Cleared or Refused: What Gets Medical Devices Through FDA's Cybersecurity Review

Picture three medical device companies sending FDA their applications to go to market. Each has a real cybersecurity program, with policies and procedures, testing and documentation. Six months later, one is cleared to sell. Nine months later, the other two are refused.
The difference wasn't who had the better security program on paper. It was who could prove they had actually used it on the device in front of FDA.
That gap between having a plan and showing proof is now one of the most common reasons devices get delayed or turned away. Here's what's changed, what it costs, and how to stay on the right side of it.

A few quick definitions

• 510(k): the most common FDA application to bring a medical device to market.
• Deficiency letter: FDA's list of problems and questions about an application. The clock stops until you answer.
• Penetration test: a hired team tries to break into the device, the way an attacker would.
• Refused ("not substantially equivalent"): FDA won't clear the device through this route, which usually means a far longer and costlier path as well as more proof and documentation.

The law didn't change much. The enforcement did.

Since 2023, federal law has required device makers to show FDA how their products are protected against cyberattacks. Think of that law as the speed limit. For a while, going a little over was tolerated. Today FDA reviewers are writing tickets much closer to the limit, and how strict they are depends on which reviewer you get.
FDA is also unusual among regulators. Many rely on a company's word or a high-level audit. FDA asks for the results of hands-on testing of the device's software, including penetration tests.

Cybersecurity is now half the conversation

We looked at 50 FDA deficiency and hold letters from 2020 to 2026. Before 2023, cybersecurity made up about one in six of the problems FDA raised (17%). Since then, it's been about half (49%). The average letter went from roughly 4 cybersecurity issues to 7, and recent letters ranged from 1 issue to 20.
In other words, if your device connects to anything, cybersecurity is no longer a side section of your application. It's a main event.

Why this is a business problem, not just a security one

Security costs a device company in four ways: building and staffing the program, running it on every release, fixing what testers and regulators find, and managing the impact of delay. The first three show up in a budget. Delay shows up as revenue that doesn't arrive and the competition that hits the market before you. Nine months to a refusal is nine months of a product not being sold.
And FDA isn't the only gate. Hospitals now include security in their contract requirements and run their own security reviews before they buy. A device that clears FDA but stalls in a hospital's procurement process still isn't earning revenue.

Three devices, one lesson: proof beats promises

We analyzed three recent applications, anonymized, and each reviewed by a different FDA office, from the first submission to the final decision. All three started in roughly the same place. What changed the outcome was what each company did when FDA pushed back.
The cleared device answered FDA's questions with evidence. It redid its penetration test with a named independent tester, re-rated every known weakness one by one, and finished the security information its customers would need.
The two refused devices answered with promises. One had serious problems from its own penetration test marked as "planned" fixes. Another claimed it had no shared passwords built into the device, while its own test found one. And in one case, FDA couldn't tell which version of the software it was even reviewing. Each time, the company was effectively asking FDA to accept a plan instead of proof. FDA said no.
Ratings show up here too. The cleared device re-rated every weakness; one refused device rated outdated, unsupported operating systems as only a medium risk. As we wrote in our post on CVSS, a risk score is only useful when you can show how it turned into a decision.

Underselling yourself costs time too

Even the cleared device lost months. Its first application took a narrow view and listed zero electronic connections, leaving out about half of the security work the company had already done. FDA paused the review, and one short answer turned into three major issues to fix. Once the full picture went in, the device was cleared. The security program wasn't the problem; the filing strategy was.

Five checks before you file

1. Send proof, not promises. "We'll fix it in the next release" isn't a fix.
2. Close serious test findings before you file. If one stays open, show why the remaining risk is acceptable.
3. Make sure every claim in your application matches your own test results, before FDA checks.
4. Show the processes you follow, and evidence that you followed them for this device.
5. Know exactly which software version you're submitting, and show you can detect an attack, not just record activity.

What's next: staying on the market

Getting cleared is the first test. Across regulated industries, security rules tend to tighten in the same order: guidance, then self-reporting, then hard checkpoints, then penalties. FDA is at the checkpoint stage today, and the next step is expected to be closer scrutiny of devices already on the market. FDA warning letters that cite cybersecurity have become more frequent and more specific since 2017, and an update to FDA's postmarket guidance on managing cybersecurity after launch is on its list for fiscal 2027.
Premarket gets you in. Postmarket keeps you there.

A note on the data

These letters came from companies that brought them to a cybersecurity firm, so they likely over-represent cybersecurity trouble. Three cases can't prove a rule but still offer a lesson. Treat this as a pattern worth checking against your own applications.

See it live

On Monday, November 16 at 11:00 AM PT, Seth Carmody and Axel Wirth will walk through these cases, where common risk scores help and where they leave you exposed, and how a single risk register ties every finding to a decision FDA will accept. Register now →