Introduction

Medical Device Threat Modelling: What FDA Cybersecurity Guidance Requires That Most Manufacturers Are Not Currently Providing

Cybersecurity expectations for medical devices have undergone a major transformation in recent years. What was previously considered a recommended best practice has now become a formal regulatory expectation. The U.S. Food and Drug Administration (FDA) has significantly strengthened cybersecurity guidance for medical devices and Software as a Medical Device (SaMD), particularly within pre-market submission requirements. At the centre of this shift is a clear expectation that manufacturers must demonstrate cybersecurity by design rather than relying on retrospective security measures after deployment.

This evolution represents far more than a simple regulatory update. It reflects the growing recognition that traditional approaches to medical device security are no longer sufficient in increasingly connected healthcare environments. Historically, manufacturers focused primarily on validation-based security approaches, relying on vulnerability management, penetration testing, and patching strategies to demonstrate protection against known threats. While these activities remain important, regulators now expect organisations to prove that security decisions were systematically analysed and integrated throughout the design phase itself.

The regulatory shift introduces several key expectations:

• Cybersecurity must be embedded into device design
• Security decisions must be traceable and justified
• Threats must be analysed systematically during development
• Risk analysis must align with real-world operating environments
• Security controls must demonstrate architectural reasoning

FDA reviewers are no longer asking only whether a device is secure at a specific point in time. Instead, they want documented evidence explaining how security decisions were made, why particular controls were selected, and how risks were systematically identified and mitigated. This transition represents a shift from security validation to security justification, which is precisely where many manufacturers are currently struggling.

The Analytical Gap in Most Pre-Market Submissions

The problem observed in many medical device pre-market submissions is not simply a lack of documentation but a lack of analytical depth. Manufacturers frequently provide architecture diagrams, generic threat lists, and summaries of implemented security controls. However, these materials often fail to demonstrate that security decisions were derived from a structured understanding of device-specific risks.

Regulators expect organisations to explain:

• How threats were identified
• Why specific risks are relevant to the device
• How architectural decisions mitigate those threats
• How security controls map directly to identified risks
• How security considerations align with clinical environments

Generic templates and superficial threat lists are increasingly insufficient because they do not reflect rigorous analysis. In contrast, organisations that conduct genuine threat modelling naturally produce documentation aligned with regulatory expectations because their outputs are derived from structured engineering analysis rather than compliance-driven reporting.

The underlying issue is tied to the historical design philosophy of medical devices. These systems are often built for long operational lifecycles spanning many years or decades. They are resource-constrained environments prioritising safety, reliability, and performance over computational overhead. Security practices traditionally focused on post-market monitoring and reactive measures rather than architectural security integration.

Why Traditional Medical Device Security Is No Longer Enough

Modern medical devices have become highly interconnected systems integrated with hospital networks, cloud services, remote interfaces, and continuous data exchange platforms. This connectivity dramatically expands the attack surface and introduces entirely new categories of cyber risk.

At the same time, the threat landscape has evolved significantly. Medical devices are no longer low-priority targets. They are now actively targeted by:

• Financially motivated ransomware operators
• Nation-state threat actors
• Security researchers identifying vulnerabilities
• Insider threats within healthcare environments

This convergence of connectivity and advanced adversarial capability means that reactive security approaches alone are no longer sufficient. Security can no longer function as an afterthought added after development. Instead, it must be embedded directly into system architecture from the beginning, which is exactly what structured threat modelling enables.

What FDA Cybersecurity Guidance Actually Requires

Although the FDA does not mandate a single threat modelling methodology, its expectations are clear in principle. Regulators expect manufacturers to systematically identify threats based on the specific architecture of the device, the environments where it operates, and the adversaries it may encounter.

The analysis must consider:

• Device functionality and operational workflows
• Clinical use cases and patient impact
• Trust boundaries across systems and integrations
• Threat actor capabilities and attack scenarios
• Security implications across the entire device lifecycle

This lifecycle perspective extends beyond development into deployment, operation, maintenance, updates, and eventual decommissioning. Manufacturers are effectively required to answer a core question: how could this device realistically be attacked, and what measures have been implemented to prevent or mitigate those attacks?

This expectation fundamentally changes how organisations must approach cybersecurity documentation. Regulators are looking for evidence of architectural reasoning and adversarial analysis rather than isolated security controls or testing results.

The Depth Required in Effective Threat Modelling

Threat models capable of satisfying FDA expectations operate at a far deeper level than traditional documentation exercises. They involve decomposing the device architecture into individual components and analysing each systematically.

Critical areas requiring detailed analysis include:

• Firmware integrity and secure boot mechanisms
• Embedded software and update validation processes
• Wired, wireless, Bluetooth, and API communication interfaces
• Data storage, confidentiality, and integrity protections
• External integrations with hospital systems and cloud services

Firmware and embedded software represent critical attack surfaces. Threat modelling must examine risks involving unauthorised modification, firmware tampering, insecure updates, and rollback attacks.

Communication interfaces introduce multiple trust boundaries where risks such as unauthorised access, protocol weaknesses, and man-in-the-middle attacks must be evaluated carefully. Similarly, update mechanisms require analysis to ensure authenticity, integrity, and resistance to downgrade attacks.

External integrations create additional trust assumptions that must be explicitly analysed rather than implicitly trusted. As devices become more integrated with cloud services and remote monitoring platforms, these trust boundaries become increasingly important.

The Importance of Adversary-Centric Threat Analysis

An effective medical device threat model must include realistic adversary analysis. Without this perspective, threat analysis remains theoretical and disconnected from actual attack conditions.

Relevant adversary profiles include:

• Organised cybercriminal groups
• Advanced persistent threats (APTs)
• Insider actors such as clinicians or technicians
• Security researchers and vulnerability analysts

Each adversary type possesses different motivations, access levels, and capabilities. Threat modelling must account for these differences to produce meaningful security insights.

Frameworks such as STRIDE play a major role in enabling systematic threat identification. By categorising threats into spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, organisations can ensure broader coverage of potential attack scenarios.

However, identifying threats alone is not sufficient. One of the key regulatory expectations is traceability. Regulators want clear evidence linking:

• Identified threats
• Security requirements
• Implemented controls
• Mitigation strategies

This traceability demonstrates that security decisions were based on structured analysis rather than arbitrary implementation choices. Without this linkage, even detailed documentation may appear superficial.

Why Many Manufacturers Still Fall Short

Despite increasing regulatory clarity, many manufacturers still struggle to produce threat models that satisfy FDA expectations. One major reason is that threat modelling is often treated as a documentation requirement rather than an engineering discipline.

Common organisational challenges include:

• Limited visibility into complex device ecosystems
• Lack of specialised security engineering expertise
• Misalignment between development and security processes
• Over-reliance on testing and validation activities
• Superficial use of generic threat templates

Many organisations continue to prioritise penetration testing and vulnerability scanning while overlooking architectural security analysis. Although testing remains important, it cannot replace systematic threat modelling that examines how adversaries may exploit trust boundaries and system design assumptions.

Addressing these issues requires a methodology-driven approach that integrates threat modelling directly into device design and development lifecycles rather than applying security analysis retrospectively.

How Codec Networks Helps in This Area

Codec Networks supports medical device and SaMD manufacturers by delivering structured, adversary-focused threat modelling tailored to highly connected healthcare environments. Their methodology helps organisations identify architectural risks, analyse trust boundaries, and align cybersecurity practices directly with evolving FDA expectations.

By applying globally recognised frameworks and producing evidence-based, traceable security outputs, Codec Networks enables manufacturers to move beyond compliance-driven documentation and implement security as a core engineering discipline. This strengthens regulatory readiness while improving long-term resilience and patient safety.

Key Capabilities

1. Structured Medical Device Threat Modelling

• Decomposes device architectures systematically
• Identifies critical trust boundaries and attack surfaces
• Maps security risks across embedded and connected systems

2. Adversary-Focused Security Analysis

• Applies real-world attacker methodologies
• Evaluates risks from ransomware groups, insiders, and APTs
• Aligns threat analysis with realistic attack scenarios

3. Regulatory Alignment and Traceability

• Produces evidence-based security documentation
• Maps threats directly to controls and requirements
• Supports FDA pre-market submission expectations

4. Embedded and Communication Security Assessment

• Reviews firmware integrity and secure boot mechanisms
• Analyses wired, wireless, Bluetooth, and API interfaces
• Identifies risks in update and communication processes

5. Engineering-Ready Security Requirements

• Generates actionable remediation guidance
• Delivers prioritised and implementation-ready outputs
• Integrates security requirements into development workflows

6. Secure-by-Design Healthcare Systems

• Embeds cybersecurity into architectural decisions
• Reduces long-term remediation complexity and cost
• Strengthens resilience across connected healthcare ecosystems

Conclusion

Medical device cybersecurity regulation is undergoing a major transition toward security by design, where organisations must demonstrate that cybersecurity has been systematically analysed, architecturally integrated, and clearly documented throughout the device lifecycle. FDA expectations now extend far beyond vulnerability management and penetration testing, requiring manufacturers to show how threats were identified, how security decisions were justified, and how risks were mitigated through structured analysis. Organisations that embrace threat modelling as a core engineering discipline will naturally align with these expectations because security becomes embedded into architectural decision-making rather than treated as a post-development activity.

In contrast, organisations relying on superficial documentation and reactive security measures will continue to face increasing challenges in both regulatory approval and operational resilience. As medical devices become more connected, integrated, and critical to patient care, rigorous and adversary-focused threat modelling is no longer optional—it is essential for building secure, resilient, and trustworthy healthcare technologies.