Home
Solutions
FDA 510(k)

Solutions · Compliance · FDA 510(k)

Medical device penetration testing for FDA 510(k) premarket cybersecurity

Medical device cybersecurity is now part of what FDA reviews in a premarket submission. ioSENTRIX tests your device, firmware, wireless interfaces, apps and cloud the way an attacker would, ties each finding to your threat model, and includes a retest of your fixes so the testing documentation in your submission holds up.

Scope my device test See what FDA asks for

GuidanceFDA premarket cybersecurity guidance (Feb 2026) · FD&C Act section 524B

Who asksFDA reviewers, your regulatory team and hospital customers

What you getIndependent pentest and fuzzing reports, retest included, mapped to your threat model

Independently rated

★★★★★ 4.9 / 5 on G2 (12 reviews) · 5.0 / 5 on Clutch

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026Key terms: Embedded device security, SBOM, Fuzz testing

Trusted by security teams at

01The requirement

Does the FDA require penetration testing for a 510(k)?

FDA recommends it, and cyber devices carry legal requirements. FDA's final guidance on cybersecurity in medical devices (February 3, 2026) recommends that security testing documentation be submitted in premarket submissions and lists penetration testing among the testing to consider including. For cyber devices, section 524B of the FD&C Act requires a postmarket vulnerability plan, cybersecurity processes and an SBOM.

GuidancePenetration testing recommended

Alongside threat mitigation, vulnerability and fuzz testing. Guidance is nonbinding.

StatuteSection 524B for cyber devices

Plan, processes and SBOM required in the 510(k), De Novo or PMA submission.

ReportIndependence, scope, methods

FDA asks reports to show tester independence, scope, duration, methods and results.

What is medical device penetration testing?

Medical device penetration testing is an authorized, simulated attack on a device and its system: firmware, wireless and wired interfaces, companion apps, update mechanisms and cloud services. It looks for vulnerabilities an attacker could discover and exploit, and documents them in the form FDA asks for in a premarket submission.

What is medical device cybersecurity under FDA guidance?

FDA recommends designing cybersecurity in, for example through a secure product development framework (SPDF), with threat modeling, security risk management, an SBOM, security testing throughout development, and a plan for postmarket vulnerabilities. Read FDA's final guidance or our 510(k) and section 524B explainer.

02See it in action

From design control to premarket evidence

How one security control on a connected device is tested like an attacker would, fixed, retested and documented for your premarket submission.

Illustrative

01Evidence this test supports

Threat modelUpdate path

AuthenticitySoftware binaries

PentestIndependent

FuzzingBLE inputs

524B(b)(2)Updates, patches

Risk fileResidual risk

02The control, tested

Control: the device accepts firmware only from the manufacturerCritical

Finding: unsigned firmware update accepted over Bluetooth Low Energy (BLE)

Control in threat model

TestTesters build a modified image and push it over the BLE update service
ProveTest unit boots the modified firmware: authenticity not verified
FixCode signing with on-device signature verification described
RetestModified image now rejected; fix confirmed
SubmitReport with scope, methods, independence and results

03Test report contents

Tester independence and expertise
Scope, duration and methods
Finding, fix and risk assessment
Retest result
Traceability to the threat model

Report statusTest report open

From the threat model

We start from the threats and controls in your threat model and test whether each control holds, so results trace straight back to your design documentation.

A report FDA can review

Reports state our independence and expertise, scope, duration, methods and results, the elements FDA's guidance asks penetration test reports to include.

Fixed, then proven fixed

A retest of your fixes is included, so your submission shows each finding assessed, remediated or justified, and confirmed.

Illustrative example. The device, interface and statuses are a composite for explanation only and do not describe any client. Testing uses test units agreed in the rules of engagement, never devices in clinical use.

Text version of the exhibit

Control: your threat model says the device accepts firmware only from the manufacturer. FDA's guidance includes software binaries among the information a device should be able to authenticate.
Test: testers build a modified firmware image and push it to a test unit over the Bluetooth Low Energy update service, alongside fuzz testing of the BLE inputs.
Finding: the test unit boots the modified firmware, so authenticity is not verified. The finding is rated Critical.
Fix: we describe code signing with signature verification on the device, which also supports your update and patch processes under section 524B(b)(2).
Retest: the modified image is rejected and the fix is confirmed; residual risk is recorded in your risk file.
Submitted: the report (tester independence and expertise, scope, duration, methods, results and traceability to the threat model) goes into your premarket submission.

03Requirement to evidence

What cybersecurity evidence does FDA expect in a 510(k)?

What FDA's guidance and section 524B ask for, what ioSENTRIX tests for each, and the evidence that goes into your submission.

Expectation	What FDA asks	What ioSENTRIX tests	Evidence in your submission
Threat modelGuidance	Threat modeling of the device system, with traceability to the risk assessment, SBOM and testing.	Threat modeling or review of yours, covering every interface and update path.	Threat model and traceability matrix
Risk assessmentGuidance	Cybersecurity risk assessment and a security risk management report.	Exploitability assessment of identified risks, proven on test units.	Findings mapped to risk controls
SBOM524B(b)(3)	A software bill of materials, including commercial, open-source and off-the-shelf components, required for cyber devices.	SBOM review and software composition analysis of firmware binaries.	SBOM validation and known-vulnerability notes
Security testingGuidance	Security requirements, threat mitigation and vulnerability testing (fuzzing, attack surface, chaining, code analysis) and penetration testing.	Embedded device penetration testing, fuzzing of wireless and wired inputs, app and cloud testing.	Reports with independence, scope, duration, methods and results
Findings assessmentGuidance	Your assessment of every finding, with rationale for any fix not implemented or deferred, and plans for future releases.	Risk-ranked findings with fix guidance, then a retest of your fixes.	Findings log, retest results and deferral rationale
Postmarket524B(b)(1), (b)(2)	For cyber devices: a plan to monitor, identify and address postmarket vulnerabilities, and updates and patches for known unacceptable vulnerabilities.	Testing of the update mechanism, retests of patches and testing after significant changes.	Update-path results and patch retests

Summarized from FDA, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions," final guidance issued February 3, 2026 (nonbinding recommendations), and section 524B of the FD&C Act as described in that guidance. Orientation, not regulatory advice. FDA decides what evidence is sufficient.

04Timing

When should you test a medical device for FDA?

Throughout development, as FDA recommends, with an independent penetration test before the design is frozen for submission.

Design (SPDF)
Security requirements and architecture built into the secure product development framework.
Design review
Threat model
Every interface, update path and connected system modeled and risk-assessed.
Threat model
Test
Fuzzing, SBOM and binary analysis, and an independent penetration test on test units.
Manual testing
Fix and retest
Fix guidance for each finding, then a retest of your fixes.
Retest included
Submission package
Reports and traceability ready for your 510(k), De Novo or PMA.
Evidence pack
Postmarket
Testing of updates and patches, and after significant changes.
Ongoing

PremarketEvidence for the submission

Threat model, risk assessment, SBOM and security testing documentation, including penetration test reports, in the premarket submission.

PostmarketKeep the device cybersecure

For cyber devices, the 524B(b)(1) plan and timely updates and patches, with testing that confirms each fix.

05Evidence pack

What's in a medical device cybersecurity evidence pack?

The testing documentation your regulatory team needs for the submission, in one place.

Tester independence and expertise
Who tested, their qualifications and their independence from your developers.
Scope, duration and methods
Device, firmware, interfaces, apps and cloud in scope, dates and the methods used.
ANSI/ISA 62443-4-1NIST SP 800-115
Findings with proof
Each finding with evidence, exploitability, potential impact and steps to reproduce.
SBOM and binary analysis
Software composition results and known vulnerabilities in third-party components.
Retest results
Fixes retested and recorded, with rationale noted for any deferred finding.
Traceability
Each result traced to the threat model and risk assessment.
Threat modelRisk file524B

06Independently verified

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.SVP, Chief Information Security Officer · Verified G2 review ↗

★★★★★

“We were impressed with ioSENTRIX's ability to independently validate the security of our customer-facing product.”

Zeehasham R.Data Scientist, Security Operations · Insurance · Verified Clutch review ↗

4.9 / 5 on G212 reviews · High Performer, Fall 2026↗

5.0 / 5 on ClutchPremier Verified↗

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards↗

CREST-accredited firmPenetration testing↗

ISO/IEC 27001 certifiedOur own information security management system↗

SOC 2 Type 2 attestedOur own controls, independently examined↗

07How we help

Services that support a premarket submission

From the first threat model to testing every update after clearance.

Case study · Safety-critical systems

Proprietary, segmented control systems tested in a safety-critical environment

Penetration test of a communication-based train control system built on proprietary software
Pivoting across segmented networks reached critical communication nodes
Security controls and the incident response plan improved

Read the case study

Services for medical device makersEmbedded device penetration testingFirmware, hardware interfaces, BLE and wireless, and update paths.Threat modeling and secure design reviewArchitecture review, threat modeling and code review for your SPDF.Mobile app penetration testingCompanion apps that pair with or control the device.Cloud security assessmentDevice cloud and data platforms on AWS, Azure and GCP.Compliance support (CaaS)Documentation and readiness support around your submission.HIPAA penetration testingWhen your device platform also handles ePHI.

08Insights

Read before you scope your device test

November 16, 2024

510(k) Regulatory Pathway Basics and Cybersecurity Requirements

The basics of the 510(k) pathway: who must submit, eligibility, key requirements, and what Section 524B cybersecurity rules add for cyber devices.

September 17, 2024

FDA 510(k) Submission Process, Including Cybersecurity

How the FDA 510(k) submission process works, step by step, and the Section 524B cybersecurity evidence cyber devices must now include.

September 12, 2024

Understanding Medical Device Security Audit

This blog post highlights the important steps for conducting a thorough assessment and testing of cybersecurity risks in medical devices.

January 9, 2024

Navigating FDA Cybersecurity Compliance: Essential Guidelines for Healthcare Product Manufacturers

Discover the importance of cyber security for medical device manufacturers and learn how ioSENTRIX's comprehensive services can assist in meeting the FDA's cybersecurity requirements.

09FAQ

Medical device cybersecurity questions

Short answers to what device makers and regulatory teams ask us most.

Ask us something else

Does the FDA require penetration testing for a 510(k)?

FDA's final guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026), recommends that security testing documentation be included in premarket submissions, including 510(k)s, and lists penetration testing among the types of testing to consider. FDA asks that penetration test reports state the testers' independence and technical expertise, the scope, duration and methods of testing, and the results. The guidance contains nonbinding recommendations; for cyber devices, section 524B of the FD&C Act adds statutory requirements.

What is a cyber device under section 524B?

Section 524B(c) of the FD&C Act defines a cyber device as a device that includes software validated, installed or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains technological characteristics that could be vulnerable to cybersecurity threats. FDA's guidance treats firmware and programmable logic as software, and counts any means of connecting to the internet, intended or not.

What does section 524B require of cyber device manufacturers?

A submission for a cyber device must include information FDA requires to show it meets section 524B(b): a plan to monitor, identify and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure (524B(b)(1)); processes and procedures that provide reasonable assurance the device and related systems are cybersecure, including updates and patches (524B(b)(2)); and a software bill of materials (524B(b)(3)).

What security testing does FDA recommend for medical devices?

The guidance lists, among others: testing of security requirements; threat mitigation testing against your threat models; vulnerability testing such as abuse and misuse cases, malformed and unexpected inputs (robustness and fuzz testing), attack surface analysis, vulnerability chaining, known vulnerability scanning, software composition analysis of binaries and static and dynamic code analysis; and penetration testing.

Does the penetration tester need to be independent?

FDA asks manufacturers to state who performed the testing and what level of independence the testers have from the developers who designed the device, and notes that third parties may sometimes be needed to ensure appropriate independence. For third-party reports, FDA asks for the original report. ioSENTRIX tests as an independent third party.

What happens to findings we decide not to fix before submission?

FDA asks for your assessment of every finding, including the rationale for not implementing or deferring a fix. For remediation deferred to a future release, the submission should contain plans for that release, including the vulnerabilities it will address and anticipated timelines.

Does ioSENTRIX prepare or submit the 510(k)?

No. ioSENTRIX provides the cybersecurity testing, threat modeling, SBOM review and reports that go into your premarket submission. Your regulatory team prepares and submits it, and FDA makes the clearance decision.

Ready when you are

Get premarket cybersecurity evidence that holds up

Tell us about your device, its interfaces and your submission date. We will help you scope the right testing and plan it before design freeze.

Written scope and timeline before testing starts
Retest of fixes included
Reports built around FDA's premarket guidance

Scope your medical device test

Takes about a minute.

Medical device penetration testing for FDA 510(k) premarket cybersecurity

Does the FDA require penetration testing for a 510(k)?

What is medical device penetration testing?

What is medical device cybersecurity under FDA guidance?

From design control to premarket evidence

From the threat model

A report FDA can review

Fixed, then proven fixed

What cybersecurity evidence does FDA expect in a 510(k)?

When should you test a medical device for FDA?

Design (SPDF)

Threat model

Test

Fix and retest

Submission package

Postmarket

What's in a medical device cybersecurity evidence pack?

Tester independence and expertise

Scope, duration and methods

Findings with proof

SBOM and binary analysis

Retest results

Traceability

Services that support a premarket submission

Proprietary, segmented control systems tested in a safety-critical environment

Read before you scope your device test

Medical device cybersecurity questions

Does the FDA require penetration testing for a 510(k)?

What is a cyber device under section 524B?

What does section 524B require of cyber device manufacturers?

What security testing does FDA recommend for medical devices?

Does the penetration tester need to be independent?

What happens to findings we decide not to fix before submission?

Does ioSENTRIX prepare or submit the 510(k)?

Get premarket cybersecurity evidence that holds up