Medical Device Post-Market Cybersecurity Services
End-to-end post-market cybersecurity execution — SBOM monitoring, vulnerability triage, risk assessment, security testing, and coordinated vulnerability disclosure program management — carried out on your behalf, against the commitments your device's cybersecurity management plan already makes.
A managed program, run against your plan
SBOM Monitoring
Continuous monitoring of your device's software bill of materials against newly disclosed vulnerabilities across NVD, OSV, and vendor advisories — so new CVEs affecting third-party and open-source components are caught as they're published, not at the next audit.
Vulnerability Triage
Every new vulnerability affecting your SBOM is triaged against your device's actual architecture and deployment context to determine applicability, cutting through advisory noise before it ever reaches your engineering team.
Risk Assessment
Applicable vulnerabilities are scored and assessed against your device's cybersecurity risk management process, integrated with your broader safety risk management under ISO 14971, to determine severity and required response timeline.
Security Testing
Confirmatory testing and exploitability validation on candidate vulnerabilities, verifying whether a theoretical finding is a reachable, real-world risk on your device before remediation resources are committed.
Coordinated Vulnerability Disclosure Management
Aktriva runs your CVD program end-to-end — researcher intake, communication, timeline coordination, and disclosure — modeled on ISO/IEC 29147 and ISO/IEC 30111.
Reporting & Regulatory Documentation
Findings, decisions, and remediation status are logged and reported in a form that satisfies FDA post-market surveillance and EU MDR vigilance obligations, matching the commitments your cybersecurity management plan makes.
From new CVE to closed loop
Every vulnerability that could touch your device moves through the same five stages, with your engineering and quality teams looped in only where a decision is actually needed.
Detect
SBOM is continuously matched against newly published vulnerabilities as they're disclosed.
Triage
Each match is evaluated against your device's actual context to determine whether it applies.
Assess
Applicable findings are risk-scored per your cybersecurity risk management process.
Validate
Security testing confirms exploitability before remediation effort is committed.
Disclose & Report
Outcomes are documented and, where warranted, coordinated through your CVD program.
Your cybersecurity management plan, executed — not just written
Most manufacturers have a medical device cybersecurity management plan on file describing how SBOM monitoring, vulnerability triage, and coordinated disclosure will be handled post-market. Keeping that plan actually running week over week is a different job than writing it.
Aktriva acts as the execution arm of your plan — monitoring, triaging, assessing, testing, and managing disclosure as your device's activity, under your policies, so the plan your organization committed to regulators is the plan that's actually being followed.
Also covers your CVD program
- Public disclosure policy and intake channel management
- Direct communication with external security researchers
- Coordinated timelines between researcher, manufacturer, and regulator
- Advisory drafting and publication when a fix ships
Have a plan that isn't being run yet?
Tell us about your device and current post-market process — we'll show you what a managed program looks like.