MedTech Terms
    The authoritative reference
    All terms

    Penetration Testing

    Hands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Penetration testing (pen testing) is hands-on adversarial security testing in which qualified, sufficiently independent testers attempt to exploit a medical device's security controls - network services, web/API interfaces, wireless protocols, physical interfaces (USB, JTAG, UART), companion apps, and back-end cloud - to uncover weaknesses that automated scanners miss. A pen test produces an evidence package: methodology, findings (with reproduction steps), severity ratings, and remediation recommendations.
    What the regulation says
    FDA's 2023 guidance explicitly expects penetration testing for cyber-device submissions, performed by personnel with sufficient independence from the development team. The submission should describe the testing scope, qualifications of the testers, methodology (e.g., NIST SP 800-115, OWASP MASTG/WSTG), and how findings were addressed. AAMI TIR57 and IEC 81001-5-1 also reference penetration testing as a lifecycle activity.

    What this means in practice

    Pen testing is most valuable when scoped against a current threat model and run before V&V freeze so findings can be designed-out rather than risk-accepted. Mature MedTech teams budget for an annual external pen test plus targeted retests after major changes. Findings flow into CAPA and re-test verification.
    Common pitfalls
    • •Hiring a generic pen-test firm with no medical-device experience - they'll miss the device-specific attack surface.
    • •Scoping the test too narrowly (only the web UI) and missing the wireless, hardware, or backend channels.
    • •Treating the pen-test report as a one-time deliverable instead of feeding remediation into CAPA and re-test.

    Frequently asked questions

    FDA expects 'sufficient independence' - practically, that means testers who did not author the code under test. External firms or an internal red team that reports outside the product engineering line both qualify.

    Primary references

    3 sources
    Link health: 1 verified 1 bot-blocked 1 needs review· last checked 2026-05-09
    FDA·1NIST·1AAMI·1
    1. 1
      FDA Cybersecurity Guidance (Sept 2023)
      Bot-blocked
      FDAfda.gov
    2. 2
      NIST SP 800-115 Technical Guide to Information Security Testing
      Verified
      NISTcsrc.nist.gov
    3. 3
      AAMI TIR57:2016
      Needs review
      AAMIaami.org

    Inline markers like [1] jump to the matching reference above.