Episode 64 · March 26, 2026 · 50m listen · 9,496 words · ~47 min read

Early Design Decisions that Shape Medical Device Success with Chris Danek, CEO of Bessel | Ep. 63 - Full Transcript | The Med Device Cyber Podcast

Read the complete, searchable transcript of Episode 64 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.

Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.

Episode summary

In this episode of The Med Device Cyber Podcast, hosts Christian and Trevor welcome Chris Danek, CEO of Bessel, to delve into the critical importance of early design decisions in shaping the success and cybersecurity of medical devices. The discussion emphasizes that robust cybersecurity is not merely about data protection but fundamentally about patient safety, citing examples of severe harm that could result from compromised devices. The conversation highlights common misconceptions, such as the belief that all software developers inherently understand cybersecurity or that devices without obvious external connections are immune to cyber threats. A key takeaway is the necessity of integrating cybersecurity considerations from a product's inception, including hardware choices like microcontrollers, and the meticulous vetting of third-party software components through the creation of a Software Bill of Materials (SBOM). The episode stresses the iterative nature of cybersecurity throughout the total product lifecycle, rather than as a one-time assessment, and introduces threat modeling as an essential early-stage activity. The experts also touch upon the nuances of FDA expectations, particularly concerning vulnerabilities like self-signed certificates, and the distinction between traditional IT cybersecurity and the highly regulated medical device cybersecurity landscape.

Key takeaways from this episode

Cybersecurity in medical devices is primarily driven by patient safety, not just data protection, due to the potential for severe physical harm from compromised devices.
Lack of preparedness regarding the extensive scope of cybersecurity, particularly concerning third-party software components and hardware choices, can lead to significant delays and product setbacks.
The FDA explicitly disallows the use of probability for cybersecurity risk assessments, instead focusing on the criteria that must be true for an exploit to occur.
Early and continuous engagement with cybersecurity experts, including threat modeling from the idea stage, is crucial for making sound design decisions and avoiding costly delays.
The misconception that all software developers are cybersecurity experts is dangerous; specialized cybersecurity expertise is necessary due to differing skill sets and the evolving threat landscape.
Cybersecurity must be integrated throughout the entire total product lifecycle of a medical device, from initial design requirements to end-of-life considerations, rather than being treated as a one-time study.
In the context of FDA submissions, be aware of specific vulnerabilities like self-signed certificates that, while often overlooked in traditional IT security, are a significant concern for regulators due to data privacy and encryption implications.

Topics covered in this transcript

Full episode transcript

Startup companies sometimes can run past a milestone in a funding capacity, the runway of their company that could be make or break for the company itself. They like to say, “Oh, cybersecurity is just about data protection with medical devices.” But the primary driver is patient safety, because if you think about it, you can hack into a surgical robot that's performing surgery on somebody's spine. You can paralyze that person. There's this misconception that software developers understand cybersecurity. They will all tell you they are experts in cybersecurity, but the reality is, from my experience, I would say one out of a hundred actually know about cybersecurity. Christian, before you go forward on that, I'm just going to say, well, that's provocative and maybe to some people, not me, but to some people that's inflammatory. I think there's a good reason why many software engineers therefore then feel that they have some level of expertise. We'll start testing three months out from submissions when it's the first time someone's touched their code. And we come back with 3,500 vulnerabilities on day one and we say, “Well, you know, this is a conversation we need to have.” Yeah, it can save you like $500,000 in cost overruns and delays and everything else from a ten-minute conversation, right? Welcome back to another episode of The Med Device Cyber Podcast. Today, we're talking about how to build medical devices for impact and we have Chris Danek, a guest of ours from Bessel. We've also got our co-host Trevor as usual and then myself. I'm coming from beautiful Tempe, Arizona, where it's like 85 degrees out today. I think Trevor is coming from foggy San Francisco, where he insisted on moving to for, I don't know why, but you know, he likes the fog and the cold and rain. And then where are you coming from, Chris? You're also in California, right? I'm in San Carlos, California. You could think Silicon Valley. It's between the San Francisco airport and Palo Alto and I would say that our weather is typically pretty nice. Yeah, even though you're close to San Francisco, the weather is nicer there, isn't it? Yes, that's for sure. Why didn't you move to that area, Trevor? Why San Francisco? Why not Santa Clara or like closer to Silicon Valley? Well, Santa Clara, I don't like San Jose. Something about it, it just feels like this expanse. And San Francisco is nice because everything is in 49 square miles. So it's so easy to get from anywhere to anywhere. Yeah, and I'm down with Christian. I think the Niners come from the gold rush, but I didn't make that connection before. Denver airport is a larger area than San Francisco. Pretty interesting. Hey, Christian, thanks for inviting me on this podcast. I've been watching what Blue Goat's been doing for the past few years and I think you're filling a real gap in understanding, awareness, and actually execution on cybersecurity, which is more and more important. And I'm interested to talk too about the common challenges outside of cybersecurity that startups in our field are facing. So, thanks for the invitation. Yeah, thanks for joining us. I know we ran into each other at JP Morgan not too long ago and we're talking about the fog. I think one of the things you help companies do is remove some of that fog on their journey to commercialization. Would that be a good way to kind of kick off what you do and maybe describe a little bit about the companies you work with and everything? Yeah, I like that. I like that metaphor and trying to bring clarity in strategy, as you mentioned, and how we execute against that and how we can actually fuel the tank with fundraising. Those are the things we do. But it starts with the concept of breakthrough impact. And to me, breakthrough is an innovation in our domain of healthcare that will sustain and scale. Without that, it doesn't have the ability to impact millions of patients and thousands of caregivers and clinicians. So that's what we're all striving for in this industry really is to create breakthroughs that scale impact. And I would say that, you know, the challenges remain the same, but it's harder than ever to address the significant questions and concerns or risks that startups have to be able to answer the questions that investors have. You know, I would say that it used to be the case that you could talk about your commercialization plan later in the company life cycle because first, we know there's a demonstrated clinical need. We know the market is big enough and we think we have a line of sight in certain areas. And if we show technical proof of concept, clinical proof of concept, then maybe during the Series A round, we'll work harder on the commercialization plan and make it specific and concrete. This idea of proxy or relying on the experience of the team and the judgment of others around it, it breaks down because now startups have to answer, they have to have a good path to answering all of the questions that investors will have, even from the earliest stage that relates to commercialization.

1 / 11