The Med Device Cyber Podcast
byBlue Goat Cyber
HealthFitnessMedicineScienceLifeTechnology
In a time where healthcare and technology are deeply intertwined, understanding medical device cybersecurity is not just important—it's essential. Welcome to The Med Device Cyber Podcast, your go-to resource for understanding the complexities of this critical field of cyber security. As the definitive podcast on medical device security, we explore everything from identifying and mitigating vulnerabilities to navigating this ever-evolving regulatory landscape. Hosted by Christian Espinosa, Founder & CEO of Blue Goat Cyber, and Trevor Slattery, Director of Medical Device Cybersecurity, each episode features expert insights into the latest cybersecurity threats, innovative solutions, and best practices for protecting the medical de...
Episodes(40 episodes)
Season 1 - Episode 69
Science Before Hype in MedTech Investing with Varun Turlapati of Chaanakya Capital | Ep 69
Early-stage MedTech gets riskier when investors confuse a compelling story with a credible device. Stronger diligence starts by testing whether the science is real, whether clinicians would actually use the product, and whether the company has thought seriously about regulatory fit, reimbursement logic, and engineering durability.That framework becomes even more important in neurotech, where public fascination can outrun the evidence base and where the difference between a breakthrough and a weak claim is often diligence quality.Episode Breakdown00:00 Opening02:42 Science and engineering filters07:55 Why neurotech still...
Published: May 7, 2026Duration: 40m 59s
Season 1 - Episode 68
Why MedTech Needs More Than Approval with Michael Branagan Harris of HealthTech Strategies Limited
A device can clear regulatory hurdles and still struggle commercially if the evidence is too narrow. MedTech companies need proof that speaks to affordability, care quality, operational impact, and long term value, not just technical performance.Market selection matters just as much. The same solution may fit the United States, the UK, Germany, or the Netherlands very differently because reimbursement models, provider incentives, and care delivery systems are not built the same way.Episode Breakdown00:00 Opening09:02 What evidence actually needs to prove14:16 Building a stronger adoption case22:43...
Published: Apr 30, 2026Duration: 48m 58s
Season 1 - Episode 67
De-Risking Product Decisions in MedTech Startups with Brent Lavin of Ironwood MedTech Partners
Product decisions made during early development determine commercialization outcomes years later. Wrong choices about regulatory pathways, feature sets, and market segments create compounding problems limiting commercial success.Christian Espinosa and Trevor Slattery explore product management with Brent Lavin, Chief Product Catalyst of Ironwood MedTech Partners, covering why 510(k) pathways average four years while PMA programs require seven to nine years, and how feature set alignment shapes success.The engineering mindset applies hypothesis testing to product development through iterative refinement.Practical for MedTech founders and product teams.Episode Breakdown:00:02 Introduction04:35 Ironwood...
Published: Apr 23, 2026Duration: 43m 44s
Season 1 - Episode 66
Vibe Coding Security Risks and Malicious Code Injection with Jake Rodriguez of Triangle Tech
Vibe coding enables rapid development through AI-generated code but introduces security risks when developers accept outputs without verification. Malicious actors can inject vulnerabilities through manipulated training data or prompt engineering. Supply chain attacks become easier when developers blindly trust AI implementations.Jake Rodriguez, Founder and CEO of Triangle Tech, joins Trevor Slattery and Christian Espinosa to explore the security implications of vibe coding, how attackers exploit AI code generation, and what verification processes prevent unverified code reaching production.Understanding generated code requires technical knowledge many vibe coding adopters lack.Practical for development and...
Published: Apr 16, 2026Duration: 39m 10s
Season 1 - Episode 65
Why Clinical Trials Are the Most Expensive Capital Outlay for Startups with Rob Bedford, CEO of Franklyn Health
Early planning prevents expensive corrections when startups address clinical strategy, regulatory pathways, and cybersecurity requirements from day one rather than improvising solutions before launch. FDA pre-submission meetings provide feedback that de-risks strategies before execution.Clinical trial design shapes feasibility for startups with limited budgets. Understanding target markets determines sample requirements since UnitedStates sales need United States samples while Korean sales need Korean data. Reverse engineering where you want to sell enables appropriate planning.Good Clinical Practice guidelines establish responsibility layers. Manufacturers remain accountable for outcomes even when delegating work to CROs or...
Published: Apr 9, 2026Duration: 41m 36s
Season 1 - Episode 64
Traceability Requirements and Documentation Audit Trails with Dr. Basant Bajpai, CEO of Compliance MedQRA
Quality management system implementation delays create cascading failures across medical device development timelines. Startups using SharePoint or Google Drive for documentation discover at audit time that these tools provide no traceability, no version control, and no evidence of systematic processes.Dr. Basant Bajpai discusses why design controls begin at the concept stage, regardless of whether companies acknowledge them, how reverse documentation costs 6-12 months when manufacturers reach the submission stage without proper systems, and what happens when scaling exposes foundational quality gaps.Simple automated systems that enforce traceability outperform both manual approaches and enterprise platforms...
Published: Apr 2, 2026Duration: 35m 26s
Season 1 - Episode 63
Early Design Decisions that Shape Medical Device Success with Chris Danek, CEO of Bessel
Early design decisions define the trajectory of a medical device long before commercialization begins. Choices related to software architecture, third-party components, and system connectivity establish both the opportunity and the risk profile of the product.Cybersecurity introduces a layer of complexity that many teams underestimate. It extends beyond protecting data and into safeguarding patient outcomes, ensuring system reliability, and meeting increasingly stringent regulatory expectations.Chris Danek, CEO of Bessel, joins Christian and Trevor to examine how a single overlooked dependency or unsupported component can become a critical vulnerability. In many cases, these issues remain hidden...
Published: Mar 26, 2026Duration: 50m 56s
Season 1 - Episode 62
Patient Monitoring Systems and the Gingerbread Man: How Brandon Fertig, Senior Manager at Philips Healthcare Uses AI to Help Nurses PrioritizePatient Monitoring Systems and the Gingerbread Man: How Brandon Fertig, Senior Manager at Philips Healthcare Uses AI to Help Nurses Prioritize
Alarm fatigue happens when monitoring systems raise so many false flags that clinical staff begin ignoring them, even when real critical events occur. A surgeon during an operation gets alarms indicating patient bleeding, but observes stable blood pressure and no visible bleeding. The surgeon trusts direct patient observation over machine output because edge cases require human judgment that AI cannot reliably provide.Brandon Fertig discusses why patient monitoring systems with visual indicators like the gingerbread man figure help nurses prioritize care without replacing their judgment, how edge cases become more important as automation increases, and why AI...
Published: Mar 19, 2026Duration: 42m 39s
Season 1 - Episode 61
Spend Two Weeks in a Hospital Before Designing Your Medical Device (Professor Aamer Ahmed)
Devices that do not integrate into the clinical workflow sit unused regardless of technical sophistication. Physicians work in high-pressure environments where equipment must be 100 percent reliable, secure, and enhance workflow rather than disrupt it.Professor Aamer Ahmed, a Consultant in Cardiothoracic Anaesthesia, Professor of Anaesthesia and Critical Care at the University of Leicester, and co-founder of Hemeo, a medical technology company designing AI-based personalized Clinical Decision Support Systems for coagulation disorders, discusses with Christian Espinosa and Trevor Slattery why involving Key Opinion Leaders at the design stage prevents expensive redesigns, what alarm fatigue does to clinical decision-making...
Published: Mar 12, 2026Duration: 38m 13s
Season 1 - Episode 60
How to Move Stakeholders from Awareness to Sustained Adoption Without Friction
Marketing medical devices requires understanding that stakeholders are different, buying processes are longer, and friction points are more complex than consumer products or software. Most companies build websites and attend trade shows hoping prospects will decode their message, but prospects do not have time for that.Sustained adoption is not the same as initial purchase. It means the device is used continuously with no friction, no concerns, and no barriers, causing users to stop or switch. Getting there requires understanding every stakeholder involved, what questions they have at each stage, and what fears might stop them.<...
Published: Mar 5, 2026Duration: 40m 51s
Season 1 - Episode 59
Prevention Is Better Than Cure: Applying Medical Principles to Medtech Cybersecurity
Medical device risk assessments are failing patients, not because the process is too hard, but because nobody doing the assessment has ever been in the room where the device actually gets used.Medtech quality and regulatory leader Stephen Smith describes sitting in a risk session for a device going into an intensive care unit. Twelve people in the room, and not one had ever set foot in an ICU. If you have never been in the environment your device will operate in, risk identification becomes guesswork, mitigations get written for problems that are not the actual problems...
Published: Feb 26, 2026Duration: 32m 26s
Season 1 - Episode 58
Adversarial Attacks on Medical AI: What You Need to Know with Jun Xiang Tan
Ten years ago, Singapore's healthcare system got hacked. Patient records were stolen at a national scale. The government responded by building one of the most comprehensive medical device security frameworks in the world.The Cybersecurity Labeling Scheme has four tiers. Level one means basic security controls exist. Level four means the device underwent independent code review, has advanced threat detection, and maintains continuous vulnerability management. Hospitals can see exactly what level of security they're getting before they buy.Jun Xiang from CareHero explains why this matters, especially now that AI is showing up in medical...
Published: Feb 19, 2026Duration: 37m 40s
SBOMs 101: What the FDA Expects and How to Get It Right
SBOMs are one of the most common sources of FDA deficiencies in medical device submissions. Most companies think they're doing it right, but then they get feedback asking for missing components or clarification on what's included.In this webinar, Christian Espinosa and Trevor Slattery explain what the FDA actually expects in an SBOM and why it's not just about listing third-party libraries. You need to include first-party code too. You need to follow the NTIA minimum elements. And you need to provide it in a machine-readable format like SPDX or CycloneDX.Trevor walks through the...
Published: Feb 18, 2026Duration: 41m 50s
Season 1 - Episode 57
Secure Software Development for Medical Devices: The Real Story with Darcy Bachert
Building medical device software is hard. Building it the right way is harder. And getting it through FDA approval while managing cybersecurity requirements? That's what Darcy Bachert has been doing for 17 years.Darcy runs Prolucid Technologies, an ISO 13485-certified software development firm in Toronto. They work with medtech companies across North America, Europe, and Australia.And in that time, he's seen the same mistakes repeatedly.The biggest one? Founders build products that solve problems nobody has. Or they build something physicians won't adopt because it adds complexity instead of making their lives easier.<...
Published: Feb 12, 2026Duration: 44m 22s
Season 1 - Episode 56
The Hidden Cybersecurity Challenges in Software as a Medical Device
Marc Zemel has been building Retia Medical for 15 years. The company started as two guys with slides and licensed technology. Now their data-driven hemodynamic monitoring technology for consistently accurate cardiac output measurements in high-risk surgical and critically ill patients is in 75 hospitals across 18 countries, sold by Medtronic in the U.S, and the company is preparing to launch their new product Argos Infinity, pending FDA clearance.But getting here meant dealing with cybersecurity challenges that Marc didn't see coming. In this conversation, he talks about what actually slowed them down, what he wishes he'd done differently, and...
Published: Feb 5, 2026Duration: 41m 56s
Season 1 - Episode 55
Why Your Cloud Platform Decision Could Destroy Your Global Market Strategy
Thinking about taking your medical device to China? Or maybe you're a Chinese company looking at the American market?William Jin has spent over 30 years helping companies do exactly that, and he'll tell you straight up that most of them aren't ready. Not because they lack good products, but because they didn't think about cybersecurity early enough.William was trained as a medical doctor in Shanghai, then moved into the medtech industry working for companies like McCulloch and Stryker. Now he helps businesses on both sides of the Pacific figure out how to actually get...
Published: Jan 30, 2026Duration: 30m 9s
Season 1 - Episode 55
Why Your Cloud Platform Decision Could Destroy Your Global Market Strategy
Thinking about taking your medical device to China? Or maybe you're a Chinese company looking at the US market?William Jin has spent over 30 years helping companies do exactly that, and he'll tell you straight up that most of them aren't ready. Not because they lack good products, but because they didn't think about cybersecurity early enough.William was trained as a medical doctor in Shanghai, then moved into the medtech industry working for companies like McCulloch and Stryker. Now he helps businesses on both sides of the Pacific figure out how to actually get...
Published: Jan 27, 2026Duration: 30m 9s
Season 1 - Episode 55
How to Actually Get Your Medical Device Approved in China (Or the US)
Thinking about taking your medical device to China? Or maybe you're a Chinese company looking at the US market?William Jin has spent over 30 years helping companies do exactly that, and he'll tell you straight up that most of them aren't ready. Not because they lack good products, but because they didn't think about cybersecurity early enough.William was trained as a medical doctor in Shanghai, then moved into the medtech industry working for companies like McCulloch and Stryker. Now he helps businesses on both sides of the Pacific figure out how to actually get...
Published: Jan 21, 2026Duration: 30m 8s
Season 1 - Episode 54
How to Avoid the 3 Biggest Mistakes in Medtech Startups
Ever thought about what it really takes to launch a successful medtech startup?Omar M. Khateeb knows the challenges firsthand. As a founder with a track record of building healthtech companies, he’s lived through the hurdles that come with innovating in the medtech space.In this episode, Omar dives into the highs and lows of his entrepreneurial journey, sharing key lessons, pivotal moments, and the strategies that helped him succeed. From tackling complex healthcare issues to navigating the regulatory maze, Omar breaks down what it takes to make a lasting impact in medtech....
Published: Jan 14, 2026Duration: 53m 0s
Season 1 - Episode 53
Untangling Software Composition Analysis for MedTech Teams
Why does software composition analysis matter beyond regulatory compliance?This episode explores SCA (Software Composition Analysis) and explains how SBOMs (Software Bill of Materials), SOUP (Software of Unknown Provenance), and related tooling fit into the broader medical device cybersecurity landscape. Christian and Trevor clarify common misconceptions, including licensing fears, machine-readable requirements, and the role of static testing tools.The Med Device Cyber Podcast is brought to you by Blue Goat Cyber, cybersecurity professionals specializing in providing elite cyber solutions for medical devices. Learn more about securing your product and business from cyber-criminals by visiting https...
Published: Jan 6, 2026Duration: 29m 2s