--- title: "Live MedTech Pulse - FDA, CISA & Funding Feed" description: "Daily pulse of MedTech: FDA 510(k) clearances, device recalls, CISA medical cyber advisories, trial registrations and venture funding rounds." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://medtechlaunchguide.com/#org", "name": "MedTech Launch Guide", "url": "https://medtechlaunchguide.com", "logo": "https://medtechlaunchguide.com/favicon.png", "description": "Editorial intelligence platform for MedTech founders and investors - funding, regulation, cybersecurity, and survival.", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "description": "Medical device cybersecurity specialists - 250+ FDA premarket cybersecurity submissions." } }, { "@type": "WebSite", "@id": "https://medtechlaunchguide.com/#site", "url": "https://medtechlaunchguide.com", "name": "MedTech Launch Guide", "description": "Live MedTech funding rounds, FDA clearances, recalls, M&A, founder sentiment and cybersecurity guidance.", "publisher": { "@id": "https://medtechlaunchguide.com/#org" }, "inLanguage": "en" }, { "@type": "Dataset", "@id": "https://medtechlaunchguide.com/#funding-dataset", "name": "MedTech Funding Rounds", "description": "Curated MedTech funding rounds aggregated daily from public news sources, including company, stage, amount, lead investor and date.", "url": "https://medtechlaunchguide.com/#funding", "keywords": [ "MedTech", "funding rounds", "venture capital", "medical devices", "Series A", "Series B" ], "creator": { "@id": "https://medtechlaunchguide.com/#org" }, "license": "https://creativecommons.org/licenses/by/4.0/", "isAccessibleForFree": true, "temporalCoverage": "2025/.." }, { "@type": "Dataset", "@id": "https://medtechlaunchguide.com/#intel-dataset", "name": "MedTech Live Intelligence", "description": "Daily-refreshed feed of FDA 510(k) clearances, FDA medical device recalls, CISA medical advisories, ClinicalTrials.gov device-trial registrations, MedTech M&A, founder sentiment, hiring signals and public-market prints.", "url": "https://medtechlaunchguide.com/#intel", "keywords": [ "FDA 510(k)", "medical device recalls", "CISA medical advisories", "clinical trials", "MedTech M&A" ], "creator": { "@id": "https://medtechlaunchguide.com/#org" }, "isAccessibleForFree": true, "temporalCoverage": "2025/.." }, { "@type": "ItemList", "name": "MedTech Founder Resources", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Pitch deck teardown for MedTech founders", "url": "https://medtechlaunchguide.com/#pitch" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity budget calculator (FDA 2026 guidance)", "url": "https://medtechlaunchguide.com/#cyber" }, { "@type": "ListItem", "position": 3, "name": "Why MedTech startups fail - post-mortems", "url": "https://medtechlaunchguide.com/#failure" }, { "@type": "ListItem", "position": 4, "name": "Go-to-market playbook", "url": "https://medtechlaunchguide.com/#playbook" } ] } ] } --- [Skip to content](#main) [ MedTech Launch Guide Education Hub for Founders ](/) [Roadmap](/roadmap) [Topics](/topics) Tools [Pulse](/pulse)Search ⌘K[Start Here](/start) Search ⌘K In partnership with Blue Goat Cyber # The pulse of _MedTech_ capital, regulation & survival. Funding rounds decoded, pitch deck teardowns, cybersecurity budgets that pass FDA scrutiny, and the un-glamorous post-mortems behind 90% of MedTech failures. Built for founders and the investors who back them. [Read the latest brief](#funding)[Cybersecurity budget calculator](#cyber) Live data sources openFDA · CISA · ClinicalTrials.gov FDA cyber guidance Feb 3, 2026 final Refreshed Daily, automated ![A surgical instrument with an overlaid ECG waveform and financial chart lines](/assets/hero-medtech-b6SDooMA.jpg) From the guidance "FDA may refuse to accept a premarket submission that does not include the cybersecurity information described in this guidance." \- FDA, _Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions_, final guidance issued 3 Feb 2026 01 - Capital Markets ## The rounds that _moved_ the field this quarter. Live tape of recent MedTech funding - extracted from public news via Firecrawl + AI. Click refresh to pull the latest deals. Refresh live dataUpdated 9/15/2026, 6:40:17 AM Primer · what each round is actually buying Click a stage to see its regulatory, clinical & commercial drivers Unlike SaaS, MedTech rounds aren't sized to revenue - they're sized to the next _de-risking event_ (predicate confirmed, FIH read-out, FDA clearance, first paying hospital). Investors price the round based on what milestone the cash unlocks. Use this as a yardstick before benchmarking the live tape below. Pre-Seed 5–10% dil. $250K – $1.5M Prove the clinical insight is real. Founder + 1–2 hires, bench experiments, IP filing. Unlock milestone Provisional patent + signed letters of intent from 3 KOLs. Open explainer → Seed 15–25% dil. $1.5M – $5M Build the working prototype, run cadaver / animal studies, draft the Pre-Sub. Unlock milestone FDA Pre-Sub meeting held, predicate device confirmed. Open explainer → Series A 20–30% dil. $8M – $20M First-in-human, design freeze, V&V testing, eSTAR submission package. Unlock milestone 510(k) / De Novo submission filed with cyber package complete. Open explainer → Series B 15–25% dil. $20M – $60M FDA clearance in hand, commercial launch, payor coverage, EU CE Mark. Unlock milestone First $1M ARR + signed coverage with a regional payor or IDN. Open explainer → Series C+ 10–20% dil. $50M – $200M+ Scale sales force, indication expansion, international distribution, or pre-IPO. Unlock milestone $10M+ ARR, multiple cleared SKUs, path to profitability or exit. Open explainer → Round purpose ### Pick a stage to see what the cash actually buys. Each stage card opens an explainer with the regulatory, clinical and commercial drivers investors expect that round to deliver - plus the most common way founders blow it. Pre-SeedSeedSeries ASeries BSeries C+ Know what each round is buying? Five adaptive scenarios, tailored to your device category. [Take the quiz](/quiz) Investor glossary · ten terms every medtech founder hears in their first pitch [Full glossary →](/glossary) Capital and clearance vocabulary collide in medtech. These are the terms that decide whether a term sheet, a 510(k) plan or a board update lands the way you intended. Dilution Ownership % The reduction in existing shareholders' ownership percentage when new shares are issued. A $5M seed at a $20M post-money values founders' stock at 75% - that 25% is the dilution. Compounds across rounds; a typical medtech founder team holds 10–25% by Series B. De-risking milestone Why this round exists A specific, verifiable event that materially lowers technical, regulatory or commercial risk - and unlocks the next round at a higher valuation. Examples: predicate confirmed via Pre-Sub, FIH read-out, FDA clearance, first paid hospital deployment. Investors price rounds on what milestone the cash buys. Predicate FDA · 510(k) A legally marketed medical device that your 510(k) submission claims substantial equivalence to. Choosing a predicate determines your indication for use, performance testing burden and review timeline. The 'most cleared' predicate is rarely the most defensible one. eSTAR FDA submission format Electronic Submission Template And Resource - FDA's mandatory interactive PDF template for 510(k) submissions (and most De Novos). Built-in completeness checks reduce Refuse-to-Accept bounces. Not a software platform; a structured form you fill out and upload via the CDRH Customer Collaboration Portal. Pre-money / Post-money Valuation Pre-money is the company's value before new capital comes in; post-money is pre-money plus the new round. A $5M raise at $15M pre = $20M post, and the new investor owns 25% ($5M / $20M). Always confirm which one a term sheet quotes - the difference is real ownership. Pro-rata rights Follow-on protection Contractual right for an existing investor to participate in future rounds at the same proportional ownership. Most seed funds insist on it; aggressive Series A leads sometimes try to strip it. Matters because medtech requires multiple capital injections before clearance. Liquidation preference Exit waterfall The multiple of invested capital a preferred shareholder gets paid before common stock at exit. 1× non-participating is founder-friendly; 2× participating means investors take 2× their money plus their pro-rata share of the rest. Stacks across rounds - model the waterfall before signing. Burn multiple Capital efficiency Net cash burned ÷ net new ARR over the same period. Pre-revenue medtechs use a modified version: cash burned per de-risking milestone hit. Investors at Series B+ benchmark burn multiple to decide whether the next round is an extension or a step-up. Bridge round Between priced rounds Convertible note or SAFE raised between priced rounds - typically to extend runway to a missed milestone (FDA delay, slower-than-modelled enrollment). Often signals a down-round risk; sophisticated founders structure bridges with caps that protect against punitive conversion. Strategic vs financial investor Cap table mix Financial investors (VC, growth equity) optimise for IRR and exit. Strategics (J&J, Medtronic, Stryker venture arms) optimise for product line gaps and pre-emption. Strategics on the cap table early can deter competing acquirers later - useful sometimes, value-destroying others. Filter by stage All 20 Pre-Seed 5 Seed 6 Series A 2 Series B 1 Series C+ 0 Company Round Raised Lead Date Tandem Health AI-powered healthcare Series B $100M Scaleup Europe Fund, managed by EQT Group September 14, 2026 Nara Health pre-seed and seed rounds $14 million Khosla Ventures \- Astek Diagnostics speed up antibiotic testing seed $750K \- \- Scopia Surgical AI-powered navigation software for minimally invasive robotic surgery Pre-Seed CAD $2.65 million \- \- Lupin Dental dental robotics Series A €15M \- \- Epsilon Health \- $27.6M \- \- Implicity \- $40M \- \- Aisel Health operating system (OS) pre-Seed €1.7 million \- \- scan.com \- £220M \- \- Elucid AI-powered heart disease diagnostics \- $55 million \- 3 days ago juli health AI-powered digital health platform seed funding $3.8 million \- \- AccuLine AI-powered heart disease diagnostics \- $55 million \- \- Scopia Surgical AI-powered navigation software for robotic surgery pre-seed funding $2.65 million CAD Anges Québec and Linearis Ventures \- Enginprime Medical Series A Financing Round $12M Qiming Venture Partners \- Shape Memory Medical medical device convertible note financing $10M August Global Partners \- Aurenar medical device seed funding $5.7 million \- \- Pairidex bioscience seed funding $4.89 million \- \- Omme men's digital health platform Seed $4.8M \- \- Hope Care Health digital health seed investment €4.8 million \- February Tross healthcare infrastructure pre-seed round $400,000 All In Capital \- Sector benchmarks We publish only verifiable rounds (left). For aggregated sector totals and multiples, go to the primary sources below. - [ SVB Healthcare Investments & Exits Quarterly device & dx funding totals ](https://www.svb.com/trends-insights/reports/healthcare-investments-and-exits-report/) - [ Rock Health Digital Health Funding US digital health round-by-round ](https://rockhealth.com/insights/) - [ PitchBook MedTech Reports Subscription · sector multiples ](https://pitchbook.com/news/reports) - [ CB Insights State of Digital Health Global trend lines ](https://www.cbinsights.com/research/report/digital-health-report/) 02 - Live Intelligence ## Four official feeds, _refreshed daily_. FDA clearances, recalls, CISA medical-device advisories, and new clinical trial starts, pulled straight from government APIs and refreshed every morning at 06:10 UTC, alongside a live public-market strip for the large-cap MedTech names. All feeds current Scheduled daily 06:10 UTC · newest record fetched 6h ago FDA clearances · 6h ago FDA recalls · 6h ago CISA advisories · 6h ago Device trials · 6h ago Public tape · 6h ago How to read this Official API Straight from a government API. Fields are as the agency published them. Public Tape ABT $103.09 ▼ 4.84% BDX $182.91 ▼ 0.99% BSX $45.05 ▼ 5.75% DXCM $84.68 ▼ 3.66% EW $85.52 ▼ 4.87% ISRG $377.94 ▲ 3.07% MDT $93.80 ▼ 0.39% SYK $281.87 ▼ 7.01% FDA 510(k) clearancesOfficial API openFDA 6h ago 6 [ Electrical Muscle Stimulator (AST-105DJ, AST-105EJ, AST- 105BJ, AST-105GJ, AST-303J, AST-309J, AST-310J;AST-300Q, AST-300Q-A, AST-500B; AST-500G, AST-500F; AST-500N; AST- 500C, AST- 500K, AST-500A; AST-300E, AST-500M, AST- 500U, AST- 500D; AST- 500E.) Shenzhen Osto Medical Technology Co.,Ltd 2026-09-06 ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K261131)[ KCS rTMS Therapy System (Transcranial Magnetic Stimulator) (MetaStim 100, MetaStim 100A) Fidelity BioPharma Co. 2026-09-06 ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K260396)[ LipoSurg ARTIST NOUVAG AG 2026-09-05 ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K254135)[ FreezeSpray TA Cryosurgery, Inc. 2026-09-05 ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K261684)[ Gastric Alimetry Alimetry , Ltd. 2026-09-04 ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K262292)[ 3D-RD-S Radiopharmaceutical Imaging & Dosimetry, LLC 2026-09-04 ](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K262060) FDA recallsOfficial API openFDA 6h ago 6 POWERSEAL 5 MM (in diameter) 23 CM (long), Curved Jaw Sealer & Divider, Double Action. GEI / Electrosurgical, cutting & coagulation & accessories Olympus Corporation of the Americas - Potential labeling deficiency in which an outer shelf box is incorrectly labeled as a 37-cm device. 2026-08-18 Baxter Novum IQ Syringe Pump, Model Number 40800BAXUS Baxter Healthcare Corporation - A software issue that may occur during a Volume/Time (VOT) multi-syringe infusion when a syringe reaches empty and is replaced while a Volume To Be Infused (VTBI) remains. 2026-08-11 Baxter Novum IQ Syringe Pump, Loaner, Model Number 40800BAXUSL Baxter Healthcare Corporation - A software issue that may occur during a Volume/Time (VOT) multi-syringe infusion when a syringe reaches empty and is replaced while a Volume To Be Infused (VTBI) remains. 2026-08-11 Power-Trialysis Short-Term Straight Dialysis Catheter, REF: 5605150; Power-Trialysis Short-Term Straight Dialysis Catheter, REF: 5605200; Power-Trialysis Short-Term Straight Dialysis Catheter, REF: 5605240; Power-Trialysis Short-Term Straight Dialysis Catheter, REF: 5605300; Bard Access Systems, Inc. - this is a downstream recall of class I recall RES 98777 2026-08-10 DuoGlide Short-Term Straight Dialysis Catheter, REF: 5625150; DuoGlide Short-Term Straight Dialysis Catheter, REF: 5625200; DuoGlide Short-Term Straight Dialysis Catheter, REF: 5625240; DuoGlide Short-Term Straight Dialysis Catheter, REF: 5625300; DuoGlide Short-Term Curved E Bard Access Systems, Inc. - this is a downstream recall of class I recall RES 98777 2026-08-10 5008X Standard HD Pre-Flush Standard Blood Tubing Set Part Number 03-5110-6 Fresenius Medical Care Renal Therapies Group, LLC - Heightened probability of blood leak from the connection between the Arterial Alpha Clip and the main line or pump segment. Leak during treatment may lead to blood loss and hypovolemia. 2026-08-10 CISA medical advisoriesOfficial API CISA.gov 6h ago 6 [ Orthanc DICOM Server Orthanc DICOM Low ](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-02)[ NextGen Healthcare Mirth Connect NextGen Healthcare Low ](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01)[ Flow Neuroscience FL-100 Flow Neuroscience Low ](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01)[ Pulsetto Vagus Nerve Stimulator Pulsetto Vagus Low ](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-02)[ Mira Hormone Monitor, Mira Android App Mira Hormone Low ](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01)[ Medixant RadiAnt DICOM Medixant RadiAnt Low ](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-218-01) New device trialsOfficial API ClinicalTrials.gov 6h ago 6 [ \[Trial of device that is not approved or cleared by the U.S. FDA\] \[Redacted\] \- ](https://clinicaltrials.gov/study/NCT07801443)[ HERMES: Quality and Safety of Advanced Respiratory Support During Patient Transport Medipol University - Acute Respiratory Failure, Respiratory Insufficiency, Respiratory Distress 2026-12-31 ](https://clinicaltrials.gov/study/NCT07805603)[ Development and Validation of the Indian Asthma Care Bundle for Reducing Readmission and Improving Post-hospitalisation Care After Discharge From Hospital Due to an Acute Asthma Exacerbation Ahmedabad University - Asthma Exacerbation, Asthma (Diagnosis), Exacerbations NA ](https://clinicaltrials.gov/study/NCT07815730)[ Efficacy of Myopia-control Lenses in a Population of Young Adults : the OPTIMA Study Fondation Ophtalmologique Adolphe de Rothschild - Myopia NA ](https://clinicaltrials.gov/study/NCT07804043)[ Diabetes Prevention Through Genetics, Familial History and Behavior Change Morehouse School of Medicine - Prediabetes, Weight Loss PHASE2, PHASE3 ](https://clinicaltrials.gov/study/NCT07815236)[ Safety and Clinical Performance of the Next-Generation SAFESYNC Transcatheter Heart Valve in Patients With Severe Aortic Stenosis Braile Biomedica Ind. Com. e Repr. Ltda. - Aortic Stenosis Senile, Aortic Stenosis Symptomatic, Aortic Stenosis NA ](https://clinicaltrials.gov/study/NCT07806409) Sector benchmarks 0 We don't publish aggregate sector totals we can't verify. For benchmarks, see [SVB Healthcare Investments & Exits](https://www.svb.com/trends-insights/reports/healthcare-investments-and-exits-report/), [Rock Health](https://rockhealth.com/insights/), and [CB Insights State of Digital Health](https://www.cbinsights.com/research/report/digital-health-report/). Live large-cap MedTech prints appear in the Public Tape strip above. Sources · openFDA · ClinicalTrials.gov · CISA · Yahoo Finance · Refreshed daily 06:10 UTC 03 - Pitch Deck ## The 10-slide MedTech deck that _closes_. Synthesised from teardowns of 60+ MedTech decks that closed between $1.5M and $60M. Total run-time: under 8 minutes. View through the lens of SeedSeries ASeries B Series A cyber line item $200K – $500K 2–3% of raise "Our cybersecurity package is reviewer-ready. Submission risk is contained." Talking points - eSTAR cyber sections drafted: SBOM, threat model, SPDF, architecture views. - Pre-Sub on cyber complete - FDA feedback documented. - Hospital MDS2 questionnaire pre-filled to compress procurement cycles. [Full stage budget →](#cyber) - Reverse-engineered from successful raises - Reviewed by ex-FDA reviewers - Mapped to Blue Goat security checklist [Get the Figma template →](#newsletter) 1. 01 ### The Clinical Problem Frame the unmet need with a real patient and a real number - incidence, mortality, cost burden. Series A Pair the patient story with bottom-up incidence × cost burden you've validated with KOLs. 30s 2. 02 ### Solution & Mechanism Photo of the device. One sentence on how it works. Resist the urge to teach physiology. Series A Show the production-intent device + a diagram of the connectivity / data flow. Cyber angle Overlay a trust boundary on the data-flow diagram. Investors love seeing where PHI lives. 45s 3. 03 ### Evidence to Date Bench data, animal data, first-in-human. Investors discount unsubstantiated claims by 80%. Series A First-in-human results + IRB-approved feasibility study readout. 60s 4. 04 ### Regulatory Path 510(k), De Novo, or PMA - with predicate device, expected timeline, and pre-sub history. Series A Pre-Sub feedback in hand. eSTAR-ready package in build. Cyber angle State that your eSTAR cyber sections (SBOM, threat model, SPDF) are drafted. 45s 5. 05 ### Reimbursement Strategy CPT code path, payor conversations, and your number for cost-per-procedure savings. Series A Payor advisory board + economic model with 3 payor archetypes. 60s 6. 06 ### Market Sizing - Bottom Up Procedures × ASP × penetration. Top-down TAMs get instantly dismissed. Series A Add geographic + indication-expansion layers with timing. 45s 7. 07 ### Competitive Landscape 2x2 with axes investors actually care about. Show the moat - IP, data, switching cost. Series A IP claims granted/pending. Data moat starting to compound. Cyber angle Add a security-posture row: most incumbents still ship without an SBOM. 30s 8. 08 ### Go-To-Market KOLs, IDN strategy, and the first 10 hospitals. Specificity wins. Series A First 10 target hospitals + which IDNs they belong to. Cyber angle Mention the hospital MDS2 / HIPAA security questionnaire is pre-filled and ready. 45s 9. 09 ### Team Ex-operators from the field you're disrupting. Highlight prior FDA clearances. Series A Full exec bench except CCO. Prior FDA clearances on the team. Cyber angle Fractional CISO or named security lead. Cyber owner appears on the org chart. 30s 10. 10 ### Financials & The Ask 18-24 months of runway, milestones tied to value inflections, post-money expectation. Series A $8–20M to clearance + early commercial. Milestones tied to submission. Cyber angle Break out the $200–500K cyber line tied to submission milestone. 60s 04 - Regulatory Strategy ## Pick the right _FDA pathway_, build the right evidence. 510(k), De Novo, PMA, HDE, Breakthrough, Pre-Sub - each pathway has a different timeline, a different bar, and a different cybersecurity package. Synthesised from [Blue Goat Cyber's regulatory playbook](https://bluegoatcyber.com/regulatory-strategy). ### Six routes to market All trigger Section 524B 510(k) Premarket Notification 3–9 mo· ~6 mo avg Best for Most Class II devices that are substantially equivalent to a legally marketed predicate. Examples Patient monitors, infusion pumps, connected wearables, imaging software (CADx). Cyber lift Section 524B applies in full. Reviewers expect SPDF evidence, machine-readable SBOM, threat model, and postmarket plan in the eSTAR. Fee: Standard / small-business user fees apply. De Novo Risk-Based Classification Request 9–12+ mo· Establishes a new classification Best for Novel low-to-moderate-risk devices (Class I/II) with no valid predicate. Examples First-of-kind digital therapeutics, novel SaMD diagnostics, AI-enabled triage tools. Cyber lift Cyber expectations equal to 510(k); novelty draws extra reviewer attention to threat-model rigor and ML/AI threats. Fee: Higher than 510(k); small-business waivers available. PMA Premarket Approval 12–24+ mo· Highest bar Best for Class III devices - those supporting/sustaining human life or presenting potential unreasonable risk. Examples Implantable cardiac devices, neurostimulators, life-supporting infusion systems, certain AI/ML diagnostics. Cyber lift Highest bar. Manual penetration testing, deep traceability (threat → requirement → design control → V&V), and an active CVD program are effectively required. Fee: Highest user-fee tier. HDE Humanitarian Device Exemption 75-day review· After HUD designation Best for Devices for rare conditions affecting < 8,000 US patients/yr. Requires HUD designation first. Examples Pediatric implants for rare disorders, niche neuromodulation devices. Cyber lift Cyber requirements still apply. Connectivity profile + patient-safety impact drive evidence depth. Fee: Reduced. Breakthrough Breakthrough Devices Program Sprint reviews· Still goes through 510(k) / De Novo / PMA Best for Devices providing more effective treatment/diagnosis of life-threatening or irreversibly debilitating conditions. Examples Novel cancer dx, first-line stroke detection AI, BCI devices for paralysis. Cyber lift Speed does not relax cyber expectations. Build SPDF + threat model + SBOM in parallel - late additions cause schedule slips. Fee: Same as underlying pathway; benefits include sprint discussions and priority review. Pre-Sub Pre-Submission (Q-Sub) Free 60–75 days· Written feedback + meeting Best for Getting written FDA feedback on your strategy before you file. Free and underused. Examples Used at concept, before pivotal study, before any pathway above. Cyber lift Best place to align on cybersecurity evidence depth, AI/ML threat scope, and acceptable VEX justifications before you commit to a build plan. Fee: Free. ### Class I, II, III - what changes for cyber Risk-based Class I Low risk Controls General controls (registration, listing, GMP, labeling). Typical pathway Most are 510(k)-exempt; some require 510(k). Cyber lift Section 524B still applies if the device meets the cyber-device definition. Even minimal connectivity (Bluetooth, USB sync) triggers full cyber expectations. Examples Bandages, manual stethoscopes, basic surgical instruments, some software accessories. Class II Moderate risk Controls General + special controls (performance standards, post-market surveillance, labeling). Typical pathway Typically 510(k); some De Novo. Cyber lift Default for connected medical devices. SPDF + machine-readable SBOM + threat model + pen test + postmarket plan all expected. Examples Infusion pumps, patient monitors, most SaMD, imaging software, connected diagnostics. Class III High risk / life-supporting Controls Premarket approval (PMA) - highest level of regulatory control. Typical pathway PMA (rarely HDE for rare-disease versions). Cyber lift Highest expectations. Reviewers want exhaustive traceability, manual exploit-driven testing, AI/ML threat coverage, and a mature CVD program. Examples Implantable defibrillators, neurostimulators, replacement heart valves, certain implantable AI systems. ### Cybersecurity artifact crosswalk When each artifact starts, iterates, ships Artifact Scope Classify Pre-Sub Evidence Test Submit Postmarket SPDF (Secure Product Development Framework) S • • • ✓ • Asset & Interface Inventory S • ✓ Threat Model (STRIDE + Attack Trees) S • • • ✓ • Cybersecurity Risk Assessment (AAMI SW96) S • • ✓ • Machine-Readable SBOM (CycloneDX 1.5) S • ✓ • Vulnerability Exploitability eXchange (VEX) S • ✓ • Security Architecture & Control Mapping S ✓ Penetration Test Report S ✓ Fuzz / Protocol Test Results S ✓ Cybersecurity Labeling (IFU) S ✓ • Coordinated Vulnerability Disclosure (CVD) S • ✓ • Postmarket Cybersecurity Plan S • ✓ • S Start drafting • Iterate / expand ✓ Finalize / submit ### The 5-step plan Sequencing regulatory + cyber The single biggest mistake: treating cybersecurity as a final-mile add-on. Every pathway above rewards teams that build evidence in parallel with engineering. 1. STEP 01 Confirm device classification Use the FDA product classification database and the MDCC crosswalk to confirm your product code, regulation number, and class. Class drives pathway, evidence depth, and timeline. [FDA Product Classification DB](https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfPCD/classification.cfm) 2. STEP 02 Decide pathway 510(k) if a defensible predicate exists. De Novo if novel and low-to-moderate risk. PMA if Class III. Consider Breakthrough designation if eligible - file Q-Sub feedback before committing. [FDA Breakthrough Devices Program](https://www.fda.gov/medical-devices/how-study-and-market-your-device/breakthrough-devices-program) 3. STEP 03 Map cybersecurity to the pathway Every pathway above triggers Section 524B cyber-device requirements. Build the SPDF, SBOM, threat model, and postmarket plan in parallel with engineering - not at the end. [FDA Cybersecurity Guidance (Feb 2026)](https://www.fda.gov/media/119933/download) 4. STEP 04 Use a Pre-Sub to de-risk A Q-Sub is the cheapest reviewer feedback you'll ever get. Validate the cybersecurity scope, AI/ML threat coverage, and acceptable VEX justifications before you build evidence at scale. [FDA Q-Sub Program](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/requests-feedback-and-meetings-medical-device-submissions-q-submission-program) 5. STEP 05 Build the eSTAR-ready package Cybersecurity risk assessment, threat model, SBOM (CycloneDX 1.5), pen test report, postmarket plan, labeling. Each artifact has a specific eSTAR slot. [FDA eSTAR Templates](https://www.fda.gov/medical-devices/how-study-and-market-your-device/estar-program) [ Recommended tool MDCC Crosswalk Map FDA, EU MDR, IEC 62304, AAMI TIR57 and ISO 14971 in one view - essential for multi-jurisdiction submissions. ](https://mdccrosswalk.com/)[ Need a strategy session? Book a regulatory + cyber review 30 minutes with a senior medical-device security engineer. We'll review your device profile, recommend the pathway, and identify the evidence you need. ](https://bluegoatcyber.com/regulatory-strategy) 05 - Cybersecurity Budget · Sponsored by Blue Goat Cyber ## How much _cyber budget_ to put in your raise. A stage-by-stage guide for connected Class II MedTech founders - drawn from [Blue Goat Cyber's 250+ FDA submissions](https://bluegoatcyber.com/funding-cybersecurity) (100% success rate). Class III adds 30–50%; pure SaMD shaves ~20%. The short answer Allocate 2–5% of every round to cybersecurity through Series A - then transition to 1–2% of opex as a continuous postmarket program from Series B onward. Underspending here is the single most common reason FDA submissions stall - and the most expensive line item to backfill late. Where the money goes You buy expertise first, tools second, people last. Penetration testing and compliance audits stay outsourced at every stage - FDA and hospital buyers expect third-party independence. ### Round by round 5 stages Pre-Seed Raise: $250K – $1.5M $8K – $75K 3–5% of raise Concept validation, founding team, IP, early prototypes. Where the money goes - ~100% External consulting (advisory hours)No hires, no tooling licenses What to buy - → Architecture / threat-modeling working session - → Initial cyber risk register tied to ISO 14971 - → Tech-choice review (connectivity, OS, crypto) - → Pre-Sub (Q-Sub) cybersecurity strategy memo Skip Full pen test · SBOM tooling stack · dedicated CISO We've baked cybersecurity into our architecture before writing the first line of firmware - here's the threat model. Linked resources - [Playbook · Threat modeling for medical devices ](https://bluegoatcyber.com/services/medical-device-cybersecurity/threat-modeling/) - [Standard · ISO 14971 risk management ](https://www.iso.org/standard/72704.html) - [Regulator · FDA Pre-Sub (Q-Sub) program ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/requests-feedback-and-meetings-medical-device-submissions-q-submission-program) Seed Raise: $1.5M – $5M $45K – $200K 3–4% of raise MVP build, first clinical engagement, regulatory pathway lock-in. Where the money goes - ~78% Consulting + pen testing~70–80% of the line - ~18% SBOM / SCA tooling license~15–20% - ~4% Contingency What to buy - → STRIDE-per-element threat model + AAMI TIR57 - → First-pass SBOM (CycloneDX 1.5) + tooling - → Pre-Sub submission with cybersecurity scope - → Lightweight gray-box pen test of MVP - → SPDF skeleton + SDLC integration Skip Full PSIRT · bug bounty · expensive GRC platform Our Pre-Sub returned no cybersecurity questions - the FDA agrees with our approach. Linked resources - [Standard · AAMI TIR57 cyber risk ](https://www.aami.org/) - [Tool · SBOM (CycloneDX) format ](https://cyclonedx.org/) - [Playbook · Blue Goat funding-cyber playbook ](https://bluegoatcyber.com/funding-cybersecurity) - [Regulator · FDA premarket cyber guidance ](https://www.fda.gov/media/119933/download) Inflection point Series A Raise: $8M – $20M $160K – $600K 2–3% of raise Pivotal study, 510(k) / De Novo / PMA prep, scale engineering. Where the money goes - ~85% Consulting + testingManual pen test is the largest single line, often $50–150K+ - ~10% Tooling - ~5% Fractional security lead What to buy - → Full eSTAR-ready cybersecurity package - → Manual exploit-driven pen test (device + app + cloud + wireless) - → Coordinated Vulnerability Disclosure program - → Cybersecurity labeling + MDS² prep - → Submission support + reviewer-letter response Skip Full-time CISO before postmarket scale Our cybersecurity package is reviewer-ready. Submission risk is contained. Linked resources - [Playbook · Premarket cyber package (Blue Goat) ](https://bluegoatcyber.com/services/medical-device-cybersecurity/fda-premarket-cybersecurity/) - [Regulator · FDA eSTAR submission templates ](https://www.fda.gov/medical-devices/how-study-and-market-your-device/estar-program) - [Playbook · Medical device pen testing ](https://bluegoatcyber.com/services/medical-device-cybersecurity/penetration-testing/) - [Playbook · Regulatory strategy ](https://bluegoatcyber.com/regulatory-strategy) Series B Raise: $20M – $60M $200K – $1.2M / yr 1–2% of raise Commercialization, postmarket scale-up, EU + global expansion. Where the money goes - ~40% First in-house hire (PSIRT lead)~$150–250K loaded - ~20% Monitoring tooling - ~20% Recurring testing / retests - ~20% Consulting + external surge What to buy - → Operational PSIRT (in-house lead + external surge) - → Continuous SBOM monitoring + VEX program - → Annual third-party pen test + per-release retests - → EU MDR cybersecurity package (harmonized w/ FDA) - → Tabletop exercises + IR readiness Skip Over-tooling - process maturity beats SaaS sprawl We have a postmarket cyber program with measurable SLAs - hospital procurement teams trust us. Linked resources - [Playbook · Postmarket cyber management ](https://bluegoatcyber.com/services/medical-device-cybersecurity/postmarket-cybersecurity/) - [Regulator · EU MDR (Reg. 2017/745) ](https://health.ec.europa.eu/medical-devices-sector_en) - [Tool · Health-ISAC threat intel ](https://h-isac.org/) - [Standard · ISO 13485 QMS ](https://www.iso.org/iso-13485-medical-devices.html) Series C+ Raise: $60M+ $1.5M – $5M+ / yr 1–1.5% of annual opex Multi-product portfolio, M&A, IPO-readiness. Where the money goes - ~55% Product security org (salaries)CISO + engineers - ~20% Platforms / toolingGRC, ML monitoring, bug bounty - ~15% Audit + cert feesSOC 2, HITRUST, CRA - ~10% Testing + bounty payouts What to buy - → Full-time CISO + product security org - → M&A cybersecurity due diligence capability - → Continuous compliance (FDA, EU MDR, CRA, HITRUST, SOC 2) - → ML-specific monitoring for AI-enabled SaMD - → Bug bounty program Skip Vanity certifications outside customer ask We're an acquirer's dream - clean posture, no skeletons in the SBOM. Linked resources - [Playbook · M&A cyber due diligence ](https://bluegoatcyber.com/services/cybersecurity-due-diligence/) - [Regulator · EU Cyber Resilience Act ](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) - [Playbook · Regulatory strategy index ](https://bluegoatcyber.com/regulatory-strategy) ### Five budget rules How to spend RULE 01 Budget cyber as a % of the raise 2–5% through Series A. Cheapest insurance against a 6-month FDA deficiency loop. - [Playbook Funding-stage cyber budget guide ](https://bluegoatcyber.com/funding-cybersecurity) - [Regulator FDA premarket cyber guidance ](https://www.fda.gov/media/119933/download) RULE 02 Front-load architecture decisions A $20K threat model in Pre-Seed prevents a $400K firmware re-architecture in Series A. - [Playbook Threat modeling service ](https://bluegoatcyber.com/services/medical-device-cybersecurity/threat-modeling/) - [Standard AAMI TIR57 ](https://www.aami.org/) RULE 03 Use the FDA Pre-Sub - it's free A Q-Sub with cyber scope returns written FDA feedback in ~75 days. Highest-leverage spend in fundraising. - [Regulator FDA Q-Sub program ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/requests-feedback-and-meetings-medical-device-submissions-q-submission-program) - [Playbook Blue Goat regulatory strategy ](https://bluegoatcyber.com/regulatory-strategy) RULE 04 Buy outcomes, not headcount, until Series B Fractional / contract expertise tied to deliverables (threat model, pen test, SBOM, CVD). - [Playbook Premarket cyber package ](https://bluegoatcyber.com/services/medical-device-cybersecurity/fda-premarket-cybersecurity/) - [Playbook Pen testing for devices ](https://bluegoatcyber.com/services/medical-device-cybersecurity/penetration-testing/) RULE 05 Don't double-pay for FDA + EU evidence One harmonized package - same SBOM, same threat model, two filings. Saves 4–6 months. - [Regulator EU MDR overview ](https://health.ec.europa.eu/medical-devices-sector_en) - [Playbook Postmarket cyber (harmonized) ](https://bluegoatcyber.com/services/medical-device-cybersecurity/postmarket-cybersecurity/) Don't say "We're spending $300K on a penetration test and SBOM tooling." Say "We're investing 3% of the round in the cybersecurity package FD&C Act Section 524B already requires of a cyber device submission - removing submission risk and making us procurement-ready for large hospital systems on day one." Take this into your board meeting. Pick your stage and device type, and get a one-page worksheet with the line items to fund, what to defer, and the Section 524B evidence a reviewer will look for. Prints to a single page. [Open the worksheet](/worksheets/cyber-budget) Raising right now? 30 minutes with a senior medical device security engineer. We'll size the right cyber line item for your round, device class and timeline. [Book with Blue Goat](https://bluegoatcyber.com/funding-cybersecurity) [Source: Blue Goat Cyber - Funding-Stage Cybersecurity Budget Guide](https://bluegoatcyber.com/funding-cybersecurity) 06 - Post-mortem ## Why most MedTech startups never reach _durable revenue_. A working taxonomy of failure modes drawn from public MedTech wind-downs, FDA refuse-to-accept patterns and CB Insights / Silicon Valley Bank post-mortems. Read it before your next board meeting. № 01 Commercial ### Reimbursement never materialised Founders build a device that works clinically but lacks a CPT code, payor coverage, or a credible cost-savings story. The hospital says yes; the CFO says no. № 02 Regulatory ### Regulatory pathway misjudged A 510(k) becomes a De Novo. A De Novo becomes a PMA. Each escalation adds 18+ months and $5–15M unplanned burn. № 03 Clinical ### Clinical evidence too thin to scale Pilot data convinced the seed round but cannot survive a peer-reviewed publication or a multi-site RCT. Sales stall at 12 hospitals. № 04 Cyber ### Cybersecurity blocked clearance Since the FD&C Act Section 524B took effect (Mar 2023) and the FDA cyber guidance was finalised (Sep 2023, refreshed Feb 2026), connected-device submissions without an SBOM, threat model and SPDF evidence are subject to Refuse-to-Accept. № 05 Team ### Founder-CEO outgrew the role The brilliant clinician-founder cannot scale ops, hire VPs, or manage a 60-person org. Boards routinely delay the transition past the point of no return. № 06 Finance ### Capital efficiency collapsed Burn rate doubled before milestones were hit. Down rounds become unavoidable; the cap table cannibalises future raises. № 07 IP ### IP exposed by a single weak claim Late-stage diligence discovers prior art, a defective continuation, or freedom-to-operate gaps in core geographies. The takeaway Three of the top four killers - reimbursement, regulatory, cyber - are _solvable in pre-seed_ with the right diligence. Synthesised from CB Insights MedTech post-mortems, SVB Healthcare Investments & Exits reports, and FDA refuse-to-accept patterns. 09 - Programs & Resources ## The MedTech founder's _starter kit_. A curated index of the accelerators, regulators, communities, books and vendors that meaningfully move a MedTech startup forward. Featured listings are sponsors or programs we've personally vetted with founders. ### Accelerators & Programs Apply early - the application alone forces narrative discipline. [ #### MedTech Innovator (Global) Global · Free · Equity-free World's largest non-dilutive accelerator for MedTech. 4-month curriculum, 750+ alumni, $7M+ awarded annually. ](https://medtechinnovator.org/)[ #### Y Combinator US · 7% equity $500K standard deal. Strong alumni network, but MedTech is a minority of the batch - pick partners with hardware/regulated experience. ](https://www.ycombinator.com/companies?industry=Healthcare)[ #### Techstars Healthcare US/Global · 6% equity · $120K Multiple healthcare-focused programs (Mayo Clinic, Cedars-Sinai, UnitedHealthcare). Strong hospital channel access. ](https://www.techstars.com/accelerators)[ #### JLABS (Johnson & Johnson Innovation) Global · Lab access No-strings-attached lab residencies in 13 cities. Excellent for hardware founders who need wet-lab + electronics space. ](https://jnjinnovation.com/jlabs)[ #### Plug and Play Health Global · Equity-free Corporate-sponsored matchmaking with hospital systems and pharma. Less curriculum, more pilot opportunities. ](https://www.plugandplaytechcenter.com/health/) ### Regulatory Bodies & Standards Bookmark all of these. Read the guidance documents, not the summaries. [ #### FDA CDRH (Devices) USA 510(k), De Novo, PMA pathways. Use the Pre-Sub program - it's free and returns written feedback in ~75 days. ](https://www.fda.gov/medical-devices)[ #### FDA Pre-Sub (Q-Sub) Program USA · Free The single highest-leverage spend in your fundraising lifecycle, because it's $0. ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/requests-feedback-and-meetings-medical-device-submissions-q-submission-program)[ #### FDA Cybersecurity Guidance (Feb 2026) PDF Mandatory cybersecurity content for premarket submissions of connected devices. SBOM, threat model, postmarket plan. ](https://www.fda.gov/media/119933/download)[ #### EU MDR (Regulation 2017/745) EU European medical device regulation. Notified Body conformity assessment + UDI + EUDAMED. ](https://health.ec.europa.eu/medical-devices-sector_en)[ #### TGA (Therapeutic Goods Administration) Australia Australia's regulator. Often the fastest first market for APAC-headquartered startups. ](https://www.tga.gov.au/products/medical-devices)[ #### PMDA (Japan) Japan Japan's MHLW pathway. Long, structured, predictable - and a meaningful market for high-end devices. ](https://www.pmda.go.jp/english/)[ #### NMPA (China) China China's regulator. Local clinical evidence usually required - partner with a CRO early. ](https://english.nmpa.gov.cn)[ #### ISO 13485 (QMS) Standard Quality management system standard. Required for CE mark, expected by FDA, demanded by acquirers. ](https://www.iso.org/iso-13485-medical-devices.html)[ #### ISO 14971 (Risk Mgmt) Standard Risk management for medical devices. Maps directly to your design history file and cyber risk register. ](https://www.iso.org/standard/72704.html)[ #### AAMI TIR57 (Cyber) Standard Cybersecurity risk management for medical devices - the technical companion to FDA's premarket guidance. ](https://www.aami.org/) ### Communities & Networks Where MedTech founders actually compare notes. [ #### AdvaMed Trade body US trade association. Best-in-class regulatory and reimbursement policy briefs, plus working groups on cybersecurity and AI/ML. ](https://www.advamed.org/)[ #### MedTech Europe Trade body · EU European industry voice. Track EU MDR implementation guidance and EU AI Act medical device carve-outs here. ](https://www.medtecheurope.org/)[ #### Stanford Biodesign Methodology The reference methodology for need identification. Free curriculum, fellowship program, and global network of practitioners. ](https://biodesign.stanford.edu/)[ #### AAMI Standards Association for the Advancement of Medical Instrumentation. Standards body + community for QA, regulatory and cyber engineers. ](https://www.aami.org/)[ #### Health-ISAC (Cyber) Cyber Information Sharing & Analysis Center for healthcare cybersecurity. Threat intel feed worth subscribing to from Series B onward. ](https://h-isac.org/)[ #### r/medicaldevices Community Surprisingly high-signal subreddit. Regulatory questions get real answers from practicing engineers. ](https://www.reddit.com/r/medicaldevices/) ### Books & Long-Form Reading The dozen texts every MedTech founder eventually reads. [ #### Biodesign: The Process of Innovating Medical Technologies Zenios, Makower, Yock Stanford Biodesign textbook. The canonical end-to-end MedTech founder reference. ](https://www.cambridge.org/highereducation/books/biodesign/F71806C33C7BFA8C1B9A5660F68B2858)[ #### The Lean Startup Eric Ries Yes, generic - but the build-measure-learn loop is essential discipline for hardware founders who default to over-building. ](https://theleanstartup.com/)[ #### Crossing the Chasm Geoffrey Moore Required reading for the IDN sales motion. The chasm between early adopter clinicians and mainstream procurement is real. ](https://www.harpercollins.com/products/crossing-the-chasm-3rd-edition-geoffrey-a-moore)[ #### Medical Device Marketing Terri Wells Practical reimbursement, KOL, and channel strategy. Dated examples, timeless framework. ](https://www.amazon.com/Medical-Device-Marketing-Strategies-Tactics/dp/0982294700)[ #### Hacking Healthcare Trotter & Uhlman Decent primer on the US healthcare delivery system, payors, and where MedTech actually fits in the workflow. ](https://www.oreilly.com/library/view/hacking-healthcare/9781449305635/)[ #### FDA's CDRH Learn (free courses) Free · Video Free FDA-produced video tutorials on every submission pathway. Watch before your Pre-Sub. ](https://www.fda.gov/training-and-continuing-education/cdrh-learn) ### Tools, Tooling & Vendors Categorically the things you'll buy or trial - not endorsements. [ #### Greenlight Guru (eQMS) QMS Purpose-built electronic QMS for medical device companies. Most-used choice for ISO 13485 by Series A. ](https://www.greenlight.guru/)[ #### Jama Connect (Requirements) ALM Requirements + traceability + V&V evidence. Painful learning curve, but auditors love the output. ](https://www.jamasoftware.com/)[ #### Medcrypt (Device Security) Cyber Cybersecurity tooling specifically for medical devices - SBOM, vuln management, cryptographic agility. ](https://www.medcrypt.com/)[ #### Blue Goat Cyber Cyber · Services Senior medical device cybersecurity services - threat modelling, pen testing, FDA premarket package, postmarket. ](https://bluegoatcyber.com/)[ #### CycloneDX (SBOM format) Open standard Open-source SBOM standard. The format FDA expects. Generate it from your CI pipeline, not by hand. ](https://cyclonedx.org/)[ #### Crunchbase Pro / PitchBook Data Investor research and round benchmarking. Pricey, worth it for Series A onward. ](https://www.crunchbase.com/) MedTech Launch Guide The independent education hub for medtech innovators bringing devices to the US market - paired with a live pulse of what FDA, CMS, CISA and investors are doing right now. Sponsored by Blue Goat Cyber Pulse - [Live Pulse](/pulse) - [Funding Tape](/pulse#funding) - [Pitch Decks](/pulse#pitch) - [Cybersecurity](/pulse#cyber) - [Post-mortems](/pulse#failure) Learn - [Founder Roadmap](/roadmap) - [Start here: build my plan](/start) - [Regulatory & Quality](/roadmap/regulatory-pathway) - [Funding & Grants](/pulse#funding) - [Clinical evidence](/roadmap/clinical-evidence) - [Reimbursement](/roadmap/reimbursement) - [Topics & tools](/topics) - [Funding quiz](/quiz) - [Investor Directory](/investors) - [FDA user fees & calculator](/mdufa-fees) - [Cyber budget worksheet](/worksheets/cyber-budget) - [Glossary](/glossary) - [Weekly Brief](/#newsletter) Company - [About](/about) - [Editorial policy](/editorial) - [Tip line · Contact](/contact) - [Privacy](/privacy) - [Terms](/terms) Sister sites [MedTech Terms ↗](https://medtechterms.com) medtechterms.com The full MedTech dictionary. Sourced definitions with a page per term, A-Z and category indexes, learning paths, and side-by-side comparisons. [A-Z index →](https://medtechterms.com/a-z)[Categories →](https://medtechterms.com/categories)[Learning paths →](https://medtechterms.com/paths)[Compare terms →](https://medtechterms.com/compare) [Blue Goat Cyber ↗](https://bluegoatcyber.com) bluegoatcyber.com Medical device cybersecurity practice. Threat modeling, SBOMs, penetration testing, and FDA premarket and postmarket submission support. [FDA premarket cyber →](https://bluegoatcyber.com/services/medical-device-cybersecurity/fda-premarket-cybersecurity/)[Penetration testing →](https://bluegoatcyber.com/services/medical-device-cybersecurity/penetration-testing/)[Threat modeling →](https://bluegoatcyber.com/services/medical-device-cybersecurity/threat-modeling/)[Site index →](https://bluegoatcyber.com/site-index) © 2026 MedTech Launch Guide. Editorial independence is non-negotiable. Sponsored content is clearly labelled.