Skip to main content
    All Episodes
    Episode 040 · September 30, 2025 · 44m listen

    Medical Device Startups and Cybersecurity Challenges with Suzy Engwall | Ep. 39

    Suzy Engwall
    Founder & CEO
    Health Tech Strategies

    Episode Summary

    This episode of The Med Device Cyber Podcast features Suzy Engwall of Health Tech Strategies, who shares insights on the challenges faced by medical device startups, particularly concerning cybersecurity. Engwall, with her two decades of experience in healthcare innovation, highlights that while funding and market fit are primary concerns for startups, cybersecurity often gets overlooked until compliance becomes a hurdle for FDA approval. The discussion emphasizes the increasing scrutiny from hospitals regarding device security, often exceeding FDA requirements, especially for legacy devices. The conversation also delves into the complexities of product adoption in healthcare, including market nuances, internal politics, and the evolving role of AI in clinical decision-making. The guests debate shared liability in AI-driven diagnostics and the patient's awareness of AI use, underlining the critical need for early cybersecurity integration in product development, a risk-based approach to device security (especially for Class II and III devices), and clear communication of risks to all stakeholders, including patients. Engwall advises startups to engage with the FDA early to understand regulatory pathways and potential future claims. The episode underscores the never-ending cat-and-mouse game of cybersecurity and the importance of anticipating threats from the initial idea stage.

    Key Takeaways

    • 01Medical device startups often deprioritize cybersecurity, focusing instead on funding and market fit, leading to potential roadblocks during FDA approval.
    • 02Hospitals are increasingly implementing stringent cybersecurity requirements that often surpass FDA mandates, making it difficult for even recently developed devices to gain adoption if security was not baked in from the start.
    • 03The integration of AI in healthcare introduces complex questions of liability and accountability for diagnostic decisions, with a current industry trend toward labeling AI tools as 'clinical decision support' rather than 'diagnosis' to mitigate liability.
    • 04A risk-based approach is crucial for medical device cybersecurity, differentiating needs based on potential patient harm (e.g., Class I vs. Class II/III devices) rather than solely on data privacy or technical vulnerabilities.
    • 05Patients generally lack awareness and engagement regarding the cybersecurity risks of medical devices, often trusting their physicians without asking critical questions about the technology being used.
    • 06Startups should engage with the FDA early in the development cycle to understand regulatory requirements, especially concerning product claims and future iterations, to avoid compliance issues later on.

    Frequently Asked Questions

    Quick answers drawn from this episode.

    • This episode of The Med Device Cyber Podcast features Suzy Engwall of Health Tech Strategies, who shares insights on the challenges faced by medical device startups, particularly concerning cybersecurity.

    • Medical device startups often deprioritize cybersecurity, focusing instead on funding and market fit, leading to potential roadblocks during FDA approval. Hospitals are increasingly implementing stringent cybersecurity requirements that often surpass FDA mandates, making it difficult for even recently developed devices to gain adoption if security was not...

    • The discussion emphasizes the increasing scrutiny from hospitals regarding device security, often exceeding FDA requirements, especially for legacy devices. It's most useful for medical device manufacturers, cybersecurity engineers, regulatory affairs professionals, and MedTech founders preparing for FDA review.

    • Medical device startups often deprioritize cybersecurity, focusing instead on funding and market fit, leading to potential roadblocks during FDA approval.

    Listeners also asked

    Quick answers pulled from related episodes.

    Share this episode

    Pre-fills with: "Medical device startups often deprioritize cybersecurity, focusing instead on funding and market fit, leading to potential roadblocks during FDA approval."

    Hello and welcome back to the Med Device Cyber Podcast. Today we're going to be talking about how you can get your device to market, what you need to do, the things you need to think about, and how you can make sure you're not letting cybersecurity slow you down. I'm your co-host, Trevor Slatterie, and I'm joined by our co-host, Christian Espinosa. We also have a very special guest today, Suzy Engwall. I'll let you introduce yourself. Sure. Yeah, thank you guys so much for having me. Again, I'm Suzy. I have a small consulting company called Health Tech Strategies. I've been in healthcare for about 20 years now. I actually started in lean transformation inside of a hospital, which I did for about 10 years. And it was fantastic trying to make change in healthcare, but it was really hard to do with no money, no technology, no staff, and no time. So, I made my way over to the innovation side so that we could truly make some change about 10 years ago and never looked back. So, I've done everything from setting up innovation programs at hospitals to teaching human-centered design to clinicians and physicians, to mentoring advising startups, to working with investors, and everything kind of in between. So, I love this space. I'm very passionate about it. I have a little bit of an extra passion for pediatrics and women's health, but I'm happy to be here today. I think this topic is really interesting. I don't claim to know everything about cybersecurity, which is why I'm thankful for people like you, but I'm happy to be here today and to talk about this with you guys. Awesome. And you're coming to us from California. Is that right? Yep. Southern California. SoCal. I was born in Riverside, which is part of SoCal. Trevor is moving to California. It's kind of like, is it Central or Northern California? San Francisco Bay Area. That's kind of Northern. Northern. Yeah. Signed a lease as of Sunday. So. Oh, wow. That's huge. Yeah. Super excited. That is huge. That's an expensive area. Yeah, it's coming from Arizona though, which is getting more expensive because everyone from California is taking over Arizona, of course. And but you know, you don't have all the weather problems. In Arizona, it's either 120 degrees or 45, and there doesn't really seem to be any in between. So, well, Phoenix, it's always warm. Yeah, Phoenix, it's always warm. And you'll love San Francisco. The climate is fantastic. Although, you might get a little bit more rain than you're used to. Yeah, and pretty big medtech scene. It seems that I was already out there enough for conferences or events or this that or the other thing. So, save myself a flight once in a while. Yeah. Love it. Love it. I really like it up there. I think I'm in Orange County, so I'm SoCal, but it is a huge medtech scene, and there's always something to do every single night. If you want to go to any kind of an investor event, you'll find one free around every corner. So, it's a fantastic place to live in this industry, for sure. That's awesome. Isn't there like a SoCal and NorCal rivalry that goes on in California? You know what? I kind of feel like there is. It's weird though because when I talk to people from Northern California, I don't necessarily feel it, but I do think there's a little bit of that. Like, I think there's a little bit of NorCal envy down here in SoCal. You know, we have a great ecosystem, but we know that the ecosystem here doesn't get together as much, isn't probably as big, especially with the investor pool as maybe Northern California is. So, I think we have a little bit of envy. You know, a lot of times I have friends that are posting about all the fun medtech events they're going to and the investor events they're going to, and I'm like, darn it, it's a short flight, but I can't make it up there tonight. So, there's a lot of things that I feel like I miss out on by not being up in the Northern California region. So, for me, it's more of an envy than anything. You guys get way better weather though, so at least you have. It's true. Our weather is fantastic. You can. It's always the same, isn't it? It's like 75 and sunny. Yeah. Yeah. San Diego, I have to argue, has the best. And they have a really, really good ecosystem in San Diego, too. And you'd think it's not that far away. But, you know, going anywhere in California, it takes you forever to get there. If it's a 15-mile drive, you got to times that by three, and that's how long it's going to take you to get there. Awesome. So, I know you work with Suzy, with startups and kind of help them with a roadmap. What are some of the biggest challenges that startups face from your perspective? You know, I mean, I think it's everything. It starts with funding, really, right? How do we get funding for our project? How do we get funding for what we're moving forward in? But I mean, even things from go-to-market strategy, regulatory, reimbursement, especially people that are coming in new to the market and trying to understand what are all the pieces of the puzzle that I need to put together and how do I put them together? And I think cybersecurity, since this is kind of our topic today a little bit, is one that I don't think that startups think about as much as they should. And it is a challenge because it's something that for certain products, you're going to have to have it for FDA approval and things like that. But unless there's compliance around it, sometimes it can be a bit daunting or maybe gets completely overlooked. There are definitely multiple challenges in this space, and it all kind of starts from the idea stage on. So happy to talk about any one of those topics. There's no shortage, for sure. Yeah. It's interesting because we talked to a lot of investors, and one of the investors that I talked to said, out of his portfolio, 7% of companies succeed. So, 93% fail in medtech. Why do you think the 93% fail? It's a pretty high number. I know like in business in general, startups fail, but that's a pretty high number. It is. And I think a lot of it comes down to how hard it is to get a product adopted in healthcare. Market adoption is challenging. Buying cycle times are very lengthy. So even once you are able to kind of get into the hospital, sometimes it can take some time. I often see people that have issues where maybe they have like a great physician champion who's really kind of working the system to get them in, and then it's been six months, and they're waiting and waiting, and it's close, and then that physician leaves and goes somewhere else, and all of a sudden, everything just gets dropped, and you kind of have to start over. So there's incidents like that that happen. Sometimes I think it's a lack of product-market fit. I mean, most of the time it's a lack of product-market fit, right? Not understanding where your product should really be placed within the ecosystem and not really. Is that step one though, like knowing how you develop a product, knowing who's going to consume it, how are you people are going to pay for it, isn't like kind of like step one? It is. But even when you think like, hey, I have a great product, so I'll kind of give an example here. Like sometimes you can have the best thing since sliced bread that's really going to help a patient out. The physicians like it, the patients like it, but then it does something like either call out a certain segment of caregivers. Like maybe it's somehow accidentally showcasing what nurses aren't doing right, and then you get pushback from the nursing population. Or maybe it's going to interfere with a physician. Like I actually have had a physician say out loud about a product, I will not say who because I'm not going to throw anybody under the bus, you know, this product is great, but it's going to cost me billable visits, so I probably won't adopt it. And I love the level of honesty, but it also is a sad thing to hear. There's a lot of nuances. So even when you feel like you might have product-market fit, you may not because there might be those little nuances that you maybe didn't think about early on. That's interesting. I didn't think about the nuances, but you're saying like the nurses might, if a product highlights something they're not doing as great as they should, they're going to push back. So the product, even though it's solving a massive problem, it's not going to get adopted because of basically politics. Yes. Yeah. So there are all kinds of internal politics. I actually had marketing shoot down a product that we were going to work on for a company for a hospital many years ago. We had an idea that a clinician had come up with that they wanted to integrate into a hospital, and we were kind of working with them to co-develop something, and we got the green light from everybody. And then we said,

    Hosted by

    More from your hosts

    Other episodes diving into Christian and Trevor's areas of focus.

    Episodes covering similar ground.

    Listen to this episode