Writing and appearances on medical device cybersecurity
What FDA reviewers expect, what a test has to cover, and what we have said about it in public. Newest first.
FDA's PCCP guidance and cybersecurity – what changed and what was already allowed
The FDA's Predetermined Change Control Plan guidance lets manufacturers ship certain device updates without a new submission. What qualifies, what doesn't, and what the FDA has expected since 2005.
ArticleWith many AIs, all bugs are shallow (Part 1)
Many in cybersecurity wrote obituaries for vulnerability coordination, but I think that's premature. Coordination isn't dead, but the conditions have changed.
ArticleThe random number was 4 – what the eMudhra CA incident means for connected devices
A Certificate Authority generated cryptographic keys from tiny random numbers – one of them was just 4. Browsers and phones are fixed; medical devices, cars, and other IoT devices are likely exposed until updated.
WebinarValidating Medical Device Cybersecurity Through Penetration Testing
MDIC panel on pen testing best practices for FDA submissions. With Justin Post (FDA CDRH), Jessica Wilkerson (Roche, formerly FDA), and Chris Reed (Medtronic).
ArticleWhich FDA cybersecurity guidance applies to my submission?
Four FDA premarket cybersecurity guidances share almost the same name. Which one is current, what each superseded, and how to tell which applies to your submission.
PressQuoted in Wired: Why safety-critical security research matters
Andy Greenberg's Wired story on a hardware implant against Boeing 737 avionics features Beau's perspective: research done in the open and taken seriously by industry makes safety-critical systems safer.
ArticleCISA's Coordinated Vulnerability Disclosure Guidance: A Look at What's New
CISA's new joint guidance on coordinated vulnerability disclosure updates the playbook in welcome ways. What's new, what it leaves out for safety-critical systems, and what medical device makers should draw from.
LinkedInReintroduction: Beau Woods on medical device cybersecurity
After years of quietly building Stratigos Security, Beau shares what the team has been working on and why medical device cybersecurity demands a different kind of testing partner.
ArticleFDA is asking for known vulnerabilities alongside your SBOM
Reviewers are asking for a list of known vulnerabilities with the software component inventory, in machine-readable VEX form. What that means in practice and what to do now.
ArticleWhat the February 2026 FDA premarket update changes
FDA's February 2026 revision is a minor update that aligns the premarket cybersecurity guidance with the QMSR. What FDA expects in a submission is unchanged. Two things to change in your procedures.
ArticleThe 2025 FDA premarket cybersecurity guidance: an evolution, not a revolution
FDA's June 2025 update to the premarket cybersecurity guidance is an evolution, not a revolution. Five expectations and clarifications to fold into your cybersecurity program.
AppearanceStratigos CEO presents at Digital Biomarkers & Digital Measurements Summit
Stratigos Security Founder and CEO, Beau Woods, delivered a presentation and joined a panel discussion at the Digital Biomarkers & Digital Measurements Summit today.
AppearanceStratigos CEO keynotes H-ISAC Medical Device Security Workshop
Stratigos Security Founder and CEO, Beau Woods, was invited to keynote the Health Information Sharing and Analysis Center (H-ISAC) Medical Device Security Workshop, on October 29, 2020.
AppearanceStratigos CEO interviewed for IntoSecurity Podcast
Stratigos Security Founder and CEO, Beau Woods, was interviewed by Dan Raywood of InfoSecurity Magazine on a special Cybersecurity Awareness Month episode of the IntoSecurity Podcast.
AppearanceStratigos CEO quoted in Wall Street Journal on Future of Hacking
Stratigos Security Founder and CEO, Beau Woods, was quoted in a Wall Street Journal story, Hackers Eye their Next Targets, from Schools to Cars.
AppearanceStratigos CEO quoted in Washington Post on Cybersecurity Awareness Month
Stratigos Security Founder and CEO, Beau Woods, was mentioned in a Washington Post story, Americans are as insecure as ever on the 17th annual Cybersecurity Awareness month.
AppearanceStratigos CEO quoted in Vox
Stratigos Security Founder and CEO, Beau Woods, was quoted in a Washington Post story, The US killed Soleimani. What will Iran do next?
AppearanceStratigos CEO Mentioned in Washington Post
Stratigos Security Founder and CEO, Beau Woods, was mentioned in a Washington Post story, Hackers are going after medical devices — and manufacturers are helping them.
AppearanceStratigos CEO quoted in The Verge
Stratigos Security Founder and CEO, Beau Woods, was quoted in a Verge story, Health Care's Huge Cybersecurity Problem.
AppearanceStratigos CEO joins Council on Foreign Relations panel
Stratigos Security Founder and CEO, Beau Woods, joined a panel discussion at the Council on Foreign Relations, titled Hacking and the Internet of Things.
AppearanceStratigos CEO featured in Council on Foreign Relations podcast
Stratigos Security Founder and CEO, Beau Woods, sat down for a podcast with Micah Zenko, from the Council on Foreign Relations.