What FDA expects and how to stay ahead of attackers
The line between “software company” and “medical device manufacturer” has never been thinner.
Connected infusion pumps, remote patient monitoring systems, mobile companion apps, cloud-hosted analytics platforms, AI-powered diagnostics – these aren’t edge cases anymore. They’re the norm, and as software-as-a medical device and software-enabled medical devices become more powerful, attackers are treating them like any other high-value target: something they can ransom, pivot through, or quietly exploit.
2025 has been a pivotal year. Regulators have raised the bar, hospitals are under constant cyber pressure, and manufacturers are realizing that “basic IT security” is not enough for devices that directly impact patient care.
Below are the key cybersecurity trends medical device manufacturers need to watch as we move into 2026 and what to do about them.
- OTS and Tooling Vulnerabilities: Your Device Is Only as Secure as Your Supply Chain
For years, manufacturers have worried about off-the-shelf (OTS) software and open-source components inside their devices. In 2025, that concern has expanded to everything around the device as well:
- Developer workstations and build servers
- IDEs and plugins
- Browsers and browser extensions
- CI/CD pipelines and test harnesses
- Admin consoles and remote support tools
Attackers are increasingly targeting these soft spots. Compromise the developer’s environment and you can poison the build. Compromise the admin console and you can reconfigure a fleet of devices at scale.
Why this matters now
Regulators and customers no longer accept “we use industry-standard libraries” as a comfort statement. They want to see:
- A real SBOM (Software Bill of Materials) that includes third-party/OTS components that include a depth of information inclusive of data like component hashes and support capabilities.
- A comprehensive process for monitoring vulnerabilities in those components.
- Documented risk decisions and mitigations, not ad-hoc firefighting when a CVE hits the news.
What manufacturers should do
- Expand your SBOM scope
Don’t limit your SBOM to runtime code, firmware and device binaries. Include critical build tools, containers, and key third-party services that could impact what ultimately ships. - Formalize third-party risk management
Create intake and review processes for new libraries, SDKs, and tools. Define criteria (support, patch history, licensing, vulnerability posture) and make the decision trackable. - Harden the development environment
- Limit admin privileges on dev machines
- Restrict plugins and extensions to approved lists
- Use secure build pipelines with signed artifacts and integrity checks
- Connect it to your quality system
Treat software supply chain security as part of design controls and ongoing risk management, not just an IT project.
- AI Everywhere: In Your Device, Your Tools, and Your Threat Landscape
AI is no longer a specialized add-on. In 2025, it shows up in three places that matter to medical device cybersecurity:
- AI-enabled features in the device itself (e.g., decision support, triage, image analysis)
- GenAI tools in the development lifecycle (coding assistants, test generation, documentation)
- AI-powered attacks (more convincing phishing, faster exploit development, automated recon)
Each of these brings unique risks.
AI in the device
AI/ML components change how we think about validation, integrity, and explainability. Tampered models, poisoned training data, or unintended behavior in edge cases can all have safety implications.
AI in development
GenAI tools speed up development, but they’re also good at generating:
- Vulnerable code patterns
- Incorrect security assumptions
- Copy-pasted snippets from unknown or incompatible sources
Without guardrails, you can silently accumulate technical and security debt.
AI in attacks
Attackers are using AI to:
- Write better phishing emails and deepfake audio/video
- Automate scanning and exploitation
- Generate malware variants that evade signature-based defenses
What manufacturers should do
- Build AI threat modeling into your standard practice
Explicitly consider:- Prompt injection and model manipulation
- Training data poisoning
- Insecure model updates and deployment
- Abuse of AI-powered agents with broad system access
- Govern AI usage in development
- Define acceptable use of AI coding tools
- Require human review and security scanning for AI-generated code
- Document how these controls fit into your Secure Product Development Framework (SPDF)
- Test AI like a critical subsystem, not a black box
Include adversarial and negative testing, robustness checks, and clear rollback paths for model updates.
- Phishing and Social Engineering: The Human Perimeter Is Under Siege
Despite all the sophisticated technology, many breaches still start the same way: someone is tricked.
In 2025, phishing and social engineering are more convincing than ever thanks to AI-generated content and deepfakes. For medical device manufacturers, that targeting includes:
- Engineers and DevOps staff (to compromise code or pipelines)
- Customer support and field service (to abuse remote access tools)
- Hospital IT and clinical staff (to gain device or portal access)
Why this matters for devices
A successful phishing attack can lead to:
- Stolen credentials for cloud portals and admin interfaces
- Misconfigurations that weaken security controls
- Unauthorized remote access to deployed devices
- Changes to configurations that impact safety or availability
What manufacturers should do
- Treat identity and access management (IAM) as a core safety control
- Enforce multi-factor authentication (ideally phishing-resistant)
- Use role-based access control with least privilege
- Log and monitor all admin and remote access activity
- Design remote access with malicious insiders in mind
Assume an attacker can obtain support credentials. Build safeguards:- Just-in-time access
- Time-bound and session-recorded support connections
- Customer approval workflows where appropriate
- Educate your own teams—then back it with process
Awareness alone isn’t enough. Build:- Clear change approval flows
- Strong separation between dev, test, and production
- Incident playbooks that assume a credential has been stolen
- Support your customers
Provide hospitals and clinics with security implementation guides that cover:- How to integrate with their identity provider
- How to manage and revoke accounts
- Recommended alerting and monitoring
- Ransomware and Operational Disruption: Availability Is a Safety Issue
Hospitals continue to be prime targets for ransomware. When their IT systems go down, medical devices are caught in the blast radius:
- Devices can’t reach cloud services they depend on
- Workflows are delayed or rerouted
- Staff revert to manual processes, sometimes under extreme stress
In some cases, devices or associated systems are directly impacted by ransomware, encrypting local data or rendering interfaces unusable.
The key shift in 2025
Regulators and healthcare providers increasingly view availability and resilience as part of safety, not just convenience. The question is no longer “Is your device secure?” but:
“Can your device still support safe care when things go wrong around it?”
What manufacturers should do
- Design for graceful degradation
When cloud or network services are unavailable, devices should:- Fail safely, not fail silently
- Provide clear, actionable status to users
- Support fallback workflows where feasible
- Harden critical systems against ransomware-style attacks
- Use least-privilege access to file systems and services
- Restrict write access for processes that don’t need it
- Consider read-only or cryptographically protected system images for key components
- Plan for recovery before an incident happens
- Define how you’ll deliver emergency patches
- Document how devices can be reimaged or restored safely
- Align your incident response with customers’ hospital and health-system processes
- Communicate clearly with customers
Provide guidance on:- Network segmentation
- Backup strategies for device-related data
- How you will notify them about vulnerabilities and patches
- Cloud Configuration: The New “Shared Responsibility” Reality
Most modern devices rely on some form of cloud service—telemetry, analytics, dashboards, remote configuration, AI inference, and more.
In 2025, cloud misconfigurations remain one of the most common and preventable causes of security incidents:
- Over-privileged IAM roles
- Publicly exposed storage buckets or APIs
- Insecure default configurations and security groups
- Undersecured ML and data processing services
For medical device manufacturers, these aren’t just IT problems—they’re regulatory and safety risks.
What manufacturers should do
- Treat cloud architecture as part of the device architecture
Document:- Data flows between device, cloud, and third-party services
- Trust boundaries and network segmentation
- Roles and permissions for each component
- Use “secure by default” cloud baselines
- Standardize on hardened templates (via Infrastructure as Code)
- Enforce logging, encryption, and network restrictions
- Run automated config scanning and policy checks in CI/CD
- Clarify shared responsibility with customers
If customers deploy any part of the solution in their own cloud or network:- Spell out what you secure vs. what they must secure
- Provide reference architectures and configuration guides
- Include this in contracts and technical documentation
- Continuously monitor and adjust
Cloud environments are dynamic. Build processes for:- Detecting drift from secure baselines
- Reviewing access patterns and tightening privileges
- Responding quickly when new cloud vulnerabilities emerge
Turning Trends into Competitive Advantage
The bad news: cyber threats against medical devices are getting more sophisticated, and regulators are watching closely.
The good news: manufacturers who embrace cybersecurity as a design and lifecycle discipline—rather than a last-minute checkbox—are in a strong position to:
- Earn trust from hospitals and partners
- Move through regulatory review more smoothly
- Avoid costly recalls, field actions, and brand damage
- Differentiate in a crowded market
If you’re a medical device manufacturer, 2025 is the year to ask:
- Do we have a Secure Product Development Framework that actually runs in practice?
- Are we managing third-party, AI, cloud, and human-factor risks in a structured way?
- Can we demonstrate reasonable assurance of cybersecurity with real evidence—not just slides?
If the answer to any of these is “not yet,” you’re not alone—and it’s fixable.
How We Can Help
This is exactly the space we live in.
We partner with medical device and SaMD manufacturers to:
- Build and refine Secure Product Development Frameworks (SPDF)
- Run practical threat modeling on devices, cloud back ends, and AI components
- Develop SBOMs and third-party risk programs that go beyond spreadsheets
- Design IAM, remote access, and cloud security architectures that stand up to real-world threats
- Create submission-ready cybersecurity documentation and lifecycle management plans
If you’d like to sanity-check your current approach—or explore what these 2025 trends mean for your specific product roadmap—contact us to set up a conversation.
Your devices don’t just need to work. They need to be trustable, resilient, and secure—every day, in the environments where patients rely on them.
Related Posts
