur throughout the SPDF. Security testing early in development can ensure that security issues are addressed prior to impacting release timelines... After release, cybersecurity testing should be performed at regular intervals commensurate with the risk (e.g., annually).”

Section V.C, Cybersecurity Testing
Total Product Life Cycle

Risk keeps arriving after you ship

“Security risk management should be an integrated part of a manufacturer’s entire quality management system, addressed throughout the TPLC.”

Section V.A

“Cybersecurity risks may continue to be identified throughout the device’s TPLC. Manufacturers should ensure they have appropriate resources to identify, assess, and mitigate cybersecurity vulnerabilities as they are identified throughout the supported device lifecycle.”

Section V.A.6, TPLC Security Risk Management

FDA also asks you to report the clock

Section V.A.6 recommends tracking and submitting the “Duration from vulnerability identification to when it is updated or patched.” A model that tests once a year reports that number once a year, and it is the number a reviewer reads first.

Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. FDA final guidance, February 2026. Docket FDA-2021-D-1158.

1 · Regulatory exposure

Find it before it becomes
a regulatory artifact.

A vulnerability found during development is a development artifact you control. The same vulnerability found in formal testing is a document a reviewer reads.

Fixed before it is on the record

Continuous testing surfaces findings early, while they are cheap to fix and before they ever reach a formal report or quality document. You control the timeline because nothing external has started a clock.

Fewer findings at the formal test

By the time the submission test runs, the volume and severity of what remains has already been reduced. Fewer findings in the FDA submission, fewer in the reports your customers read.

The record shows the work

Every early fix leaves an evidenced test case behind, so the reduction is demonstrable rather than asserted.

2 · Cost

Pay for the delta,
not the restart.

When testing keeps pace with the product, each release costs a fraction of a full engagement. That is only possible if someone kept the evidence.

Engagement model · twelve months, one product
6 restarts
1 history
Point-in-timea new consultant relearnsthe product every timeSubscriptionevery release inherits thetest cases before itTEST 1from zeroTEST 2from zeroTEST 3from zeroR1R2R3R46restarts, six invoicesone product, paid for six times1history, compoundingeach release pays for the delta
restart from zerorelease testedevidence retained
The same twelve months. One model pays to restart six times, the other pays for what changed.
The mechanism

Unchanged components
do not need retesting.

Traceable test cases plus a digital twin of coverage let you diff the release and zero in on what actually changed. The rest carries hundreds of executed test cases and the evidence to defend them.

Release diff · R5 to R6
3 inherited
2 retest
847 cases carried
RELEASE R5last tested buildRELEASE R6shipping nextTHE DIFF2 of 5components moved since R5TEST THE DELTAINHERITEDBluetooth stackunchanged since R4DICOM listenerunchanged since R2Web UI bundleunchanged since R5847 test cases carry forwardRETEST, SCOPEDAuth servicechanged this releaseUpdate clientchanged this release
unchanged, evidence inheritedchanged, retest scopedcomponent in the twin
Traceable test cases plus a twin of coverage is what evidences that unchanged components need no retest.
3 · Speed

Milestone tests in days,
reports that never go stale.

Incremental testing means a milestone test closes in under two days. Continuous SBOM monitoring means the report is current whenever you need it.

Under two days per milestone

Keeping pace means each test covers a delta, not a device. Findings land while the release is still open instead of after it shipped.

Regenerate the report any day

If nothing changed in the software since the last test and every new public CVE is already triaged, the report can be regenerated on demand. That outlasts the six-month shelf life a one-time consulting test carries.

Ship on your schedule

Testing stops being the gate. The evidence is standing by before anyone asks for it.

4 · Capacity

Reserved capacity,
no lead time.

An annual subscription reserves the team before you need it. Release schedules move, and the testing is still there on the day the schedule lands.

Release calendar · eight weeks around a milestone
3 open weeks
8 weeks reserved
BOOKING A CONSULTANTW1bookedW2bookedW3openW4bookedW5bookedW6openW7bookedW8openYour code freeze slips to W5. The next open slot is W8, or you pay to jump the queue.RESERVED CAPACITYW1yoursW2yoursW3yoursW4yoursW5yoursW6yoursW7yoursW8yoursCapacity is blocked off in advance, so the answer to “can you test Thursday” is yes.
sold to whoever booked firstreserved for your productopen, for now
“We will have to check the schedule” is one of the most expensive sentences in a release plan.

Booking a consultant

Capacity is sold by the week to whoever booked first. A code freeze that slips means requeuing, and pulling testing forward costs a short-notice fee charged exactly when you have the least room to argue.

Reserved capacity

Capacity is blocked off for your product in advance. No lead time, no availability check when a milestone moves, no expedite fee in the week that matters.

5 · Depth

Depth is a function
of time on the product.

A point-in-time test maxes out at two or three weeks and scratches the same surface every time. Researchers and HDOs testing your product have no such constraint.

Attack surface coverage · 40 testable areas on one product
7 consulting
34 subscription
ONE CONSULTING ENGAGEMENT2 to 3 weeks, then the budget is gone7 OF 40 AREAS REACHEDthe same familiar surface every timeTWO YEARS OF SUBSCRIPTIONevery release targets what has not been tested34 OF 40 AREAS REACHEDbreadth and depth accumulate every release
reached once, then time ran outreached and re-reachednever tested
Depth is not a talent question. It is how long someone has been allowed to keep looking.

The ceiling is the budget

Consulting depth stops where the engagement stops. Repeat it annually and you re-cover the same familiar ground rather than reaching further in.

Nobody else has a clock

Independent researchers and high-profile health systems spend as long as they want on your product. That asymmetry is why third-party vulnerability reports land so hard.

Coverage compounds

Each release targets what has not been tested or was never a focus, so breadth and depth accumulate across months and years, at lower cost than any single engagement.

6 · Faster patching

Prescriptive fixes,
scoped V&V.

Long-term engagements track the posture of the product, so guidance stops being generic. The fix is contextual, and so is the retest it forces.

Consulting guidance
F-01  SQL injection in device query
        → “You should sanitize input.”

F-02  Weak TLS on management port
        → “Perform better encryption.”

No file, no line, no patch, no verification. Development guesses, then V&V retests everything the guess touched.

The ELTON Fix
Weakness: TLS negotiation on mgmt port

- ctx = ssl.PROTOCOL_TLS
+ ctx.minimum_version = ssl.TLSVersion.TLSv1_3

Verified against the digital twin at runtime, then delivered into Jira or Azure DevOps. V&V scopes to the line that moved.

Not “sanitize your inputs”

Consulting guidance is high-level because the consultant does not know the product. ELTON ships the ELTON Fix: prescriptive remediation down to the code, delivered as a ticket or over ELTON MCP, ready for a developer.

The fix with the broadest impact

Subscription testing plus CVE management makes fix optimization possible: find the change that knocks out the most highs and criticals at once, rather than patching them one at a time.

V&V scoped to the change

The twin knows the blast radius of a fix, so revalidation covers what actually moved. That is what takes patch deployment from months to days.

7 · AI needs a platform

AI testing only pays off
inside a subscription.

AI finds vulnerabilities in days. The output is large, and raw volume is a liability without somewhere to put it. The platform is what turns that volume into verdicts.

Finding classification · one release, one device
Few direct
Dozens conditional
Rest weakness
Hundredsraw findings from scanners,SBOM feeds and test toolsDozensconditional, gated behindanother root causeA fewdirectly exploitable, andthese carry the exposureDirectExploitable on its own from a known entry vector. This is thenumber that carries regulatory exposure, and it should be a handful at most.ConditionalReal, but reachable only while another root cause keeps producingthe condition it needs. Fix the root and the condition closes.WeaknessNo path on this device today. Ships dismissed withits reasoning, and gets re-evaluated as the product changes.
directly exploitableconditionalweakness, dismissed
Point-in-time tests call everything a vulnerability because two weeks with a device is not enough time to know what is reachable.

Volume needs contextualization

Faster discovery means more findings per release. Each one still needs exploitability determined, a CVSS rating, and a correct classification before anyone can act.

Classified against the real attack surface

A vulnerability in code that is unreachable from the outside-the-case attack surface is not today’s problem. It gets tracked and addressed in time, not escalated as a crisis.

Directly exploitable, conditional, or a weakness

A medical device under regulatory exposure should not carry more than a handful of directly exploitable vulnerabilities. Point-in-time tests call everything exploitable because they lack the system context to say otherwise.

Subscription models share the value of AI with the customer: more testing, better results, the same price. A point-in-time engagement has no reason to pass the savings on, and every reason to keep the turnaround long.

What to require

Six questions that separate
a model from an invoice.

Any firm can put the word subscription on an annual engagement. These are the things that make it one.

01

Test case traceability that carries across engagements, not a fresh scope each time

02

A model of the product that shows what changed since the last test, at component level

03

Findings classified as directly exploitable, conditional or weakness, with the reasoning attached

04

Fixes written to a file and a line, verified before they reach a developer

05

Reports that can be regenerated against today’s CVE set without a new engagement

06

Transparency on where AI is used, and how that efficiency reaches your price and your coverage

Continuous testing is not a faster version of the old engagement. It is the only model where evidence accumulates instead of being rebuilt every year.

Stop paying to start over.

One subscription, every release, with the evidence accumulating behind you.

Exploitability management for medical devices. FDA §524B methodologyExploitability proven at runtime95% faster than legacy testing Book a Demo
Platform
OverviewAvoid FDA DeficienciesAvoid Consulting FeesDigital Twin TraceabilityAI PentestingExploitability VerificationVulnerability ChainingRemediation OptimizationRemote TestLink™Incident ResponseAutomated VEX & MetricsCVSSv4 Migration
Solutions
Postmarket SurveillanceIncident ResponseSecurity EngineeringRegulatory AffairsFDA §524BEU MDR/CRAEU REDNIS2IMDRF N60 / N73Japan MHLW
Why ELTON
Subscription TestingAI-NativeFDA ComplianceVerified ExploitabilityELTON vs. Legacy TestingThreat-Led AI PentestingMDDT MethodologyCredentialsDevice ModalitiesPricing
Resources
FDA Deficiency ListFDA Testing RequirementsFDA Cyber SOPs & TemplatesRemediation LibraryRegulatory GuidesWebinarsAI NewsletterThe End of Legacy TestingThe AI Vulnerability ExplosionSecurity AdvisoriesWhitepapersIntelligence & Blog
Company
AboutLeadershipCareersPartnershipsContact Meet ELTON
See the graph decide, live >