Cybersecurity
Penetration Testing
In one line
Hands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.
Definition
Penetration testing (pen testing) is hands-on adversarial security testing in which qualified, sufficiently independent testers attempt to exploit a medical device's security controls - network services, web/API interfaces, wireless protocols, physical interfaces (USB, JTAG, UART), companion apps, and back-end cloud - to uncover weaknesses that automated scanners miss. A pen test produces an evidence package: methodology, findings (with reproduction steps), severity ratings, and remediation recommendations.
Why it matters
Pen testing is most valuable when scoped against a current threat model and run before V&V freeze so findings can be designed-out rather than risk-accepted. Mature MedTech teams budget for an annual external pen test plus targeted retests after major changes. Findings flow into CAPA and re-test verification.
Common pitfalls
- •Hiring a generic pen-test firm with no medical-device experience - they'll miss the device-specific attack surface.
- •Scoping the test too narrowly (only the web UI) and missing the wireless, hardware, or backend channels.
- •Treating the pen-test report as a one-time deliverable instead of feeding remediation into CAPA and re-test.
Sources