--- title: "Why Postmarket Cybersecurity Is Where MedTech Actually Fails" description: "FDA clearance is the floor, not the finish line. A look at why most medical device cybersecurity programs collapse after launch; and what the working…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Why Postmarket Cybersecurity Is Where MedTech Actually Fails | Christian Espinosa", "description": "FDA clearance is the floor, not the finish line. A look at why most medical device cybersecurity programs collapse after launch; and what the working postmarket programs do differently.", "image": "https://christianespinosa.com/__l5e/assets-v1/59e3d195-1262-4b5c-a6c0-b4df000f9c8b/why-postmarket-cybersecurity-is-where-medtech-actually-fails-card.png", "datePublished": "2026-04-08T14:00:00Z", "dateModified": "2026-04-08T14:00:00Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/why-postmarket-cybersecurity-is-where-medtech-actually-fails" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the core idea behind \"Why Postmarket Cybersecurity Is Where MedTech Actually Fails\"?", "acceptedAnswer": { "@type": "Answer", "text": "I've lost count of how many times I've watched this happen: a MedTech company treats cybersecurity like a one-time hurdle for submission, then the device ships, and the postmarket program dies a quiet death. Twelve to twenty-four months later, a CVE drops in a component nobody’s tracking, a hospital network team finds it, and my sales team is on a call explaining a vulnerability we didn't know we had" } }, { "@type": "Question", "name": "Who is this post for?", "acceptedAnswer": { "@type": "Answer", "text": "Honestly, security leaders, medical device teams, and technical operators who want the honest version, not the vendor version. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading." } }, { "@type": "Question", "name": "How do I actually apply this, not just nod along?", "acceptedAnswer": { "@type": "Answer", "text": "Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch." } }, { "@type": "Question", "name": "How does this connect to Run postmarket cybersecurity like it's a product?", "acceptedAnswer": { "@type": "Answer", "text": "Blue Goat Cyber stands up and runs postmarket cybersecurity programs for medical device makers. SBOM monitoring, coordinated disclosure, patch logistics, and the postmarket cybersecurity management plan. If the post landed, that is the natural next step; the work with blue goat cyber link at the bottom of the page goes straight there." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Cybersecurity](/blog/category/cybersecurity) # Why Postmarket Cybersecurity Is Where MedTech Actually Fails April 8, 2026 3 min read 731 words I've lost count of how many times I've watched this happen: a MedTech company treats cybersecurity like a one-time hurdle for submission, then the device ships, and the postmarket program dies a quiet death. Twelve to twenty-four months later, a CVE drops in a component nobody’s tracking, a hospital network team finds it, and my sales team is on a call explaining a vulnerability we didn't know we had ![](/__l5e/assets-v1/046fcdc3-3485-47d3-951c-99d383dc08f4/why-postmarket-cybersecurity-is-where-medtech-actually-fails-hero.webp) Published April 8, 2026 Read time 3 min In this essay 1. [01 The pattern is always the same ](#the-pattern-is-always-the-same) 2. [02 What the working programs do ](#what-the-working-programs-do) 3. [03 Why this is actually a brand asset ](#why-this-is-actually-a-brand-asset) 4. [04 What this costs to run well ](#what-this-costs-to-run-well) 5. [05 The mindset shift ](#the-mindset-shift) Jump to 1. [01 The pattern is always the same ](#the-pattern-is-always-the-same) 2. [02 What the working programs do ](#what-the-working-programs-do) 3. [03 Why this is actually a brand asset ](#why-this-is-actually-a-brand-asset) 4. [04 What this costs to run well ](#what-this-costs-to-run-well) 5. [05 The mindset shift ](#the-mindset-shift) The takeaways 1. 01 Clearance is the floor. The hard part is the next ten years of the device's life. What to do next Pause for five minutes today, then name the one place in your week where device is playing out and you have been avoiding naming it. 2. 02 Postmarket monitoring needs an owner with calendar time, not a contractor. What to do next Add postmarket to the next leadership review as a standing item, not a one-time slide. 3. 03 Coordinated disclosure is a brand asset when you run it well, a liability when you don't. What to do next Ask your security lead this week for the one-page view of coordinated in your environment, and read it end to end. 4. 04 Your SBOM is only as good as the watch list you run against it. What to do next Run a 20-minute tabletop with your team this month using sbom as the scenario. 5. 05 Patch programs fail on logistics, not on engineering. What to do next Ask your security lead this week for the one-page view of patch in your environment, and read it end to end. ## The pattern is always the same I've lost count of how many times I've seen this script play out: the company gets clearance, the launch is celebrated, the cybersecurity team shrinks back to whoever was already there, and the cybersecurity management plan goes in a folder. Nine months later something happens; a researcher reports a vulnerability, a hospital IT team asks about an unpatched library, FDA sends a question; and there is no muscle memory for responding. The problem is almost never technical. The problem is that no one is running the program. ## What the working programs do The companies whose postmarket cybersecurity actually holds up share a small set of unglamorous habits. **1\. There is a named owner with calendar time.** Not a job title, a calendar. Somebody whose week reliably contains hours dedicated to vulnerability monitoring, triage, and outbound communication. If the person responsible for postmarket cyber is also responsible for shipping the next product, postmarket loses every time. **2\. The SBOM is alive.** It is regenerated on every build. It is monitored against NVD plus at least one paid feed. New high-severity CVEs in components you ship produce a ticket within a defined SLA. The team can answer "are we exposed to X?" within hours, not weeks. **3\. Coordinated disclosure is operationalized.** There is a public security.txt or equivalent. Researchers know where to send findings. The first response is fast and human. The internal triage path is documented. Nothing kills a security researcher's goodwill faster than radio silence; nothing builds it faster than a thank-you note in 48 hours. **4\. Patch logistics are designed, not improvised.** Most postmarket failures look like engineering problems but are logistics problems. Who signs the update? Who notifies which hospitals? What is the validation regression? What is the fallback if a hospital declines the patch? The companies that ship patches reliably have answered these questions on a whiteboard before the first patch. **5\. There is a postmarket cybersecurity review cadence.** Quarterly is the minimum. The review covers open vulnerabilities, disclosure activity, patch status by deployment site, and any cross-cutting program changes. The artifact from that review is reportable to FDA on request. ## Why this is actually a brand asset MedTech buyers; hospital systems, integrators, MDMs; increasingly grade vendors on postmarket cybersecurity posture before procurement, not after. A company that can answer "what is your coordinated disclosure process?" with a confident, written answer wins deals against companies that cannot. A company that proactively notifies its customers of a patched CVE before anyone in the press finds it earns trust that is genuinely hard to buy. The inverse is also true. A botched disclosure, a vulnerable component left unpatched, a sales rep on a call without a story; these become procurement disqualifiers, sometimes permanently. ## What this costs to run well Less than you think, if you scope it honestly. For a single connected device, a competent postmarket cybersecurity program is roughly 0.25–0.5 FTE of dedicated time, plus tooling, plus a relationship with an external responder for spikes. For a portfolio, it scales sublinearly because the process is the same; the watch list, the cadence, the disclosure intake. It costs vastly more not to run it. The companies I have seen taken offline by a postmarket cybersecurity event paid the cost in delayed releases, lost deals, FDA scrutiny, and management distraction that ran into the millions. ## The mindset shift The shift that has to happen inside the company is treating postmarket cybersecurity as a _product_, not a _project_. Products have owners, roadmaps, metrics, and SLAs. Projects have end dates. Postmarket cybersecurity has no end date until the device is no longer in service. Clearance gets you to launch. The next ten years of the device's life are the work you signed up for when you decided to ship a connected medical device. Run that program like the product it is, and your cybersecurity story becomes one of your most defensible competitive moats. Sit with this - Who owns postmarket cybersecurity for your shipping devices today? Could they tell you their last triage decision and when it happened? - How would your team find out, on a Friday night, that a critical CVE was just published in a library you ship? - If a researcher emailed your security contact right now, where would the email go, and how long would it take to get a human reply? Frequently asked ### What is the core idea behind "Why Postmarket Cybersecurity Is Where MedTech Actually Fails"? ### Who is this post for? ### How do I actually apply this, not just nod along? ### How does this connect to Run postmarket cybersecurity like it's a product? ### Run postmarket cybersecurity like it's a product Blue Goat Cyber stands up and runs postmarket cybersecurity programs for medical device makers. SBOM monitoring, coordinated disclosure, patch logistics, and the postmarket cybersecurity management plan. [Work with Blue Goat Cyber](https://bluegoatcyber.com/) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwhy-postmarket-cybersecurity-is-where-medtech-actually-fails&text=Why%20Postmarket%20Cybersecurity%20Is%20Where%20MedTech%20Actually%20Fails) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwhy-postmarket-cybersecurity-is-where-medtech-actually-fails) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwhy-postmarket-cybersecurity-is-where-medtech-actually-fails) [Email](mailto:?subject=Why%20Postmarket%20Cybersecurity%20Is%20Where%20MedTech%20Actually%20Fails&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwhy-postmarket-cybersecurity-is-where-medtech-actually-fails)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founding CEO, Blue Goat Cyber. Host of the Med Device Cyber Podcast. I'm the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm where my team has supported 250+ FDA submissions with zero failing to clear on cybersecurity. I previously founded and sold Alpine Security. I host The Med Device Cyber Podcast and wrote The Smartest Person in the Room and The In-Between: Life in the Micro, with Medical Device Cybersecurity: An In-Depth Guide out in 2026. Air Force Academy grad, 24x Ironman, climber of two of the Seven Summits. Keep reading - [ ### Total Product Lifecycle: The Framing That Fixes Most MedTech Submissions | Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/total-product-lifecycle-the-framing-that-fixes-most-submissions) - [ ### FDA Premarket Cybersecurity: What the 2026 Guidance Actually Requires | Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/fda-premarket-cybersecurity-what-the-2026-guidance-actually-requires) - [ ### What a 'Good' SBOM Actually Looks Like, And What Reviewers Reject | Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/what-a-good-sbom-actually-looks-like) [← Previous essay FDA Premarket Cybersecurity: What the 2026 Guidance Actually Requires | Christian Espinosa ](/blog/fda-premarket-cybersecurity-what-the-2026-guidance-actually-requires)[Next essay → If Your Reviewer Can't See the System, You Don't Have an Architecture | Christian Espinosa ](/blog/if-your-reviewer-cant-see-the-system-you-dont-have-an-architecture) Related, Cybersecurity ### Need medical-device or offensive security expertise? Blue Goat Cyber, Christian's firm, runs FDA-aligned premarket submissions, penetration testing, and SBOM/SOUP analysis for medtech and high-stakes industries. [Explore Blue Goat Cyber](/cybersecurity) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)