The Med Device Cyber Podcast
Medical-device cybersecurity FAQ
Common questions about secure design, testing and incident readiness, drawn from conversations with Christian Espinosa and his guests.
These answers summarize interview discussions. They are educational, not device-specific legal, regulatory or clinical advice.
6 answers
01 / Secure development
When should we start medical-device cybersecurity?
Start while defining the product and its architecture, not just before a submission or final test. Identify security needs alongside clinical, usability and regulatory needs so the design can support them. In her interview, Helen Souris discusses how postponing security and compliance can lead to costly rework and make commercialization harder.
02 / Security testing
How is penetration testing different from vulnerability scanning?
A vulnerability scan identifies potential weaknesses. Penetration testing investigates how those weaknesses could be exploited, what an attacker could accomplish and how that affects the device. Parker Daudt discusses documenting attack paths and understanding device and patient-safety impact rather than treating a list of findings as the whole assessment.
03 / Lifecycle protection
Is patching enough to protect a medical device?
Patching is important, but it is not a complete defense strategy. Joe Saunders discusses additional runtime protection against exploitation of memory-related vulnerabilities, rather than relying only on fixing individual flaws after discovery. His approach is a perspective from the interview, not a guarantee that a device is secure or a reason to stop patching.
04 / Incident readiness
Why should a medical-device company run tabletop exercises?
A tabletop exercise rehearses incident decisions before a real emergency. Daniel Hammond and Christian Espinosa discuss testing how teams coordinate across functions, who makes decisions and what happens if normal company communications are unavailable. The exercise helps reveal gaps in a response plan that may look complete on paper.
05 / Connected implants
Why is cybersecurity challenging for long-lived implants?
An implant can remain in use while the surrounding technology and security assumptions change. Frederik Ceyssens discusses how manipulated stimulation or sensory information could affect a patient, and an architecture that keeps much of the processing in an external, updateable unit. That example highlights why longevity and the ability to update the system belong in early design decisions.
06 / Human-centered design
How do usability and cybersecurity fit into device design?
Consider them together, early in development, with the people who will use the device. Dylan Horvath and Christian Espinosa discuss how late changes to hardware, firmware, access controls and user interactions become expensive. Security decisions need to work within the clinical workflow, while usability affects whether a useful product is actually adopted.
