--- title: "Five Seconds On Elbrus And The FDA Submission" description: "Learn how a near-fatal climbing accident on Mt. Elbrus taught critical lessons about inattention, directly applicable to avoiding costly mistakes in FDA…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Five Seconds On Elbrus And The FDA Submission | Christian Espinosa", "description": "Learn how a near-fatal climbing accident on Mt. Elbrus taught critical lessons about inattention, directly applicable to avoiding costly mistakes in FDA…", "image": "https://christianespinosa.com/__l5e/assets-v1/d01cded4-2e69-491b-aecb-6392d9f8f55d/five-seconds-on-elbrus-and-the-fda-submission-card.png", "datePublished": "2025-11-10T13:00:00Z", "dateModified": "2025-11-10T13:00:00Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/five-seconds-on-elbrus-and-the-fda-submission" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the core idea behind \"Five Seconds On Elbrus And The FDA Submission\"?", "acceptedAnswer": { "@type": "Answer", "text": "This is me on the summit of Mt. Elbrus. 18,510 feet, highest peak in Europe. The photo doesn't show that four hours earlier, I almost died on that mountain" } }, { "@type": "Question", "name": "Who is this post for?", "acceptedAnswer": { "@type": "Answer", "text": "Honestly, security leaders, medical device teams, and technical operators who want the honest version, not the vendor version. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading." } }, { "@type": "Question", "name": "How do I actually apply this, not just nod along?", "acceptedAnswer": { "@type": "Answer", "text": "Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch." } }, { "@type": "Question", "name": "How does this connect to Stay awake on the slope. Get a gap analysis?", "acceptedAnswer": { "@type": "Answer", "text": "Blue Goat Cyber has supported 250+ medical device cybersecurity submissions through FDA and global review. Start with a gap analysis on your device before the deficiency letter starts the clock. If the post landed, that is the natural next step; the request a gap analysis link at the bottom of the page goes straight there." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Cybersecurity](/blog/category/cybersecurity) # Five Seconds On Elbrus And The FDA Submission November 10, 2025 3 min read 694 words This is me on the summit of Mt. Elbrus. 18,510 feet, highest peak in Europe. The photo doesn't show that four hours earlier, I almost died on that mountain ![](/__l5e/assets-v1/5ac66560-c1df-4632-8157-df35dd32654c/elbrus-summit-self-arrest.jpg) Published November 10, 2025 Read time 3 min In this essay 1. [01 The Real Cost Of "Good Enough" Attention ](#the-real-cost-of-good-enough-attention) 2. [02 Why I See The Same Pattern In Submissions ](#why-i-see-the-same-pattern-in-submissions) 3. [03 How To Build The Habit Of Not Drifting ](#how-to-build-the-habit-of-not-drifting) Jump to 1. [01 The Real Cost Of "Good Enough" Attention ](#the-real-cost-of-good-enough-attention) 2. [02 Why I See The Same Pattern In Submissions ](#why-i-see-the-same-pattern-in-submissions) 3. [03 How To Build The Habit Of Not Drifting ](#how-to-build-the-habit-of-not-drifting) The takeaways 1. 01 Fumbling a Coke bottle and subsequently slipping on a 45-degree snow slope taught I a crucial lesson about inattention. What to do next Run a 20-minute tabletop with your team this month using fumbling as the scenario. 2. 02 I’s near-fatal accident on Mt. Elbrus highlighted that immediate consequences often follow a lapse in attention. What to do next Open your current near-fatal plan today and identify the one gap you would not want an auditor to find. 3. 03 The article draws a parallel between my mountaineering mistake and common oversights in medical device cybersecurity submissions to the FDA. What to do next Open your current medical plan today and identify the one gap you would not want an auditor to find. 4. 04 Delaying focused attention during the FDA submission process can lead to deficiency letters, postmarket vulnerabilities, or difficult audit questions. What to do next Add process to the next leadership review as a standing item, not a one-time slide. 5. 05 Blue Goat Cyber was founded on the principle of meticulous attention to detail in medical device submissions, treating each one with the gravity of a life-threatening mountain climb. What to do next Pause for five minutes today, then name the one place in your week where medical is playing out and you have been avoiding naming it. Editor's note The five-second decision on a submission looks like this: a finding shows up in penetration testing two weeks before filing. The team has to choose between delaying to fix it properly or writing a justification that hopes the reviewer doesn't push back. The justification path feels faster. It is, until the deficiency letter arrives. We were on the steepest section of the climb. A 45-degree snow slope. I stopped for a break. I pulled a bottle of Coke out of my pack, and I fumbled it. It hit the snow and accelerated down the mountain fast. Someone said, "Man, that's gonna hurt if it hits someone." I ignored the warning. Five seconds of daydreaming later, my crampons slipped. I started sliding down the same slope, picking up speed exactly like that bottle. I had an ice axe in my hand. I knew how to self-arrest. I'd practiced it. I just hadn't been paying attention. I got the axe in, kicked the spikes in, and stopped. Bruised, scraped, very much alive. ## The Real Cost Of "Good Enough" Attention The lesson wasn't about Elbrus. The lesson was that the cost of "good enough" attention is paid later, not in the moment. In the moment, the lapse is invisible. I was breathing. The team was twenty feet away. The mountain looked the same as it had thirty seconds earlier. Nothing about the environment told me I had just made an expensive decision. The cost arrived five seconds later, when my crampons slipped and physics took over. The gap between the lapse and the consequence is where most disasters live. Long enough that you do not connect them in the moment. Short enough that there is nothing you can do about it once they catch up. That gap is also the part you cannot train into a team by lecturing about it. The only people who really internalize it are the people who have slid down their own slope, gotten the axe in, and looked back up at how close it was. ## Why I See The Same Pattern In Submissions I see the same pattern in medical device cybersecurity submissions. A team rushes a [threat model](/blog/threat-modeling-is-the-work-everything-else-is-the-receipt). Skips a control. Skims a vendor's documentation. Marks something "good enough" because the deadline is loud. Then the deficiency letter shows up. Or the [postmarket vulnerability](/blog/why-postmarket-cybersecurity-is-where-medtech-actually-fails) does. Or the auditor asks the obvious question nobody wanted to ask in the design review. Five seconds of daydreaming on a slope. A week of "good enough" on a submission. Same mistake. The thing the team felt in the moment was relief. The deadline got hit. The package went out. The Friday afternoon got its weekend. The cost shows up sixty days later in a deficiency letter that lists seven items, three of which the team knew were soft when they shipped. By then the original engineers have moved on to the next project, the context is half-cold, and the rework will take three times longer than the original work would have if it had been done right. ## How To Build The Habit Of Not Drifting You cannot eliminate the lapses. You can shorten the gap between the lapse and the catch. On the mountain that is the ice axe in your hand, not on your pack. It is the habit of glancing at your crampons every few steps even when nothing feels wrong. It is the rope team that calls out a slip the second they see it, before the slipping person has registered they are sliding. On a submission it is the peer review that runs before the package leaves the building. The checklist that forces a second pair of eyes on the threat model. The cultural rule that says "good enough because the deadline" is a flag, not a status. The senior engineer who can say "stop, this is the part we always get burned on" without it being a political event. None of that is glamorous. All of it is what keeps the slide from turning into a fall. The lesson I took off that mountain is the reason Blue Goat Cyber exists. We've helped 250+ medical devices get through FDA and global clearance. And we still treat every submission like the mountain could kill us. Because the moment you don't, it will. > “Five seconds of discipline now beats five months of rework later.” Frequently asked ### What is the core idea behind "Five Seconds On Elbrus And The FDA Submission"? ### Who is this post for? ### How do I actually apply this, not just nod along? ### How does this connect to Stay awake on the slope. Get a gap analysis? ### Stay awake on the slope. Get a gap analysis. Blue Goat Cyber has supported 250+ medical device cybersecurity submissions through FDA and global review. Start with a gap analysis on your device before the deficiency letter starts the clock. [Request a gap analysis](https://bluegoatcyber.com/contact) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Ffive-seconds-on-elbrus-and-the-fda-submission&text=Five%20Seconds%20On%20Elbrus%20And%20The%20FDA%20Submission) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Ffive-seconds-on-elbrus-and-the-fda-submission) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Ffive-seconds-on-elbrus-and-the-fda-submission) [Email](mailto:?subject=Five%20Seconds%20On%20Elbrus%20And%20The%20FDA%20Submission&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Ffive-seconds-on-elbrus-and-the-fda-submission)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founder, Blue Goat Cyber I'm the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm where my team has supported 250+ FDA submissions with zero failing to clear on cybersecurity. I previously founded and sold Alpine Security. I host The Med Device Cyber Podcast and wrote The Smartest Person in the Room and The In-Between: Life in the Micro, with Medical Device Cybersecurity: An In-Depth Guide out in 2026. Air Force Academy grad, 24x Ironman, climber of two of the Seven Summits. Keep reading - [ ### Threat Modeling Is the Work. Everything Else Is the Receipt. The single highest-use place teams pay the "good enough" tax on a submission. Read essay → ](/blog/threat-modeling-is-the-work-everything-else-is-the-receipt) - [ ### FDA Premarket Cybersecurity: What the 2026 Guidance Actually Requires What the deficiency letter that follows a rushed submission actually contains, and how to avoid it. Read essay → ](/blog/fda-premarket-cybersecurity-what-the-2026-guidance-actually-requires) - [ ### Why Postmarket Cybersecurity Is Where MedTech Actually Fails The other place "good enough" gets paid for; months after the package is filed. Read essay → ](/blog/why-postmarket-cybersecurity-is-where-medtech-actually-fails) [← Previous essay The Ultrasound That Found My Clots: Why Medical Device Cybersecurity Is Personal | Christian Espinosa ](/blog/the-ultrasound-that-found-my-clots) Related, The In-Between ### Live in the In-Between Christian's philosophy on micro vs. macro, awareness, and intentional living, explored in talks, essays, and his books. [Connect with Christian](/connect) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)