Solutions
Embedded Devices Cybersecuirty
We find the security gaps in your embedded device, close them and keep watching after release. Medical or IoT - we get you ready for EU CRA, MDR and FDA without loading your team.
One team for all your cyber regulations
Is your device readyfor the new cyberrules?
- A device without proper security is a business risk. Attackers can stop it, change how it works or steal patient and customer data. Your know-how can end up with competitors.
- Regulators are no longer patient. Under the EU CRA, fines reach €15 million or 2.5% of global annual turnover. Non-compliant products can be pulled from the market. In the US, the FDA refuses to review submissions without proper cybersecurity documentation.
Our offer for embedded devices cybersecurity
Audit and documentation
New or existing project - we start with an audit or workshops followed by threat modelling. We identify your assets, risks and security requirements.
Implementation
We build security into your device by design: secure boot, encryption, signed updates and OS hardening. Then we test every measure and document the results.
Maintenance
Security does not end at release. We monitor vulnerabilities in your software, assess their impact and help you respond and report on time.
Cybersecurity projects we delivered
Bio-Rad is a global leader in life science research and clinical diagnostics. For their new generation of PCR analyzer, we ran the first cybersecurity assessment. We performed a risk analysis and threat modelling. We identified the assets to protect and defined the full list of security requirements. Then we turned them into tasks and implemented them. We reduced the attack surface by closing unused ports and stripping the Yocto Linux image to the minimum. We encrypted stored and transmitted data, using hardware-based encryption. We also added secure boot, security logs and more.
ViscoTec is a German manufacturer of precise dosing and dispensing systems. They came to us with serious gaps in EU CRA readiness. Both the product and the processes were far from compliant. On top of that, the project carried a lot of technical debt. Before any documentation, we had to fix the foundation. We moved the software from Windows to new hardware and a custom Linux based on Torizon OS. That meant migrating large parts of the code and upgrading dependencies, including Qt. Then we added secure boot and encrypted offline updates that are signed and can be rolled back. We cut the system image down to what is really needed. Finally, we prepared the SBOM and documentation for future maintenance.
Enbio Group AG makes small, fast Class B autoclaves for the medical, dental and beauty sectors. Their Enbio PRO was ready for its first US FDA 510(k) submission – except for one thing. Since October 2023, the FDA rejects cyber device submissions without cybersecurity documentation. In just two weeks, we produced the full package from zero. It included a machine-readable CycloneDX SBOM of the firmware and all its components, and a cybersecurity management plan for the device's whole life. We also delivered a full vulnerability review with a clear register of findings, and a residual risk report. Enbio sent a complete package and got FDA acceptance without push-backs.
A methodology that saves your time
We built our process on real assessment and implementation projects. We repeat it in every project, with ready templates and clear instructions. We handle the technical details. Your team gives input only where it really matters. The result is fast delivery – exactly what you need with regulatory deadlines getting closer.
Audit or kick-off workshop
01
Threat modelling and asset identification
02
Security requirements design
03
Implementation of security measures
04
Testing and documentation
05
Continuous vulnerability monitoring
06
Continuous 24/7 monitoring
Security does not end at release. Our subscription takes vulnerability monitoring off your team.
Your device uses dozens of open-source and third-party components. We check them every day against public vulnerability databases.
When a new vulnerability affects your device, we assess the risk and tell you what to do. If it is actively exploited, the EU CRA gives you only 24 hours to send an early warning. We help you meet that deadline.
Implementation aspects we cover
OS hardening to limit the attack surface
Encryption of stored and transmitted data
Secure boot
Secure OTA and offline updates
Software Bill of Materials (SBOM)
Hardware-backed disk encryption
Architecture that protects critical functions
Access control and secure user authentication
FAQ
Answers to the questions we hear most often from engineering and regulatory teams.
What standards do you cover?
Mostly EU CRA, MDR with MDCG 2019-16, and FDA Section 524B with its premarket cybersecurity guidance. The technical measures are almost unified across any industry.
How much does your service cost?
It depends on your device and where you start. The audit is a fixed-price project [from €4,000]. We estimate implementation after the audit, so you know the full cost before you commit. Monitoring is a monthly subscription.
How fast can you start?
Usually within 2 weeks of signing. The first workshop can often happen sooner.
What I need to prepare?
Description of your device, its architecture and your target markets and users. Access to source code and existing documents helps, but it is not needed to provide audit or workshop estimation. We guide you through the rest. The access to source code and documentation is of course required during implementation and monitoring. We always sign NDAs with our clients.
Request a cybersecurity audit
Adam Sowa
Chief Technology Officer
Tell us about your device. We take the documentation and implementation burden off your team and make your product secure for real.
The CRA deadline will not move. Let's check where you stand today.
Connect with me on LinkedIn