MedTech Terms
    The authoritative reference
    All terms

    OWASP IoT and Embedded Application Security

    OWASP project resources for securing IoT, embedded, and connected medical devices.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    The OWASP IoT Project (and the related OWASP Embedded Application Security Project and OWASP IoT Top 10) provides community-curated guidance, threat catalogs, and testing methodologies for connected and embedded devices - including connected medical devices. The IoT Top 10 enumerates the most prevalent IoT security weaknesses (weak/guessable passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, etc.).
    What the regulation says
    OWASP resources are not regulatory but are widely cited across MedTech security practice. FDA, IMDRF, and the HSCC reference OWASP testing methodologies and weakness taxonomies. MedTech penetration testing and SAST/DAST tools are routinely benchmarked against OWASP test cases.

    What this means in practice

    OWASP IoT Top 10 is a useful prioritization aid for product security backlogs. The OWASP MASTG (Mobile Application Security Testing Guide) covers companion mobile apps that often ship with connected medical devices; the OWASP Application Security Verification Standard (ASVS) provides a tiered set of testable requirements.
    Common pitfalls
    • •Treating the OWASP IoT Top 10 as the entirety of the threat model rather than a baseline checklist.
    • •Skipping OWASP MASTG when the device ships with a companion mobile app.

    Frequently asked questions

    OWASP is an open community that produces guidance, methodologies, and tooling. ASVS and MASVS are the closest to formal verification standards; the IoT Top 10 is a prioritization list.

    Primary references

    3 sources
    Link health: 2 verified 1 needs review· last checked 2026-05-09
    1. 1
      OWASP IoT Project
      Verified
      OWASPowasp.org
    2. 2
      OWASP IoT Top 10
      Needs review
      OWASPowasp.org
    3. 3
      OWASP MASTG
      Verified
      OWASPmas.owasp.org

    Inline markers like [1] jump to the matching reference above.