What We Heard in Boston: Notes from the 2026 US Medical Device Cybersecurity Conference

Less debate about the rules. More questions about execution and proof.

We spent last week in Boston at TT LifeSciences’ US Medical Device Cybersecurity Conference. Axel ran a workshop on cybersecurity as a business enabler, and Seth presented how manufacturers can measure their process maturity relative to FDA expectations. Across sessions from manufacturers, test labs, auditors and attorneys, one thing stood out: the industry has mostly stopped arguing about what the rules say. The question now is how to implement and execute, and whether you can prove you did the work.

Here’s what kept coming up.

One evidence base, packaged per regulator

FDA, EU MDR, IEC 81001-5-1 and NIST all ask for the same core artifacts: a threat model, a risk file, an SBOM, test evidence and a postmarket plan. Teams that run a separate workstream per regulator duplicate effort and give inconsistent answers. Build it once, then package it for each audience.

CVSS says how bad. Context says whether it matters.

A 9.8 on a disabled, segmented service can matter less than a 6.5 that’s reachable and actively exploited. Speaker after speaker presented the case for layering in exploitability, exposure and clinical impact before deciding what to fix first. It’s the argument we make in our post on CVSS for medical device product risk.

Get security into the safety file without flooding it

The practical advice: every security risk lives in the security risk assessment, but only the ones with a foreseeable path to patient harm also go into a safety risk assessment. Assume a successful exploit happens, give credit only to controls that sufficiently reduce the risk of an attack, and write down what would invalidate your assumptions so postmarket review has a trigger list.

Proof beats promises, with FDA and with hospitals

Reviewers want to trace every risk to its controls and their effectiveness. In the FDA letters we’ve reviewed, cybersecurity went from about 17% of deficiencies to roughly half after 2023, and the devices that cleared answered with evidence, not plans. Seth will walk through those cases, and what the cleared teams did differently, on our webinar.

Customers are the second gate. Hospitals now enforce cybersecurity in purchasing contracts, and value analysis committees can and do say no on security grounds, so MDS2 forms, hardening guides and named owners need to be ready before launch, not after.

And because the device ships once but the obligation doesn’t, postmarket matters just as much: a living SBOM, a proven update path, and a security posture that wouldn’t walk out the door if your best engineer did.

And yes, AI

AI was everywhere, but the most useful take was also the least dramatic: treat it as an extension of the programs you already run. Model and data threats go in the threat model, models and datasets go in the SBOM, model changes go through change control, and a human stays in the loop for critical actions.

Join Seth and Axel on Monday, November 16 at 11:00 AM PT for the full story: the FDA data, the cases, and how to tie every risk score to a decision FDA will accept. Register now →