Medcrypt has announced the appointment of Bob Lyle as Chief Revenue Officer (CRO). With nearly 30 years of experience in enterprise cybersecurity, multimedia IP licensing, and both the software and hardware sectors, Bob brings a wealth of expertise to Medcrypt’s leadership team.

In his new role, Bob will oversee all sales, revenue generation, and marketing efforts as Medcrypt continues to expand its offerings within the medical device cybersecurity landscape. His deep knowledge of enterprise cybersecurity solutions and proven success in scaling high-growth startups and global enterprises will be invaluable as Medcrypt aims to further solidify its market position.

Bob joins Medcrypt from Finite State, following its recent acquisition of MergeBase, a venture-backed supply chain cybersecurity startup, where he led revenue growth and business development as CRO. In addition, Bob serves as the Deputy Chair of the GSMA’s Device Security Group (DSG), contributing to the advancement of global standards for device security. Previously, Bob served as CRO of Cybeats, where he played a critical role in growing the company from its first customers to a successful IPO on the Canadian Securities Exchange (CSE: CYBT).

“I’m excited to join Medcrypt at such a pivotal time in the industry,” said Bob Lyle. “With the increasing regulatory focus on medical device cybersecurity, Medcrypt is in a unique position to help manufacturers meet these evolving challenges, and I look forward to contributing to our growth.”

Bob’s career is marked by entrepreneurial leadership, including co-founding and serving as CEO of Valona Labs, an enterprise cybersecurity startup that achieved a successful exit within two years through acquisition by HMD Global/Nokia Mobile. His work has helped create substantial revenue streams and drive successful exits for venture-backed companies, as well as grow innovative business units in large global organizations.

“We are excited to welcome Bob to the Medcrypt team,” said Mike Kijewski, CEO of Medcrypt. “His extensive experience, both as a senior leader in startups and large organizations, aligns with our strategic growth plans. Bob will be instrumental in helping Medcrypt scale and meet the increasing demand for secure medical devices.”

Bob’s addition comes as Medcrypt continues to grow and expand its solutions to protect medical devices from emerging cybersecurity threats.

Source: MedCrypt

Medcrypt, Inc. has announced its partnership with Tidelift, a provider of solutions for improving the security and resilience of the open-source software powering modern applications. This partnership will strengthen medical device security by leveraging data to offer advanced security solutions to customers, ensuring devices stay safe throughout their entire lifecycle.

For MDMs, the upcoming U.S. Food and Drug Administration’s (FDA) deadline of October 1 is a critical milestone, mandating the adoption of software bill of materials (SBOM) analysis for all regulated devices, according to Section 524B(b)(3) of the Federal Food, Drug, and Cosmetic Act. To address this challenge, Medcrypt and Tidelift are collaborating to offer MDMs a robust vulnerability management solution that meets stakeholder needs and enables enhanced post-market vigilance. The partnership provides access to share granular data verified by Tidelift’s partner network of independent maintainers, which will ultimately make device makers better equipped to triage vulnerabilities.

By leveraging Tidelift’s data, Medcrypt advances its Helm solution; this partnership expands the data provided to customers, making a significant impact on post-market vigilance.

“We understand the urgency facing medical device manufacturers in meeting the FDA deadline,” said Om Mahida, VP of Product at Medcrypt. “Together with Tidelift, we’re excited to present an enhanced vulnerability management solution that enables MDMs to proactively manage vulnerabilities.”

This collaboration arms MDMs with a powerful security framework capable of withstanding ever-evolving threats. By co-creating a set of evidence for upstream open source package secure development practices and continuously updating these certifications, the joint solution empowers manufacturers to not only meet the regulatory deadline but maintain a dynamic vulnerability program that safeguards medical devices in an evolving threat landscape.

Donald Fischer, co-founder, and CEO of Tidelift, shared the significance of the partnership, saying, “At Tidelift, we’re committed to providing the highest-quality data and tools to our customers. Partnering with Medcrypt allows us to expand our reach and impact in the healthcare industry, enhancing medical device security and raising the bar for cybersecurity standards.”

Source: Medcrypt

Medcrypt, Inc. has announced its latest offering “FDA Cybersecurity Readiness Services” empowering medical device manufacturers (MDMs) to confidently navigate the U.S. Food and Drug Administration’s (FDA) Refuse to Accept (RTA) policy as well as the new Section 524B requirements stemming from the Consolidated Appropriations Act, 2023.

The RTA policy evaluates the acceptability of medical device submissions, focusing on crucial elements, including cybersecurity, and may result in refusal if requirements from the amendment of the Food, Drug, and Cosmetic Act (FD&C Act) are not met. Medcrypt’s comprehensive services also prioritize the FDA’s eSTAR, a now mandatory FDA program that guides manufacturers in documenting and describing to the FDA their cybersecurity efforts for all 510(k) submissions, unless exempted. Both initiatives were issued by the FDA with an effective date of October 1, 2023.

Medcrypt’s FDA Cybersecurity Readiness Services streamline MDMs’ FDA journey, catering to those preparing, submitting, or already encountering issues:

1. FDA Cybersecurity Filing Readiness Survey: This free assessment for MDMs helps gauge submission readiness with survey questions aligned with the FDA guidance, including RTA/eSTAR and provides valuable insights into the risks to acceptance.
2. FDA Cybersecurity Filing Remediation: For MDMs who do not pass the FDA Filing Readiness Survey or have received an FDA refusal, Medcrypt’s experts can help identify gaps and create a prioritized plan to rectify issues, ensuring the submission becomes acceptable.
3. FDA Cybersecurity Submission Readiness: Aimed at MDMs with submissions either already under FDA review or planned for the near future, this service offers a comprehensive review using MedCrypt’s unique framework to ensure cybersecurity compliance.
4. Hold Letter Cybersecurity Response: In the event of an FDA hold letter, Medcrypt provides immediate guidance to navigate the response process effectively.

“We developed the FDA Cybersecurity Readiness Services to address the growing demand from medical device manufacturers seeking guidance through the complex and evolving submission process. Our goal is to equip MDMs with comprehensive insights into cybersecurity gaps, enabling them to prioritize and manage these gaps efficiently,” Naomi Schwartz, senior director of quality and safety at Medcrypt.

Seth Carmody, VP of Regulatory Strategy at Medcrypt, shared, “Our program is led by experts who have previously held cybersecurity roles at the FDA, worked in medical device manufacturing, or comparable industries. This expertise ensures that our services meet the highest standards and help our customers successfully navigate the FDA’s stringent requirements.”

For MDMs, these services streamline the submission process, saving time and fostering confidence in meeting FDA requirements. Regulators also benefit from better-organized submissions, adhering to guidance and providing contextualized cybersecurity design and validation details as expected by the FDA. Medcrypt’s primary objective is to support MDMs facing new submissions under cybersecurity draft guidance and needing to comply with the amendment to the FD&C Act (Section 524B). In addition to assessing the pivotal role of FDA Cybersecurity Readiness Services, Medcrypt’s supporting product portfolio includes additional innovative products that address vulnerability management, network encryption, and cryptography.

Interested in ensuring your medical devices comply with FDA cybersecurity expectations (both requirements per the Act and recommendations per cybersecurity guidance)? Inquire with MedCrypt to learn more about our FDA Cybersecurity Readiness Services, designed to guide medical device manufacturers through the new 510(k) eSTAR submission requirement and the cybersecurity Refuse to Accept (RTA) policy and streamline the path to regulatory approval.

Source: Medcrypt

MedCrypt, Inc. has partnered with Kansas State University by providing a grant to drive advancements in quantifying regulatory and cybersecurity risk in the medical field. This summer, the partnership will aim to enhance medical device cybersecurity research by focusing on validating the tools used to assess client risk, incorporating a holistic approach, and seamlessly integrating technical elements and public and regulatory policy considerations.

The collaboration, led by Dr. Eugene Vasserman (KSU) and Dr. Seth Carmody (MedCrypt’s VP of Regulatory Strategy), aims to address the varied challenges of assessing and quantifying cybersecurity risks associated with interconnected medical devices and their impact on clinical care delivery, patient safety, and business continuity. The MedCrypt and KSU collaboration brings together premier research institutions to tackle challenging problems faced by MDMs. Additionally, it provides the possibility for working together between MedCrypt, KSU, and Tufts University. With the U.S. Food and Drug Administration’s (FDA’s) decision to refuse future device submissions which don’t meet minimal cybersecurity requirements by October 1, there is a call to action for Medical Device Manufacturers (MDMs) to prioritize cybersecurity.

The research will combine a comprehensive qualitative and quantitative approach that considers risks from both business and technical perspectives. I like prior “one size fits all” work, which includes analyzing the manufacturer-specific approach to cybersecurity during product line engineering and product design, product requirement and risk evaluation including compensating controls, verification and validation procedures, and post-market monitoring and support. By integrating broader cybersecurity practices such as threat modeling, vulnerability monitoring, and incident response, MedCrypt and KSU can work towards enhancing the security posture of medical devices and manufacturers. The urgency to comply with the FDA’s requirements by October 1 provides a compelling incentive for MDMs to engage with MedCrypt. Through the partnership, MedCrypt and KSU can leverage academic best practices in medical device cybersecurity while applying real-life constraints that MDMs experience every day. By doing so, they will contribute to the overall safety and integrity of interconnected medical devices, ultimately improving patient care, reducing the risk of cyber threats in healthcare environments, and placing MDM-level cybersecurity risk estimation on a firmer footing.
“Partnering with Kansas State University allows us to focus on a critical research initiative,” said Seth Carmody. “This partnership validates the value of our risk assessment tools and strengthens our capacity to tackle evolving challenges in medical device cybersecurity. By leveraging academic expertise, industry insights, and an understanding of new rules and regulations, we are confident that our joint efforts will lead to significant advancements.”

Dr. Vasserman brings extensive experience in the security of distributed systems, cyber-physical systems, and the socio-technical aspects of security. As the director of the Kansas State University Center for Cybersecurity and Trustworthy Systems (K-CaTS), he has played a pivotal role in advancing cybersecurity education and has been involved in multiple medical device cybersecurity projects, from the MDM side as well as through collaboration with the FDA. Dr. Vasserman has also received several notable recognitions, including the Commissioner’s Special Citation in 2018 as a member of the St. Jude Medical Cybersecurity Response Team, the Outstanding Service Award in 2020 as a member of the Cardiac Monitor Cybersecurity Review Team, and the Group Recognition Award in the same year as a member of the URGENT/11 Response Team.

“I am honored to lead this research and work closely with MedCrypt to address challenges in medical device cybersecurity,” said Dr. Eugene Vasserman. “Our research will not only provide a holistic understanding of cybersecurity risk in the medical field but also contribute to developing standards and policies that will help strengthen the safety and integrity of medical devices. Together, we aim to make lasting improvements to the industry and protect patients from ever-evolving cyber threats.”

The research team will develop a platform that is both customizable and expandable, integrating qualitative and quantitative metrics. This platform will provide actionable and prioritized recommendations for addressing current and future technological, regulatory, and business risks. In terms of advancing science, the project will result in research papers and software artifacts that disseminate new knowledge and provide a foundation for others to build upon. Customers of MedCrypt can anticipate a swift integration of research findings into their products and services. This integration will bring immediate benefits, such as significantly enhanced proactive risk management, specifically tailored to the processes and needs of MDMs, which will include ongoing monitoring, testing, and updating of security controls. These practices not only help meet regulatory requirements but also effectively reduce cybersecurity risks while simultaneously lowering costs by prioritizing the mitigation strategies most likely to be effective and avoiding those that may yield little long-term benefit. Ultimately, customers can have increased confidence in the security of medical devices, which leads to increased trust between healthcare providers, patients, and the technology they rely on.

Source: MedCrypt

MedCrypt, Inc. announces that it was selected to participate in Microsoft Azure for Startups, a global program dedicated to accelerating the trajectory of startups through access to a network of technology, mentorship, and business support. As part of its participation, MedCrypt has also announced the launch of its product, Guardian, an embedded library that makes it easy to build cryptography, validate integrity, and keep data private, on the Azure Marketplace.

“We’re excited to join the Microsoft Azure Marketplace ecosystem as it is a great avenue for startups to discover technologies and platforms that enable secure innovation,” said Mike Kijewski, CEO of MedCrypt. “The Food and Drug Administration (FDA) requires manufacturers to include security features into their devices and our collaboration with Microsoft is now making Guardian available to its medical device manufacturing customers, bringing cybersecurity closer to these devices.”

As administrators and operators of medical devices, hospitals must comply with certain Health Insurance Portability and Accountability Act (HIPAA) security and privacy requirements. Additionally, FDA guidelines also mandate devices to be secured to ensure safety. Both of these conditions can be met by using encryption. Integrating connected medical devices across healthcare poses cybersecurity risks. In response, the FDA released updates to its premarket cybersecurity guidance and postmarket cybersecurity guidance, which establish expectations related to the design and maintenance of medical devices.

This collaboration announcement will provide medical device manufacturers with a seamless experience in implementing cryptography in support of those requirements while also furthering MedCrypt’s reach to Microsoft’s existing customer base. With streamlined deployment and management, customers can now take advantage of the scalability and security provided by Azure. MedCrypt’s Guardian meets the needs of software-enabled and connected medical devices with an opportunity to adopt improved security tooling and provides device manufacturers a helpful starting point when building with the Azure Marketplace.

“We are thrilled to be added to the Microsoft Azure platform, as it’ll help medical device manufacturers adopt and deploy our services more easily, which directly impacts how secure their devices will be,” said Vidya Murphy, chief operating officer at MedCrypt. “Launching on the Azure Marketplace is the next step in enabling more medical device companies to drastically improve their security programs, which is incredibly important given that 53% of connected medical devices and other internet of things (IoT) devices in hospitals were found to have known critical vulnerabilities.”

“Customers around the globe are using Microsoft Azure and we are glad to see a partner like MedCrypt deliver a Cryptography API tool to help manufacturers optimize security on medical devices,” said Sally Frank, worldwide lead for health and life sciences, Microsoft for Startups. “Medical device manufacturers are switching to Azure for product support and having Guardian, MedCrypt’s Cryptography API tool fits a need for the marketplace.”

MedCrypt currently provides enhanced security products and services for seven of the top 10 medical device manufacturers and startups and mid-sized companies, including the leading manufacturers of surgical robotics technologies and virtual reality applications for minimally invasive surgery.

In early November 2022, MedCrypt announced a $25M Series B funding round, followed by additional investment from Dexcom Ventures in January 2023. The company will use these funds to scale its cryptography, behavior monitoring, and vulnerability management products across various medical devices, such as glucose monitors and other diabetes devices.

Source: MedCrypt