What the Medical Device Industry Can Learn From Past Cybersecurity Vulnerability Disclosures 2025

Since the FDA’s 2016 Postmarket Cybersecurity Guidance, the rate of ICS-CERT medical device advisories has grown 386%, signaling stronger transparency but also persistent cybersecurity weaknesses.

This 2025 update expands Medcrypt’s decade-long analysis of 2013–2024 ICS-CERT medical device advisories, revealing that while industry maturity has improved, vulnerability trends remain remarkably consistent.

Key findings:

• 59.8% of all vulnerabilities still stem from user authentication and code defects.
• Patch references decreased by 22% in 2024, despite new FDA Section 524B enforcement.
• Only 27 of the top 40 manufacturers maintain public vulnerability disclosure programs.
• Nearly half of all vulnerabilities (200/433) originated from just four vendors (Baxter, BD, Medtronic, Philips).

These data reveal that cybersecurity progress has plateaued — and that proactive risk management, not reactive disclosure, must define the next era of medical device security.

Even after eight years of formal postmarket expectations, many manufacturers continue to treat vulnerability management as reactive.

The FDA’s Section 524B now mandates timely updates and patching, but patch reference rates fell sharply in 2024.

This suggests that while manufacturers are more transparent, they remain resource-limited, compliance-driven, and dependent on legacy processes.

For regulators, manufacturers, and healthcare delivery organizations alike, these findings underscore an urgent need for:

• Proactive, lifecycle-integrated security design rather than patch-based defense.
• Collaborative vulnerability disclosure processes across vendors, researchers, and CISA.
• Evidence-based security decisions rooted in longitudinal vulnerability data.