Hardware Podcasts

#407: Cybersecurity in MedTech: FDA Compliance, Patient Safety & the Hidden Risks You’re Missing

Global Medical Device Podcast · 19 May 2025 · 42m · Episode 407

What this episode covers

Christian Espinosa, founder of Blue Goat Cyber, explains why medical device cybersecurity must be integrated from the requirements phase to ensure patient safety, citing real-world risks like skin burns from hacked acne lasers and missed sepsis diagnoses. He details the FDA's September 2023 regulatory overhaul, which mandates Software Bill of Materials (SBOMs), static/dynamic testing, and risk assessments tied to patient harm, noting that traditional IT security vendors often fail to meet these specific medical device standards. Espinosa warns that waiting until the last minute to address security can lead to catastrophic delays, costly retrofits like disabling hardware features due to lack of secure boot support, or even abandoned projects.

Most relevant to

companies scaling up

Topics

Mentioned

Companies
Blue Goat Cyber, Greenlight Guru, AWS
Also
FDA

Related episodes from other shows

Other shows on the same ground, closest first.

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • Embedded.fm · 1h 09m

    67: Software for Things That Can Kill People

    Hosts Chris White and Elecia White discuss the rigorous regulatory processes for safety-critical software, drawing on their experiences with the FAA (DO-178B) and FDA (510k, PMA) for medical devices and avionics. They explain how hazard analysis determines certification levels, the necessity of extensive documentation and traceability, and the tension between agile development and waterfall compliance. The conversation highlights the ethical responsibility of engineers to push back against unsafe deadlines, the use of hardware compartmentalization (FPGAs, voting systems) to ensure safety, and the legal liabilities associated with product failures.

    Certification & complianceMechanical engineering
    8 chapters

  • Let's Combinate · 1h 03m

    021 - "Options" with Karandeep Singh Badwal

    Karandeep Singh Badwal, a QA/RA consultant and host of The MedTech Podcast, explains how defining 'intended use' determines whether a product is a regulated medical device or unregulated software, a critical distinction for startups. He details the specific regulatory challenges of Software as a Medical Device (SaMD), including cybersecurity, GDPR compliance, and the impact of the EU MDR on software classification. Badwal also discusses the strategic advantages for UK software companies post-Brexit, where they can still self-certify as Class 1 devices while EU counterparts face stricter notified body audits.

    Validation & product-market fitQuality & yield
    9 chapters

  • The Pragmatic Embedded Podcast · 33m

    How to Speed Up Safety Critical Processes

    Jeff Gable and Luca Njani discuss strategies to accelerate safety-critical development in medical devices, automotive, and aerospace without compromising quality. They argue that reducing scope for initial releases and automating documentation using modern tools like Jama and Matrix significantly shortens cycle times. The hosts emphasize that modern regulatory guidance, such as the FDA's Computer System Assurance, supports streamlined validation processes, allowing teams to iterate faster and uncover defects earlier.

    Medical & health devicesDesign for manufacturing & NPI
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Global Medical Device Podcast. The episode itself belongs to its publisher.