A point-in-time test restarts from zero every time, ends when the budget does, and goes stale in six months. A subscription accumulates evidence, tests only what changed, and gets deeper every release. That difference shows up in your submission, your invoice, and your ship date.
The premarket guidance builds the submission on a framework that runs the length of the product. It says in plain words when testing should happen.
“An SPDF encompasses all aspects of a product’s lifecycle, including design, development, release, support, and decommission.”
Section V
“FDA recommends that cybersecurity testing should occur throughout the SPDF. Security testing early in development can ensure that security issues are addressed prior to impacting release timelines... After release, cybersecurity testing should be performed at regular intervals commensurate with the risk (e.g., annually).”
Section V.C, Cybersecurity Testing
“Security risk management should be an integrated part of a manufacturer’s entire quality management system, addressed throughout the TPLC.”
Section V.A
“Cybersecurity risks may continue to be identified throughout the device’s TPLC. Manufacturers should ensure they have appropriate resources to identify, assess, and mitigate cybersecurity vulnerabilities as they are identified throughout the supported device lifecycle.”
Section V.A.6, TPLC Security Risk Management
Section V.A.6 recommends tracking and submitting the “Duration from vulnerability identification to when it is updated or patched.” A model that tests once a year reports that number once a year, and it is the number a reviewer reads first.
Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. FDA final guidance, February 2026. Docket FDA-2021-D-1158.
A vulnerability found during development is a development artifact you control. The same vulnerability found in formal testing is a document a reviewer reads.
Continuous testing surfaces findings early, while they are cheap to fix and before they ever reach a formal report or quality document. You control the timeline because nothing external has started a clock.
By the time the submission test runs, the volume and severity of what remains has already been reduced. Fewer findings in the FDA submission, fewer in the reports your customers read.
Every early fix leaves an evidenced test case behind, so the reduction is demonstrable rather than asserted.
When testing keeps pace with the product, each release costs a fraction of a full engagement. That is only possible if someone kept the evidence.
Traceable test cases plus a digital twin of coverage let you diff the release and zero in on what actually changed. The rest carries hundreds of executed test cases and the evidence to defend them.
Incremental testing means a milestone test closes in under two days. Continuous SBOM monitoring means the report is current whenever you need it.
Keeping pace means each test covers a delta, not a device. Findings land while the release is still open instead of after it shipped.
If nothing changed in the software since the last test and every new public CVE is already triaged, the report can be regenerated on demand. That outlasts the six-month shelf life a one-time consulting test carries.
Testing stops being the gate. The evidence is standing by before anyone asks for it.
An annual subscription reserves the team before you need it. Release schedules move, and the testing is still there on the day the schedule lands.
Capacity is sold by the week to whoever booked first. A code freeze that slips means requeuing, and pulling testing forward costs a short-notice fee charged exactly when you have the least room to argue.
Capacity is blocked off for your product in advance. No lead time, no availability check when a milestone moves, no expedite fee in the week that matters.
A point-in-time test maxes out at two or three weeks and scratches the same surface every time. Researchers and HDOs testing your product have no such constraint.
Consulting depth stops where the engagement stops. Repeat it annually and you re-cover the same familiar ground rather than reaching further in.
Independent researchers and high-profile health systems spend as long as they want on your product. That asymmetry is why third-party vulnerability reports land so hard.
Each release targets what has not been tested or was never a focus, so breadth and depth accumulate across months and years, at lower cost than any single engagement.
Long-term engagements track the posture of the product, so guidance stops being generic. The fix is contextual, and so is the retest it forces.
F-01 SQL injection in device query
→ “You should sanitize input.”
F-02 Weak TLS on management port
→ “Perform better encryption.”No file, no line, no patch, no verification. Development guesses, then V&V retests everything the guess touched.
Weakness: TLS negotiation on mgmt port - ctx = ssl.PROTOCOL_TLS + ctx.minimum_version = ssl.TLSVersion.TLSv1_3
Verified against the digital twin at runtime, then delivered into Jira or Azure DevOps. V&V scopes to the line that moved.
Consulting guidance is high-level because the consultant does not know the product. ELTON ships the ELTON Fix: prescriptive remediation down to the code, delivered as a ticket or over ELTON MCP, ready for a developer.
Subscription testing plus CVE management makes fix optimization possible: find the change that knocks out the most highs and criticals at once, rather than patching them one at a time.
The twin knows the blast radius of a fix, so revalidation covers what actually moved. That is what takes patch deployment from months to days.
AI finds vulnerabilities in days. The output is large, and raw volume is a liability without somewhere to put it. The platform is what turns that volume into verdicts.
Faster discovery means more findings per release. Each one still needs exploitability determined, a CVSS rating, and a correct classification before anyone can act.
A vulnerability in code that is unreachable from the outside-the-case attack surface is not today’s problem. It gets tracked and addressed in time, not escalated as a crisis.
A medical device under regulatory exposure should not carry more than a handful of directly exploitable vulnerabilities. Point-in-time tests call everything exploitable because they lack the system context to say otherwise.
Subscription models share the value of AI with the customer: more testing, better results, the same price. A point-in-time engagement has no reason to pass the savings on, and every reason to keep the turnaround long.
Any firm can put the word subscription on an annual engagement. These are the things that make it one.
Test case traceability that carries across engagements, not a fresh scope each time
A model of the product that shows what changed since the last test, at component level
Findings classified as directly exploitable, conditional or weakness, with the reasoning attached
Fixes written to a file and a line, verified before they reach a developer
Reports that can be regenerated against today’s CVE set without a new engagement
Transparency on where AI is used, and how that efficiency reaches your price and your coverage
Continuous testing is not a faster version of the old engagement. It is the only model where evidence accumulates instead of being rebuilt every year.
One subscription, every release, with the evidence accumulating behind you.