Skip to main content
    Back to episode
    Episode 19 · April 29, 2025 · 26m listen · 1,164 words · ~6 min read

    Early Cyber Strategies for MedTech Trailblazers | Ep. 18 - Full Transcript | The Med Device Cyber Podcast

    Read the complete, searchable transcript of Episode 19 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.

    Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.

    Episode summary

    This episode of the Med Device Cyber Podcast delves into critical cybersecurity strategies for early-stage MedTech startups and innovators. Hosts Christian Espinosa and Trevor discuss why cybersecurity is often overlooked until late in the product development cycle, leading to significant delays, increased costs, and even product abandonment. They highlight the shift in regulatory landscape, especially after the September 2023 FDA guidance update, making cybersecurity a mandatory, not optional, consideration. The discussion emphasizes the "security by design" principle, advocating for integrating cybersecurity from the initial requirements phase rather than attempting to retrofit it later. Key topics include the importance of selecting developers with expertise in medical device standards like IEC 62304 and ISO 13485, understanding the documentation requirements for FDA 510(k) submissions, and factoring in the costs of secure development, third-party testing, and documentation early in the roadmap. The hosts also differentiate between safety and security, explaining their interconnectedness in medical device risk management, referencing ISO 14971 and TRIR-57. The episode serves as a vital guide for product security teams, regulatory leads, and engineers to proactively embed cybersecurity, reduce time-to-market risks, and attract investor confidence.

    Key takeaways from this episode

    • MedTech startups should integrate cybersecurity into their product development roadmap from the beginning to avoid costly delays and potential product abandonment.
    • Selecting developers experienced in medical device standards like IEC 62304 and ISO 13485, and who prioritize "security by design," is crucial for creating secure and compliant products.
    • Early and thorough documentation, including architecture diagrams, requirement specifications, and data flow diagrams, is essential for FDA submissions and reduces rework later on.
    • Founders need to budget for secure software development, third-party penetration testing, and regulatory documentation from the outset to avoid financial overruns and gain investor confidence.
    • Cybersecurity in medical devices impacts both security and patient safety, necessitating a holistic risk management approach that considers both ISO 14971 for safety and TRIR-57 for security.
    • The choice of hardware components, such as microcontrollers supporting secure boot, is as critical as software considerations for overall device security and FDA compliance, especially for higher-risk devices.
    • As regulatory landscapes evolve, investors increasingly expect cybersecurity to be a foundational element of a MedTech startup's plan, viewing it as a critical factor for market success and ROI.
    • Cybersecurity is not a "one-and-done" task but an iterative process that requires continuous consideration throughout the entire product lifecycle, from design to postmarket.

    Topics covered in this transcript

    Full episode transcript

    Page 1 of 2· Paragraphs 1 - 8
    Hi, welcome back to the Med Device Cyber Podcast. Today we're talking about a very interesting topic: what early-stage startups in the MedTech innovation space should consider from a cybersecurity perspective. Often, cybersecurity is not considered until the very end, or right before submission, when it should be considered at the beginning because it causes a lot of delays, frustration, and headache, and maybe the product not even making it to market, if people wait until the very end. So, we're advocating people consider it at the beginning, and we're going to talk about why that's important today. I'm your host, Christian Espinosa, I'm the founder of Blue Goat, and I've got my co-host here, Trevor. How are you doing today, Trevor? Not too bad. Getting ready to get to some warmer weather, but doing good. Warmer weather. Where's that? In China. Warmer weather in China. It's not going to be super warm there, but warmer than here. All right, perfect, awesome. So, what do you think our, I guess let's just kind of back up a little bit. What do you think the challenge is? Like, how come people, like if I'm a founder, early stage MedTech innovator, how come I don't think about cybersecurity early on? Is this just an awareness problem, or it's just like it's not something that's on the road map typically, or what do you think the root issue is with this? I think there can be a ton of issues with it. Awareness is a big one. Often times, you know, MedTech companies don't even know that cybersecurity is really a requirement until it's too late. This is becoming better; I feel like awareness has started to increase. People are becoming more conscious of cybersecurity as a regulatory requirement, especially after the latest guidance in September of 2023. There's been enough time for people to start catching up. It's been, gosh, about a year and a half since then, so the awareness is starting to grow. It's when a company's starting a MedTech startup; MedTech startups are very expensive, and they're prone to fail. They're often on shoestring budgets trying to, you know, build a pretty impressive product that costs millions in research and development. And so, having all of this money that you're getting in from VC funding or wherever it is, it's often immediately tied up the second it hits the account. Cybersecurity can be a little bit expensive, so manufacturers try to push it to the back burner, and they forget about it altogether, which is not the best way to go about it. It's more expensive at the end than if you do it at the beginning. And then, I think that if someone's not involved in the cybersecurity world, if they're involved in the MedTech world or the startup world, they're excited to create a product, and they're following that startup mindset of "move fast and break things." Make a product, get it out there, get feedback, refine it. That's the Silicon Valley mindset; that's the startup mindset. That's what we see so many of these companies doing, and that can be a little bit of a crutch. I think it's great for innovation for products, but you're missing important steps. And then when it finally comes time to do your 510(k) submission, your RA consultant is making sure you have all your ducks in a row, all your boxes ticked, and they said, "Okay, where's your cybersecurity documentation?" And then people go, "Oh, no, we didn't do that." And that's when they have a problem because they've already moved too fast, and they already have their product, and they're going to need to go back and rework it. So, what's the, and that's what we experience the most. People wait till the very last minute to consider cybersecurity. But what is the real ramification of that? What's the impact to the Med innovator? So, the big thing is time to market is going to get cut pretty heavily. If you forget about cybersecurity, and God forbid you try to submit without any cybersecurity, you're going to get rejected by the FDA immediately, and you're going to enter a review cycle. So, you have a 180-day response window, and 180 days can be a little bit tight to do cybersecurity from the ground up, and so you may lose your submission window altogether. Now, if you include some cybersecurity, you try to cobble some stuff together, but it's not enough, you're still going to have to go back and refine it, work on it, and then get it back out. A functionality or a way that you're implementing a feature gets rejected as insecure by the FDA, and this is something that we've seen, especially in long development products. If a device is designed to do something in a certain way, then that functionality might be inherently insecure. The way that you're handling certificates, the way that you're connecting to EMR just inherently is bad design. Then the FDA is going to kick it back, and they say, "You can't design a feature like this. You have to rework this. You're going to go back, you need to do more research, more development, and another submission to the FDA." That's going to slash your time to market by even up to a year in a situation like that. And that's a year you could have spent selling your device, and B, you're going to have to spend a lot of money fixing that problem.
    1 / 2