Hardware Podcasts

#472: Cost Containment: Right-Sizing Medical Device Cybersecurity with Chris Gates

Global Medical Device Podcast · 21 Sept 2026 · 40m · Episode 472

What this episode covers

Chris Gates, founder and CEO of arsMedSecurity, explains why medical device manufacturers must right-size cybersecurity efforts early in the development lifecycle to avoid catastrophic financial and regulatory consequences. He argues that deferring security until the end of development leads to severe FDA delays, with a typical 180-day hold potentially destroying a startup's burn rate. Gates highlights the accelerating threat landscape driven by Large Language Models (LLMs), which reduce vulnerability exploitation windows from years to minutes, making reactive patching ineffective. He provides concrete steps for compliance, including performing system-level threat modeling before hardware freeze and aligning software development SOPs with ISO/IEC 81001-5-1 and ISO 62304 standards.

Most relevant to

companies scaling up

Topics

Mentioned

Companies
arsMedSecurity, Greenlight Guru, Illumina, Valentium, Acutis, Abbott, St. Jude, Hugging Face
Products
ChatGPT
Tools
eStar
Also
ISO/IEC 81001-5-1, ISO 62304, STRIDE

Related episodes from other shows

Other shows on the same ground, closest first.

  • Manufacturing Happy Hour · 49m

    188: Adopting a Cybersecurity Strategy That Fits Your Manufacturing Business with Mollie Breen, CEO & Founder of Perygee

    Mollie Breen, CEO and founder of Perygee, discusses cybersecurity strategies for manufacturing businesses, drawing on her background as a mathematician at the NSA and her experience navigating government bureaucracy to launch her company. She emphasizes returning to foundational security practices like asset inventory and network segmentation, especially as AI introduces new offensive and defensive capabilities. Breen outlines tailored approaches for different company sizes, noting that small businesses should leverage default security settings and segmentation, while scaling companies must build maturity to satisfy investor due diligence. She also highlights the unique regulatory challenges in medical devices and the evolving role of security leaders from 'veto votes' to business enablers.

    Security & privacyAI & machine learning
    9 chapters

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Let's Combinate · 41m

    134 - ISO62304, Software Development Process, SaMD, Closed Loop Systems, Complexities with Cloud and Better Software in MedTech with Richard Koch

    Richard Koch, founder of KochSaMD, explains the complexities of developing cloud-based medical devices, using a closed-loop insulin pump system as a primary case study. He details how ISO 62304 governs software development within the broader ISO 13485 framework, emphasizing the shift from batch-based physical manufacturing to continuous, high-velocity software updates. Koch warns that tech giants like Apple and Google are disrupting the industry by leveraging their digital expertise to acquire or compete with traditional medtech firms, urging leaders to upskill in software development to survive.

    Embedded firmwareConnected products & IoT
    7 chapters

  • Being an Engineer · 51m

    S5E29 Steve Gompertz | Medical Device Quality Control & Regulatory Requirements

    Steve Gompertz, a partner at QRx Partners with prior leadership roles at Medtronic, Boston Scientific, St. Jude Medical, and Pelican Biothermal, explains how to build scalable quality management systems for medical device companies. He details the evolution of regulatory frameworks, noting the shift toward stricter EU standards and the integration of AI and cybersecurity into device compliance. Gompertz emphasizes tailoring quality systems to company size, using a case study of a client who reduced FDA findings from dozens to zero by implementing a holistic, process-connected system rather than a checklist approach. He also advocates for concurrent engineering and cross-functional teams to accelerate development while maintaining rigorous safety standards.

    Medical & health devicesQuality & yield
    10 chapters

  • The Pragmatic Embedded Podcast · 33m

    How to Speed Up Safety Critical Processes

    Jeff Gable and Luca Njani discuss strategies to accelerate safety-critical development in medical devices, automotive, and aerospace without compromising quality. They argue that reducing scope for initial releases and automating documentation using modern tools like Jama and Matrix significantly shortens cycle times. The hosts emphasize that modern regulatory guidance, such as the FDA's Computer System Assurance, supports streamlined validation processes, allowing teams to iterate faster and uncover defects earlier.

    Medical & health devicesDesign for manufacturing & NPI
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Global Medical Device Podcast. The episode itself belongs to its publisher.