MedTech Terms
    The authoritative reference
    All terms

    Penetration Testing

    Hands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Penetration testing (pen testing) is hands-on adversarial security testing in which qualified, sufficiently independent testers attempt to exploit a medical device's security controls - network services, web/API interfaces, wireless protocols, physical interfaces (USB, JTAG, UART), companion apps, and back-end cloud - to uncover weaknesses that automated scanners miss. A pen test produces an evidence package: methodology, findings (with reproduction steps), severity ratings, and remediation recommendations.
    What the regulation says
    FDA's 2023 guidance explicitly expects penetration testing for cyber-device submissions, performed by personnel with sufficient independence from the development team. The submission should describe the testing scope, qualifications of the testers, methodology (e.g., NIST SP 800-115, OWASP MASTG/WSTG), and how findings were addressed. AAMI TIR57 and IEC 81001-5-1 also reference penetration testing as a lifecycle activity.

    What this means in practice

    Pen testing is most valuable when scoped against a current threat model and run before V&V freeze so findings can be designed-out rather than risk-accepted. Mature MedTech teams budget for an annual external pen test plus targeted retests after major changes. Findings flow into CAPA and re-test verification.
    Common pitfalls
    • •Hiring a generic pen-test firm with no medical-device experience - they'll miss the device-specific attack surface.
    • •Scoping the test too narrowly (only the web UI) and missing the wireless, hardware, or backend channels.
    • •Treating the pen-test report as a one-time deliverable instead of feeding remediation into CAPA and re-test.

    Frequently asked questions

    FDA expects 'sufficient independence' - practically, that means testers who did not author the code under test. External firms or an internal red team that reports outside the product engineering line both qualify.
    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Mentioned in recent activity

    1 entry

    Latest in MedTech

    View all

    Recent regulatory actions, publications, and trials matched to this term. Updated daily.

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-06-20
    FDA·1NIST·1HSCC·1
    1. 1
      FDA Cybersecurity Guidance (Sept 2023)
      Verified
      FDAfda.gov
    2. 2
      NIST SP 800-115 Technical Guide to Information Security Testing
      Verified
      NISTcsrc.nist.gov
    3. 3
      HSCC - Health Sector Coordinating Council
      Verified
      HSCChealthsectorcouncil.org

    Inline markers like [1] jump to the matching reference above.