Secure devices are intentionally designed to protect your users and your business.
Leverage a Secure Product Development Framework: threat model the device, design layered Risk Control Measures, score vulnerabilities with CVSS, maintain the SBOM and manage postmarket vulnerabilities, practiced step-by-step on a practice device.
Training a team or paying by purchase order? Email us
13 chapters · about 20–24 hours · SPDF, threat modeling, SBOM, CVSS, AAMI SW96
Top Medical Device Consulting 2026 MEDTECH Business ReviewHands-on with a practice device From design requirements to risk controls, with DQS answer reviews
- Threat
- Hackers
- Weakness
- Wireless
- Control
- Password
- Score
- Threat
- Unauthenticated command sent to the pump over Bluetooth
- Asset · CIA
- Integrity of dose settings
- Control
- Mutual authentication and signed commands, verified by penetration testing
- Score
The cybersecurity file exists. It just isn't securing the device.
- Security is bolted on at the end, to answer the reviewer's questions.
- Threats are listed as "hackers," with no threat model, assets or attack paths.
- The SBOM doesn't exist, or it was generated once and never maintained.
- Cybersecurity risk and safety risk live in separate files that never meet.
That isn't a lack of effort. It's the lack of a framework that connects threats, controls, testing and postmarket monitoring. This course teaches that framework.
How does your cybersecurity work hold up?
Answer for the most recent connected device your team worked on. Your answers stay on this page and aren't sent anywhere.
- Is cybersecurity built into design controls from the start, through a Secure Product Development Framework?
- Does your threat model identify assets, threats and attack paths for the whole system?
- Is every security control evaluated through reviews and analysis, as well as verified by penetration, fuzz, or vulnerability testing?
- Is your SBOM maintained and monitored for new vulnerabilities after release?
- Is cybersecurity risk linked to safety risk in your ISO 14971 file?
"Great material. Best I've ever seen in the industry."Mike Z.Senior Management Consultant
After the course, your team will be able to
Build security in from the start
Apply cybersecurity requirements across jurisdictions and integrate them into design controls with a Secure Product Development Framework.
See the device the way an attacker does
Threat model the system to identify assets, threats and vulnerabilities, then design a layered security architecture from network diagrams.
Score and control the risk
Assess risk through the CIA triad and CVSS, choose layered Risk Control Measures, and link cybersecurity risk to safety risk.
Prove it and keep it secure
Verify controls with penetration, fuzz and vulnerability testing, maintain the SBOM, and run coordinated vulnerability disclosure and secure updates.
Built for the people who design, secure and defend connected devices
See who it's for, and who it isn't
This course is for you if
- You are a software, firmware or systems engineer working on a connected device.
- You are a security professional new to medical devices and their regulations.
- You work in quality or regulatory and prepare cybersecurity documentation for submissions.
- You own the risk file and need cybersecurity and safety risk to work together.
- You are responsible for postmarket vulnerability management.
It is probably not for you if
- You want a one-hour overview of cybersecurity vocabulary.
- You are looking for documentation templates without changing how your team designs.
Four stages, from regulations to postmarket security
Hands-on work on a practice device throughout, with DQS answer reviews and quizzes to confirm you have it before moving on.
Regulations and framework
Cybersecurity guidance and regulations, how security fits product development, and the Secure Product Development Framework.
Chapters 1–3Threats and architecture
Threat modeling, network diagrams and a layered cybersecurity architecture.
Chapters 4–5Evaluate and SBOM
Cybersecurity evaluations, from penetration to fuzz testing, and the Software Bill of Materials.
Chapters 6–7Risk and postmarket
Cybersecurity Risk Management linked to safety risk, CVSS scoring, Risk Control Measures, and postmarket cybersecurity.
Chapters 8–13- 20–24 hrs of learning in 359 lessons
- Quizzes throughout, plus a final exam
- Practice device exercises with DQS answer reviews
- Downloadable course materials
Not sure yet? Start Chapter 1 free. You get access inside the course as a student, including the Chapter 1 quiz, before you decide.
Chapters marked "Your gap" match the answers you gave in the cybersecurity check.
- Cybersecurity Guidance and RegulationsYour gap
- Cybersecurity and Product Development OverviewYour gap
- Secure Product Development Framework (SPDF)Your gap
- Threat ModelingYour gap
- Network Diagrams and Cybersecurity ArchitectureYour gap
- Cybersecurity EvaluationsYour gap
- Software Bill of Materials (SBOM)Your gap
- Cybersecurity Risk ManagementYour gap
- Safety Risk Management OverviewYour gap
- Cybersecurity Risk Management, ContinuedYour gap
- Common Vulnerability Scoring System (CVSS)Your gap
- Cybersecurity Risk Control MeasuresYour gap
- Postmarket CybersecurityYour gap
Security is a team effort. Train the team on one framework.
When engineering, security, quality and regulatory share the same framework, threats are modeled early, controls are verified, and the submission tells one consistent story.
- A shared vocabularyOne way to describe threats, assets, vulnerabilities and controls across every product.
- Pairs with the rest of the librarySafety Risk Management, Design and Development and Usability Engineering courses build on the same foundation.
- Impact your business positivelyInvestment in professional development is not a 'nice-to-have'. It has real, tangible benefits.Get the white paper
Dr. John Salvato
John has spent more than 30 years in medical device and automotive quality and regulatory work. Since founding DQS in 2017 he has helped device makers move from single-use devices to connected, cybersecurity-enabled products, and defended that work with agencies and regulatory bodies.
"What we offer is capability-focused training. We understand the regulation, but we are also going to teach you how to implement it smartly."
Questions people ask
Can I try it before I buy?
How much time does it take?
Do I need a security background?
How does it connect to ISO 14971?
Does it cover SBOMs and postmarket requirements?
Make security part of the design, not an afterthought.
Learn a cybersecurity framework your team can defend in every design review, audit and submission.
$1,500 · self-paced · start today
Training a team or paying by purchase order? Email us