Qualysec launches Medysec for medical tech security

Qualysec Technologies has launched Medysec, a cybersecurity practice focused on the medical-technology sector. The new unit is aimed at medical-device manufacturers, MedTech businesses and HealthTech companies.

It has also created a dedicated website for the practice, separating its medical-device security work from its broader cybersecurity offering. Medysec will cover connected medical devices, software as a medical device and other healthcare technology products that rely on software, networks, cloud systems and third-party components.

The move reflects growing attention on security risks in medical technology as devices and platforms become more connected. Manufacturers are under pressure to address cybersecurity across the product lifecycle, including development, premarket preparation, deployment, vulnerability management and postmarket monitoring.

The practice will focus on security issues that differ from those in conventional corporate IT settings. In medical technology, manufacturers must consider the interaction between software, firmware, hardware, wireless links, companion applications, cloud services and external software components, each of which can create potential points of exposure.

The growing use of third-party software and open-source components has added to those demands. Manufacturers must track which software components are present in products, identify known vulnerabilities and put in place processes to assess and manage related risks.

A software bill of materials, or SBOM, is one of the tools increasingly used in that process. Its value depends on how well it is tied to vulnerability monitoring, security assessment and remediation, particularly for manufacturers dealing with regulatory cybersecurity expectations in the United States and Europe.

Service focus

Medysec's services include medical-device penetration testing, application and cloud penetration testing, security assessments for software as a medical device, SBOM support, threat modelling, vulnerability management and support related to US Food and Drug Administration cybersecurity requirements before and after products reach the market.

The practice will also support companies responding to FDA cybersecurity deficiency letters. The offering extends to healthcare compliance requirements including HIPAA and the European Union's Medical Device Regulation and In Vitro Diagnostic Regulation.

The new unit is being led by Qualysec's senior management, including Founder and Chief Executive Officer Chandan Kumar Sahoo and Co-Founder and Chief Operating Officer Pabitra Kumar Sahoo. The initiative is intended to create a more specialised setting for customers in the medical-technology market, rather than placing those services within a general cybersecurity portfolio.

That approach comes as regulators and manufacturers place greater emphasis on how security is managed not only in a single application or device, but across an entire product environment. A vulnerability in firmware, a connected application or a supporting cloud service can affect the broader system in which a medical product operates.

Regulatory pressure

For device makers, cybersecurity documentation, threat modelling, vulnerability assessment and postmarket monitoring have become part of broader product planning. The pressure is especially acute for businesses selling into tightly regulated healthcare markets, where evidence of security processes may form part of product approvals and ongoing compliance work.

Medysec has been built around that mix of technical and regulatory requirements. Qualysec positions the practice as a way for medical-technology teams to identify weaknesses, understand how those weaknesses could affect a product and its supporting environment, and decide how vulnerabilities should be managed.

Healthcare and medical-device cybersecurity has drawn increasing global attention as connected devices become more common in patient care, diagnostics and remote monitoring. Unlike many traditional IT systems, medical devices may combine hardware, embedded software, mobile apps and cloud-based services, creating layered risk that can persist after a product has entered the market.

Manufacturers are also being asked to maintain clearer visibility into software dependencies throughout a device's operational life. That has made postmarket surveillance and vulnerability handling a more central part of cybersecurity planning in the sector.

Commenting on the launch, Chandan Kumar Sahoo, Founder and Chief Executive Officer of Qualysec Technologies, said: "Medysec is more than a new name or website. Medysec was created with a clear purpose: to give medical device and HealthTech companies a focused partner for cybersecurity. We want to help teams understand their risks, meet regulatory needs, and build security into their products from the start. With Medysec, we are bringing our cybersecurity expertise closer to the needs of the medical technology industry."