One platform, priced per product line

One product line on the MSI platform for a year, with unlimited users. That covers the premarket modules (threat modeling, risk assessment, requirements, submission audit, deficiency response), regulatory intelligence, the postmarket side (Helm for SBOM and vulnerability management, continuous monitoring, MedISAO membership), and 15 hours a year with our regulatory experts. Annual term, invoiced annually.

No. Most customers add a penetration test because their submission needs one, which brings a typical first-year contract to somewhere between $50,000 and $60,000. But if you already have a pen test partner, or don't need one, the platform is $35,000 on its own.

Because compliance work scales with devices, not headcount. A regulatory lead and three engineers working the same submission shouldn't cost more than one person doing it alone. Add as many users as you need.

It's the one add-on, scoped to the device. A single-purpose embedded device and a connected imaging platform with a web interface are different tests, and pricing them the same would mean overcharging one and under-testing the other. We contract and manage the test through vetted partners, and you get the scope and the price in writing before anything is signed.

Because the honest answer depends on your device. We'd rather scope it properly in a 30-minute call than publish a number that turns out to be wrong for you in either direction.

For most teams working a single submission, yes. That's why it's the standard allocation rather than something you have to negotiate. Teams responding to a deficiency letter usually want more up front, and additional hours are available. The free readiness check will tell both of us roughly where you'll land before anyone commits.

Some customers keep their existing scanner and use MSI for everything around it: the submission audit, threat modeling, the risk assessment, and the deficiency response. Helm is included either way, and most teams consolidate once they see the SBOM feeding the same submission the rest of their documentation lives in.

It's live and customers use it, but the drafts it produces need expert review before they go in a submission. We'd rather say that here than have you find out later.

FDA is what the platform covers today. EU MDR, Health Canada, PMDA, and NMPA content are in active development on a shared requirements layer. Ask us where a specific market stands.

The subscription continues and the work shifts rather than stops. New vulnerabilities land in your components, your SBOM has to stay current, monitoring and disclosure obligations run for as long as the device is on the market, and EU MDR expects an annual cadence. The same threat models and risk assessments you built for the submission become the things you maintain, in the place you already built them.

Yes, and it's a common starting point. Run a legacy device through the platform and you get an honest read on where its documentation and vulnerability posture actually stand, which is usually the input to deciding whether to update it, keep supporting it, or plan its retirement.