# #407: Cybersecurity in MedTech: FDA Compliance, Patient Safety & the Hidden Risks You’re Missing

- Show: [Global Medical Device Podcast](https://hardwarepodcasts.com/podcast/global-medical-device-podcast)
- Published: 2025-05-19
- Length: 42m
- Episode: 407
- Page: https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2025-05-19-407-cybersecurity-in-medtech-fda-compliance-patient-safety-the-hidden-risks-your
- Listen: https://podcast.greenlight.guru/episode/407-cybersecurity-for-medical-devices

## Summary

Christian Espinosa, founder of Blue Goat Cyber, explains why medical device cybersecurity must be integrated from the requirements phase to ensure patient safety, citing real-world risks like skin burns from hacked acne lasers and missed sepsis diagnoses. He details the FDA's September 2023 regulatory overhaul, which mandates Software Bill of Materials (SBOMs), static/dynamic testing, and risk assessments tied to patient harm, noting that traditional IT security vendors often fail to meet these specific medical device standards. Espinosa warns that waiting until the last minute to address security can lead to catastrophic delays, costly retrofits like disabling hardware features due to lack of secure boot support, or even abandoned projects.

## Outline

1. Introduction: Christian Espinosa and Blue Goat Cyber
2. Patient Safety vs. Data Privacy in MedTech
3. Real-World Hacking Scenarios: Acne Lasers and Diagnostics
4. FDA's September 2023 Regulatory Overhaul and SBOMs
5. Hardware Constraints: Secure Boot and Microcontroller Mistakes
6. The Training Gap: Developers vs. Security Experts
7. AI Bias and Cybersecurity in Medical Devices
8. Advice for RA/QA Professionals and Final Thoughts

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Certification & compliance](https://hardwarepodcasts.com/topic/certification-and-compliance)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)
- [AI & machine learning](https://hardwarepodcasts.com/topic/ai-and-machine-learning)
- [Hiring & workforce](https://hardwarepodcasts.com/topic/hiring-and-workforce)

## Most relevant to

companies scaling up

## Mentioned

- Blue Goat Cyber (company)
- FDA (other)
- Greenlight Guru (company)
- AWS (company)

## Related episodes from other shows

- [140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa](https://hardwarepodcasts.com/podcast/lets-combinate/2024-06-12-140-medical-device-diagnostics-cybersecurity-3rd-party-software-sboms-evaluating) (Let's Combinate)
- [#000: How New IoT Security Regulations Will Shape the Industry's Future](https://hardwarepodcasts.com/podcast/coredump-sessions/2024-09-17-000-how-new-iot-security-regulations-will-shape-the-industrys-future) (Coredump Sessions)
- [67: Software for Things That Can Kill People](https://hardwarepodcasts.com/podcast/embedded-fm/2014-09-11-67-software-for-things-that-can-kill-people) (Embedded.fm)
- [021 - "Options" with Karandeep Singh Badwal](https://hardwarepodcasts.com/podcast/lets-combinate/2022-02-23-021-options-with-karandeep-singh-badwal) (Let's Combinate)
- [How to Speed Up Safety Critical Processes](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2021-07-27-how-to-speed-up-safety-critical-processes) (The Pragmatic Embedded Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2025-05-19-407-cybersecurity-in-medtech-fda-compliance-patient-safety-the-hidden-risks-your. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Global Medical Device Podcast.