https://bato.com/insights/ Practical writing on security and engineering in regulated industries. en-us Tue, 01 Sep 2026 12:00:00 GMT https://bato.com/insights/is-our-product-a-cyber-device/ https://bato.com/insights/is-our-product-a-cyber-device/ Tue, 01 Sep 2026 12:00:00 GMT Section 524B's cyber device test has three prongs and all must be met. The connectivity prong is read far more broadly than most self-assessments assume. https://bato.com/insights/fda-security-architecture-views/ https://bato.com/insights/fda-security-architecture-views/ Tue, 01 Sep 2026 12:00:00 GMT FDA recommends four security architecture views. Everyone lists the names. Here is what belongs in each diagram and which question each one has to answer. https://bato.com/insights/threat-modeling-medical-device-fda/ https://bato.com/insights/threat-modeling-medical-device-fda/ Tue, 01 Sep 2026 12:00:00 GMT FDA expects a structured threat model that the rest of the submission derives from. Start with trust boundaries, and rank the results by patient harm. https://bato.com/insights/security-risk-vs-safety-risk-medical-device/ https://bato.com/insights/security-risk-vs-safety-risk-medical-device/ Tue, 01 Sep 2026 12:00:00 GMT FDA treats security risk management as a process distinct from safety risk management. They score differently, and they converge at exactly one place. https://bato.com/insights/security-requirements-testable-medical-device/ https://bato.com/insights/security-requirements-testable-medical-device/ Tue, 01 Sep 2026 12:00:00 GMT FDA expects security controls written as uniquely identified, testable requirements traced to threats and tests. Most submissions contain principles instead. https://bato.com/insights/security-patch-new-510k-required/ https://bato.com/insights/security-patch-new-510k-required/ Fri, 21 Aug 2026 12:00:00 GMT A change made solely to strengthen cybersecurity rarely needs a new 510(k). The word doing the work is solely, and most real patches are not solely anything. https://bato.com/insights/fda-cybersecurity-guidance-2026-what-changed/ https://bato.com/insights/fda-cybersecurity-guidance-2026-what-changed/ Fri, 21 Aug 2026 12:00:00 GMT FDA reissued its premarket cybersecurity guidance to align with the QMSR. The requirements did not change. Your citations did, and so did where security lives. https://bato.com/insights/hard-coded-credential-medical-device-advisory-teardown/ https://bato.com/insights/hard-coded-credential-medical-device-advisory-teardown/ Fri, 21 Aug 2026 12:00:00 GMT A CISA advisory describes one hard-coded credential shared across every unit of a connected therapy device. Five ordinary controls would each have caught it. https://bato.com/insights/coordinated-vulnerability-disclosure-program-setup/ https://bato.com/insights/coordinated-vulnerability-disclosure-program-setup/ Fri, 21 Aug 2026 12:00:00 GMT Section 524B requires a coordinated disclosure process. The mechanics take a week. What makes it real is naming who owns the hop from inbox to the fix. https://bato.com/insights/mdic-penetration-testing-framework-medical-devices/ https://bato.com/insights/mdic-penetration-testing-framework-medical-devices/ Fri, 21 Aug 2026 12:00:00 GMT MDIC published a consensus penetration testing framework for medical devices. Four of its five stages sit outside the test, and that is where programs fail. https://bato.com/insights/cloud-cost-audit-where-the-money-goes/ https://bato.com/insights/cloud-cost-audit-where-the-money-goes/ Thu, 20 Aug 2026 12:00:00 GMT Cloud spend rises because nobody owns the bill. Where the money actually goes: dead resources, launch-day sizing nobody revisited, and outgrown architecture. https://bato.com/insights/deploying-ai-in-regulated-environments/ https://bato.com/insights/deploying-ai-in-regulated-environments/ Thu, 20 Aug 2026 12:00:00 GMT The compliance risk is not the AI pilot that stalls in review. It is the AI everyone is already using, on regulated data, with no policy governing any of it. https://bato.com/insights/rescuing-a-stalled-platform-migration/ https://bato.com/insights/rescuing-a-stalled-platform-migration/ Thu, 20 Aug 2026 12:00:00 GMT A stalled EMR, CRM, or core platform migration is almost always a data problem wearing a schedule problem's clothes. What to do first when one is in trouble. https://bato.com/insights/you-dont-need-ai-you-just-need-i/ https://bato.com/insights/you-dont-need-ai-you-just-need-i/ Thu, 20 Aug 2026 12:00:00 GMT A lot of what gets specified as an AI feature is a well-understood problem with a direct solution that is faster, cheaper, and easier to defend to a regulator. https://bato.com/insights/enterprise-security-questionnaires/ https://bato.com/insights/enterprise-security-questionnaires/ Thu, 20 Aug 2026 12:00:00 GMT A security questionnaire is a revenue problem. The answers exist somewhere in your environment, and the deal stalls because nobody there can produce them. https://bato.com/insights/sbom-lists-the-framework-not-the-packages/ https://bato.com/insights/sbom-lists-the-framework-not-the-packages/ Thu, 20 Aug 2026 12:00:00 GMT Most first-draft SBOMs name the framework and the major libraries and stop. The vulnerabilities are in everything those pulled in, which is where the work is. https://bato.com/insights/responding-to-fda-cybersecurity-deficiency-letter/ https://bato.com/insights/responding-to-fda-cybersecurity-deficiency-letter/ Wed, 19 Aug 2026 12:00:00 GMT What an FDA cybersecurity deficiency letter asks for, why the 180-day clock is shorter than it looks, and what changes when your product is software-only. https://bato.com/insights/the-technology-stage-companies-skip/ https://bato.com/insights/the-technology-stage-companies-skip/ Wed, 19 Aug 2026 12:00:00 GMT Growing companies build their technology function in the same order and skip the same step: a named senior technical owner, accountable for the whole estate. https://bato.com/insights/penetration-test-report-what-to-do-next/ https://bato.com/insights/penetration-test-report-what-to-do-next/ Wed, 19 Aug 2026 12:00:00 GMT A practical first pass at a penetration test report: how to triage findings, how to argue with a severity rating, and why a quarter of them may not be real. https://bato.com/insights/your-msp-is-not-your-security-program/ https://bato.com/insights/your-msp-is-not-your-security-program/ Wed, 19 Aug 2026 12:00:00 GMT An MSP closing tickets is not a security program. The gap shows up as tools purchased but never deployed, and logs too short to investigate an incident. https://bato.com/insights/fda-524b-premarket-cybersecurity-requirements/ https://bato.com/insights/fda-524b-premarket-cybersecurity-requirements/ Tue, 18 Aug 2026 12:00:00 GMT What Section 524B requires in a premarket submission for cyber devices, why software-only products are covered, and where these submissions fall short. https://bato.com/insights/ai-coding-assistants-regulated-codebase/ https://bato.com/insights/ai-coding-assistants-regulated-codebase/ Tue, 18 Aug 2026 12:00:00 GMT AI coding tools are usable under a quality system, but only if you can answer who reviewed the change, what it was verified against, and where it came from. https://bato.com/insights/who-closes-penetration-test-findings/ https://bato.com/insights/who-closes-penetration-test-findings/ Tue, 18 Aug 2026 12:00:00 GMT A penetration test report is a list of problems, not a fix. Why a testing firm cannot close its own findings, and what that actually leaves you holding.