Penetration Testing
Hands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.
Definition
Penetration testing (pen testing) is hands-on adversarial security testing in which qualified, sufficiently independent testers attempt to exploit a medical device's security controls - network services, web/API interfaces, wireless protocols, physical interfaces (USB, JTAG, UART), companion apps, and back-end cloud - to uncover weaknesses that automated scanners miss. A pen test produces an evidence package: methodology, findings (with reproduction steps), severity ratings, and remediation recommendations.What this means in practice
Pen testing is most valuable when scoped against a current threat model and run before V&V freeze so findings can be designed-out rather than risk-accepted. Mature MedTech teams budget for an annual external pen test plus targeted retests after major changes. Findings flow into CAPA and re-test verification.Examples
- A MedTech manufacturer hired independent security researchers to perform penetration testing on their new infusion pump. The testers successfully exploited a vulnerability in its Wi-Fi communication module, demonstrating how an unauthorized user could remotely alter dosage settings.
- During a pre-market penetration test, ethical hackers discovered that a diagnostic imaging device's web interface was susceptible to SQL injection attacks. This finding allowed the development team to patch the vulnerability before the device was released to the market.
- An annual penetration test of a patient monitoring system uncovered that its companion mobile app stored sensitive patient data in an unencrypted local cache. The team then implemented stronger data at-rest encryption to mitigate this risk.
- •Hiring a generic pen-test firm with no medical-device experience - they'll miss the device-specific attack surface.
- •Scoping the test too narrowly (only the web UI) and missing the wireless, hardware, or backend channels.
- •Treating the pen-test report as a one-time deliverable instead of feeding remediation into CAPA and re-test.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsAAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
Automated security testing - SAST analyzes source code at rest, DAST exercises a running application.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
More in Cybersecurity
· Same categoryA documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.
A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1FDA Cybersecurity Guidance (Sept 2023)Tier 2 VerifiedFDAfda.gov
- 2NIST SP 800-115 Technical Guide to Information Security TestingTier 2 VerifiedNISTcsrc.nist.gov
- 3HSCC - Health Sector Coordinating CouncilTier 4 VerifiedHSCChealthsectorcouncil.org
Inline markers like [1] jump to the matching reference above.