Inside FDA Cybersecurity Deficiencies: Lessons From Real Premarket Reviews

What are FDA reviewers actually flagging in medical device cybersecurity submissions, and what can manufacturers do to address those gaps before they delay clearance?

Blue Goat Cyber has analyzed real FDA cybersecurity deficiency letters, and some of the most common findings involve incomplete Software Bills of Materials (SBOMs), insufficient security testing, poorly documented security controls, and gaps in cybersecurity risk assessments. Many of these issues go beyond missing documentation and point to weaknesses in how manufacturers identify, validate, and mitigate security risks throughout the development process.

On November 17, Christian Espinosa, Founder and CEO of Blue Goat Cyber, and Joseph M. Saunders, Founder and CEO of RunSafe Security, will discuss what these findings can teach manufacturers preparing their next premarket submission. 

Christian and Joe will explore how comprehensive penetration testing, accurate SBOM generation, vulnerability analysis, and embedded runtime security can help device manufacturers demonstrate stronger security practices, address exploitable weaknesses, and build resilience into devices from the start.

Event Details

Date: Tuesday, November 17, 2026

Time: 10:00 AM ET

Hosted by: RunSafe Security + Blue Goat Cyber

What You’ll Learn

• Which cybersecurity issues recur in real FDA premarket deficiency letters and why they persist
• What makes an SBOM and vulnerability assessment accurate and defensible
• How to connect penetration testing, threat modeling, and control validation to submission evidence
• How to evaluate and document mitigations when vulnerabilities cannot be eliminated immediately
• What to prioritize before your next FDA submission

Make your next premarket review a stronger reflection of the security work already done, rather than the point at which gaps are first uncovered.