Design for Security from the Start: Making Medical Device Cybersecurity More Resilient

MedTech innovation is revolutionizing healthcare but is also introducing new cyberattack vectors that can put manufacturers, hospitals, and patients at risk.

In Episode 44 of the MedTech Speed to Data Podcast, Key Tech VP of Business Development Andy Rogers and Senior Computer Engineer Jamie Kendall discuss the FDA’s latest cybersecurity guidance.

Need to know

• Smart, connected devices have greater risks — Medical devices are emerging vectors for bad actors targeting the healthcare industry.
• FDA’s 2025 cybersecurity guidance update — The agency recommends risk-based development frameworks to make device cybersecurity more resilient.
• Clarifying “cyber devices” — The FDA’s guidance applies to any medical device that runs software and could connect to the Internet.

The nitty-gritty

“Cybersecurity was always baked into our process,” Jaime explains. More specifically, Key Tech has adapted the TIR57 risk-based standard for managing medical device security to the new rules. “[The FDA’s] 2023 guidance really laid the groundwork for our latest process. We’ve tweaked it slightly with the [latest update]. There are more explicit documentation requirements around vulnerability monitoring and more details on the software bill of materials (SBOMs).”

Jamie goes on to describe how Key Tech’s cybersecurity risk management plan informs product development. The security team starts by developing a threat model based on evaluations of data flows, data storage, and the cybersecurity activities protecting that data.

“One of the first things that we always do is a threat model. This is a visual model of the system to show the elements of the device, where data is flowing, and where your trust boundaries are. This is a one-page, digestible visual that everyone can look at, assess, and go ‘yep, that makes sense’ and then build your initial architecture and risk assessment based on that.”

The security team documents the resulting security architectures using the FDA’s recommended views:

• Global System View: Describes how software integrates with hardware and networks and the associated cybersecurity mitigations.
• Multi-Patient Harm View: Identifies mitigations for vulnerabilities or failures that could compromise multiple devices and harm multiple patients.
• Updateability/Patchability View: Summarizes the end-to-end process for distributing software updates and patches, especially if manufacturers do not control the entire path.
• Security Use Case View: Documents scenarios in which vulnerabilities can compromise the device’s safety or effectiveness.

“To give a sense of scale,” Jamie says, “this isn’t one or two documents. It’s a pretty large effort, and it’s one of those things that you want to start early in your development process.”

Data that made the difference:

Throughout his conversation with Andy, Jamie shares some of the lessons Key Tech has learned about designing secure medical devices, including:

• Design for security from the beginning. Late changes are expensive, especially once in pre-production or after your FDA submission.
• Avoid cyber rabbit holes. Rather than addressing every possible threat, use data and risk to prioritize the real threats.
• Don’t roll your own cybersecurity. Stick to standard practices, or you risk introducing unknown, novel vulnerabilities.
• Fully document your SBOMs. Standard libraries introduce layers of dependencies that you must understand. That’s the only way to control your exposure to new vulnerabilities.
• Design devices that are truly safe. Cybersecurity risks are real. Don’t treat compliance as a check box.

Watch the whole conversation in the video below to learn more about designing for cybersecurity, the importance of third-party penetration testing, and more.

HSBC Innovations is the global bank’s financing arm for American and European startups, especially in the healthcare and life sciences industries. The bank’s semi-annual Venture Healthcare Reports document trends in the investment market.

Key Tech’s Andy Rogers welcomes the report’s author, HSBC Innovation Managing Director Jon Norris in Episode 43 of the MedTech Speed to Data podcast.

Need to know

• · Four core market segments — HSBC Innovation’s Venture Healthcare Reports cover investments and exits in Biopharma, Dx/Tools, Med Device, and Healthtech.
• · Sourcing investment data — Norris enriches Pitchbook data with additional structure and analyses, making the report more relevant to these market segments.
• · Sourcing exit data — Norris supplements media and industry publications with market research and conversations with industry leaders.
• · An investment data tapestry — The reports provide “an honest picture of what’s going on in the market” so investors and innovators alike “can make targeted smart decisions.”

The nitty-gritty

Andy and Norris discuss the investment market’s recent history before exploring drivers of today’s investment headwinds.

“2021 was a record-setting year,” Norris recalls. “Every record that could be set for deals and dollars was set across all the sectors.” Things changed in 2022 as new BioTech IPOs struggled, prompting investment reprioritizations.

“VCs had done all these… frothy valuations,” Norris says. “They had to go back and look at their own portfolios and say, does this company have enough capital? How do you want to put money to work?”

Investments rebounded in 2024, but not the number of deals. Investors poured money into their existing portfolios to boost their exit chances, resulting in today’s nine-figure megadeals.

“Basically, they’re smooshing two rounds together and extending the investors coming in to support that round,” Norris says.

Headwinds stiffened in 2025 as tariffs, a more litigious competitive space, and other factors amplified business uncertainty.

Norris attributes this progression to the psychology of venture capital. “When you think about what makes these folks tick,” Norris explains, “they want to continue to raise new venture funds because they get paid management fees. But in order to raise their new venture funds, they have to show their investors that they’ve actually gotten returns.”

That means reaching an acquisition or IPO. “They’re very focused on getting to exit right now. That’s why they’re so focused on their existing portfolio. And because of that, they haven’t been doing as many new investments.”

New investments still happen, of course, but the criteria have changed. “While the dollars are actually up in some of these sectors, especially Med Device,” Norris says, “you’re seeing that being put to work on later-stage deals because they’d rather get a shorter time to exit.”

Data that made the difference:

Norris’ insights from the HSBC Venture Healthcare Report let him advise startups fighting today’s investment headwinds.

Adopt a megaround mentality. “Series B has been extremely difficult,” Norris says. “[Raising] sub two million, that’s one thing. But if you’re looking to raise five million, it’s almost better to raise twelve.”

Find investors outside the mainstream. “Traditional venture investors don’t want to write small checks.” Norris sees angel groups, innovation centers, and other small investors funding these early rounds.

Explore acquisition exits, but be careful. “On the device side, most of the corporates have been pretty darn active,” Norris says. However, some litigate to block emerging competition, especially in the Dx/Tools sector. Norris’ recommends researching potential acquirers before taking meetings.

Download the HSBC Venture Healthcare Report for Norris’ complete analysis, and watch the video below for insights into the Medical Device and Dx/Tools sectors, AI’s role in MedTech, and more.

In-utero procedures can yield better long-term outcomes for the baby. However, fetal surgery relies on instruments developed for other disciplines. An early-stage startup in Maryland is developing in-utero instruments to improve outcomes for both fetus and mother.

Fetal Therapy Technologies CEO Selena Shirkin joins Key Tech’s Andy Rogers for Episode 42 of the MedTech Speed to Data podcast to discuss startup innovation in fetal surgery.

Need to know

• Fetal surgeries carry risks — In addition to uterine damage complicating future pregnancies, 40% of surgeries have a risk of preterm birth.
• Few specialized tools are used — In the field’s forty-year history, the FDA has only approved the Karl Storz Fetoscope for use in fetal surgeries.
• Off-label device use is widespread — Equipment borrowed from adjacent fields like laparoscopy and neurosurgery weren’t indicated for use in the uterus.

The nitty-gritty

Shirkin and Chief Technology Officer Eric McAlexander founded Fetal Therapy Technologies as students in Johns Hopkins University’s biomedical engineering graduate program. While shadowing surgeons, they saw how off-label instruments complicated procedures.

“I watched a surgeon using a grasper and suture,” Shirkin recalled. “The suture was falling out of the grasper because they didn’t fit. It took time in the surgery to make sure that didn’t occur.”

Observations like these led the team to wonder why the field lacked optimized tools. “As biomedical engineers,” Shirkin says, “we asked ourselves what if we created those purpose-built instruments that actually make these procedures safer?”

They quickly ran into the commercial limits of a market as small as fetal surgery. With only one device FDA-approved for in-uterine procedures, surgeons have no choice but to use devices off-label. So Fetal Therapy Technologies is flipping the script by leveraging the broader applications of an instrument designed for fetal surgeries.

“In a way, our company solves two problems at once,” Shirkin says. “A company that creates a fetal innovation [that] also raises a much broader market of general microsurgery.”

Their first product is a uterine port. “Similar to laparoscopic surgeries,” Shirkin explains, “that involves inserting a port through the abdomen into the uterus. [The new] port is designed to leverage the elastic properties of the uterine environment to make entry safer than the current clinical standard.”

For broader commercialization, they aim to demonstrate equivalence to predicate devices and qualify as a 510(k) Class II device following benchtop and animal studies. Approval for fetal surgeries is a longer journey, but the company can build on its data before entering human trials.

Data that made the difference:

Shirkin offered insights for other students considering an entrepreneurial future in MedTech.

• Leverage university resources. “We work incredibly closely with the Johns Hopkins Center for Fetal Therapy,” Shirkin says. We’ve also gotten opportunities from Johns Hopkins Technology Ventures.”
• Build a network of advisors. “We are supported by a very broad variety of clinical, technical, and business mentors across the Johns Hopkins ecosystem and beyond.”
• Tap into local funding sources. “There’s a lot of collegiate business plan competitions that we’ve been very successful [raising] non-dilutive funds that way. There are also state-level grants. We just received a Baltimore Innovation Initiative grant.”