--- title: "Threat Modeling, Definition | MedTech Terms" description: "A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "description": "Threat modeling is a structured engineering activity in which a cross-functional team analyzes a device's architecture, data flows, trust boundaries, and assets to identify how an attacker could compromise confidentiality, integrity, availability, or safety - and then designs or selects controls to mitigate the identified threats. The most widely used framework in MedTech is STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) developed by Microsoft, often combined with attack-tree or kill-chain analysis. AAMI TIR57:2016 \"Principles for Medical Device Security - Risk Management\" provides MedTech-specific guidance.", "url": "https://medtechterms.com/terms/threat-modeling", "termCode": "threat-modeling", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/threat-modeling#article", "headline": "Threat Modeling", "description": "A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.", "url": "https://medtechterms.com/terms/threat-modeling", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/threat-modeling" }, "about": { "@id": "https://medtechterms.com/terms/threat-modeling#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Threat Modeling, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "FDA Cybersecurity in Medical Devices Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "MITRE Playbook for Threat Modeling Medical Devices", "url": "https://www.mitre.org/news-insights/publication/playbook-threat-modeling-medical-devices", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "FDA - Cybersecurity for Medical Devices", "url": "https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity", "publisher": { "@type": "Organization", "name": "FDA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/stride#term", "name": "STRIDE Threat Model", "alternateName": "STRIDE", "url": "https://medtechterms.com/terms/stride" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/aami-tir57#term", "name": "AAMI TIR57", "url": "https://medtechterms.com/terms/aami-tir57" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Threat Modeling", "item": "https://medtechterms.com/terms/threat-modeling" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/threat-modeling#faq", "mainEntity": [ { "@type": "Question", "name": "STRIDE, PASTA, or attack trees - which method should we use?", "acceptedAnswer": { "@type": "Answer", "text": "STRIDE is the de-facto MedTech standard because the 2023 FDA guidance and AAMI TIR57 both reference it. PASTA and attack trees are complementary techniques you can layer on for high-risk subsystems. Pick one primary method and apply it consistently." } }, { "@type": "Question", "name": "Who should be in the threat-modeling session?", "acceptedAnswer": { "@type": "Answer", "text": "At minimum: a security lead, the system architect, a product/clinical SME who understands intended use and clinical harm, and a software engineer familiar with the codebase. For connected devices, also include someone who understands the hospital network environment." } }, { "@type": "Question", "name": "How granular should mitigations be?", "acceptedAnswer": { "@type": "Answer", "text": "Specific enough that V&V can verify them. 'Encrypt data in transit' is too generic. 'TLS 1.3 with mutual authentication and certificate pinning between the device and the cloud gateway' is verifiable." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Threat Modeling [All terms](/terms) Cybersecurity [AI / ML in Devices](/ecosystems/ai-ml)[Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Threat modeling is a structured engineering activity in which a cross-functional team analyzes a device's architecture, data flows, trust boundaries, and assets to identify how an attacker could compromise confidentiality, integrity, availability, or safety - and then designs or selects controls to mitigate the identified threats. The most widely used framework in MedTech is [STRIDE](/terms/stride) (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) developed by Microsoft, often combined with attack-tree or kill-chain analysis. [AAMI TIR57](/terms/aami-tir57):2016 "Principles for Medical Device Security - Risk Management" provides MedTech-specific guidance. What the regulation says FDA's 2023 guidance treats threat modeling as a foundational expectation: every cyber-device submission must include a threat model that covers the global system, the multi-patient harm view, the updateability/ [patchability](/terms/patchability) view, and the security use case view. The threat model must be traceable from the device's [intended use](/terms/intended-use) through identified threats to specific mitigations and to [ISO 14971](/terms/iso-14971) safety risk evaluation. Boilerplate threat models - [STRIDE](/terms/stride) tables disconnected from the actual device architecture - are flagged as deficiencies. ## What this means in practice Threat modeling is most effective when done early (during architecture) and revisited at every major design change. Mature MedTech teams keep the threat model as a living artifact in the [Design History File](/terms/design-history-file) and re-walk it as part of design reviews. [AAMI TIR57](/terms/aami-tir57) and the MITRE Playbook for Threat Modeling Medical Devices both provide templates and examples MedTech teams can adapt. ## Use cases 1 scenario 1 ### Connected cardiac monitor design review Security architect Engineering runs a [STRIDE](/terms/stride)\-based threat model on the device, gateway, and cloud. They identify spoofing risks on the BLE pairing flow and tampering risks on firmware updates, then add mutual authentication and signed updates as controls. Outcome The threat model and resulting controls are referenced in the [524B](/terms/section-524b) cybersecurity package and accepted by FDA without a deficiency letter. Common pitfalls - • Producing a one-shot threat model at submission rather than maintaining it through the lifecycle. - • Listing generic threats (malware, ransomware) without mapping them to specific device interfaces and trust boundaries. - • Skipping the four views FDA specifically calls out - global system, multi-patient harm, updateability/patchability, security use case. - • Failing to feed threat-model outputs into the ISO 14971 risk management file. ## Frequently asked questions STRIDE, PASTA, or attack trees - which method should we use? [STRIDE](/terms/stride) is the de-facto MedTech standard because the 2023 FDA guidance and [AAMI TIR57](/terms/aami-tir57) both reference it. PASTA and attack trees are complementary techniques you can layer on for high-risk subsystems. Pick one primary method and apply it consistently. Who should be in the threat-modeling session? How granular should mitigations be? ## Cross-references ### Uses Concepts or artefacts this term builds on. - [ STRIDE Threat Model(STRIDE) ](/terms/stride) ### Used by Things that build on this term. - [ Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity STRIDE Threat Model(STRIDE) A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. ](/terms/stride)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. Adjacent lesson ](/terms/sbom?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss?from=fda-cybersecurity-101)[ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx?from=fda-cybersecurity-101) ### Software Team Onboarding · From this learning path [ Software & AI Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. Adjacent lesson ](/terms/ai-ml-pccp?from=software-team-onboarding)[ Software & AI Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. ](/terms/cds?from=software-team-onboarding)[ Standards IEC 62304 Lifecycle requirements for medical device software. ](/terms/iec-62304?from=software-team-onboarding)[ Software & AI Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. ](/terms/samd?from=software-team-onboarding) Cited by Where this term appears across MedTech Terms. Learning paths (2) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 4 of 11 - [Software Team Onboarding](/paths/software-team-onboarding)Lesson 11 of 12 Ecosystems (2) - [AI / ML in Devices](/ecosystems/ai-ml) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 FDA· 2 MITRE· 1 1. [1 FDA Cybersecurity in Medical Devices Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 2. [2 MITRE Playbook for Threat Modeling Medical Devices Verified MITRE · mitre.org ](https://www.mitre.org/news-insights/publication/playbook-threat-modeling-medical-devices) 3. [3 FDA - Cybersecurity for Medical Devices Verified FDA · fda.gov ](https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Need a STRIDE-aligned threat model? Blue Goat Cyber runs threat-modeling workshops tailored to connected medical devices and the FDA's premarket expectations. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Use cases 1 Updated 5/5/2026 [Compare with another term](/compare?a=threat-modeling) Learn in 60 seconds Card Lesson Quiz A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. - · Threat modeling is most effective when done early (during architecture) and revisited at every major design change. - · Mature MedTech teams keep the threat model as a living artifact in the Design History File and re-walk it as part of design reviews. - · AAMI TIR57 and the MITRE Playbook for Threat Modeling Medical Devices both provide templates and examples MedTech teams can adapt. Remember this Watch out: Producing a one-shot threat model at submission rather than maintaining it through the lifecycle. Related terms - [STRIDE Threat Model(STRIDE) ](/terms/stride) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [AAMI TIR57 ](/terms/aami-tir57) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) You may also need Auto-suggested from Cybersecurity and shared keywords. - [LINDDUN ](/terms/linddun) - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [SOC 2 ](/terms/soc-2) - [ISO/IEC 27001(ISO 27001) ](/terms/iso-27001) - [Medjacking ](/terms/medjacking) - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)