Medical Device
Cybersecurity Testing

醫療器材網路安全測試與滲透測試

What Is Medical Device Cybersecurity?

Cybersecurity for medical devices is essential to protecting patient data and lives, and to shielding healthcare organizations from ransomware attacks. As medical devices and their connectivity evolve, cyber threats continue to develop and introduce new risks. Medical device cybersecurity risk is multifaceted, demanding up-to-date certifications and standards together with thorough cybersecurity assessment.

Effective risk management means strengthening the entire lifecycle process to identify vulnerabilities and hardening protection through rigorous penetration testing.

Why Medical Device Cybersecurity Matters

• Protect patient safety — prevent compromised pacemakers or insulin pumps from failing or delivering incorrect doses
• Prevent exposure of health records, identity theft and loss of patient confidentiality
• Defend against ransomware attacks and keep healthcare systems operational
• Meet mandatory requirements from FDA, EMA, NMPA and other authorities, avoiding recalls or bans
• Obtain compliance evidence for EU, US and international market entry
• Strengthen product cyber resilience and reduce post-market safety concerns

Applicable Regulations & Standards

Given the risks involved, medical device cybersecurity must be tested against rigorous international and national standards. Secure Vectors × Applus+ can support the following:

• FDA US medical device cybersecurity guidance — quality system considerations and premarket submission content
• MDCG 2019-16 EU medical device cybersecurity guidance — reference framework for Notified Body review
• IEC TR 60601-4-5 medical device cybersecurity standard — a technical roadmap for global cybersecurity standards
• IEC 81001-5-1 security lifecycle standard for health software and health IT systems
• EN 18031 RED Article 3.3 wireless cybersecurity standard — required for devices with wireless functionality
• Section 524B FDA 510(k) submissions must include a complete SBOM, threat model and penetration testing report

Cybersecurity Testing Process

Using FDA-required cybersecurity testing as an example, the process ensures the safety and effectiveness of medical devices and includes the following stages:

Core Services

Penetration Testing

Secure Vectors × Applus+ offers a broad range of penetration testing services to evaluate a system's ability to withstand attacks and unauthorized access. By simulating cyberattacks, we assess vulnerabilities across each component of a medical device and recommend security measures grounded in our expertise. Penetration testing conducted by the Applus+ expert laboratory not only strengthens a product's cyber resilience but also demonstrates compliance with the cybersecurity requirements set by regulators worldwide, such as the US FDA.

Gap Analysis

Our team can also support global manufacturers by verifying whether their products comply with the specific standards or guidelines required by regulators. We review the documentation produced by the manufacturer to determine whether it meets a given standard and to identify any gaps or potential challenges, then analyze, advise on, and help prepare the required documentation before submission to the regulator.

For FDA cybersecurity testing, for example, Secure Vectors × Applus+ offers an optional service that reviews manufacturer documentation prior to premarket submission, focusing on 1) security requirements, 2) threat mitigation, and 3) vulnerability testing — analyzing whether the defined security requirements align with the security concerns identified in the threat model, along with stated assumptions and the applicability of vulnerability testing.