Kayten supports medical device manufacturers with security engineering for connected devices — from hardware root of trust and signed firmware updates to certificate lifecycle management for entire device fleets.
Connected medical devices — from infusion pumps and patient monitoring to diagnostic equipment with cloud connectivity — process sensitive health data and directly affect patient care. Cybersecurity is not an add-on here; it is a prerequisite for approval and safe operation.
Kayten brings many years of embedded security experience from regulated industries into your product development. Our methodology from the automotive domain (ISO/SAE 21434) — from threat analysis to evidence generation — transfers structurally to the requirements of IEC 81001-5-1 and medical device cybersecurity guidance.
We support you across the entire product lifecycle — from security risk analysis in the concept phase, through the implementation of hardware-backed security mechanisms, to secure update and identity management in the field.
Systematic threat analysis and security risk assessment for connected medical devices — methodically aligned with your ISO 14971 risk management and your IEC 62304 software lifecycle.
Anchoring device security in hardware: protected key storage with kHSM and a verified boot chain with kFBL, so that only authentic firmware ever runs on your medical device.
Design and implementation of secure update mechanisms with signature verification and rollback protection based on kFBL — update capability is a core requirement of current regulations such as FDA Section 524B and MDCG 2019-16.
Unique cryptographic device identities, secure provisioning, and certificate management across the entire lifecycle — from manufacturing to fleet operation in hospitals, supported by our KSP solution.
Encryption of sensitive health data at rest and in transit, hardware-backed key management, and access control on the embedded system — as a technical building block for your data protection evidence.
Securing communication between medical device, gateway, and cloud backend through mutual authentication, encrypted channels, and robust, well-tested protocol implementations.
kHSM, kFBL, and KSP address recurring security requirements of connected medical devices — as integrable building blocks that fit into your device architecture and your lifecycle processes.
Medical devices often remain in the field for well over a decade. Regulatory requirements such as FDA Section 524B require manufacturers to demonstrate processes and technical capabilities to remediate vulnerabilities through updates — without compromising device integrity.
The kFBL Secure Flash Bootloader verifies firmware signatures before activation, prevents downgrades to known-vulnerable versions, and provides the technical foundation for a controlled, documentable update process.
Connected medical devices process and store sensitive health data — often on resource-constrained platforms and in environments where physical access to the device cannot be ruled out.
The kHSM provides a hardware-based root of trust: keys never leave the protected environment, and cryptographic operations run isolated from application code — the foundation for data protection and device integrity.
Once devices are operated at scale in hospitals or home-care settings, managing identities and certificates becomes an operational challenge — from onboarding new devices to certificate rollover during live operation.
The Kayten Security Platform (KSP) automates provisioning, certificate issuance, and renewal for device fleets, giving manufacturers and operators a traceable view of the identity status of every device.
We help you translate cybersecurity requirements from standards and guidance documents into concrete technical measures and robust evidence. Responsibility for approval and conformity assessment remains with you as the manufacturer — we deliver the security engineering and the technical documentation that supports your submissions.
Software lifecycle processes for medical device software. We integrate security activities into your existing development and maintenance processes rather than building parallel structures.
Security lifecycle for health software and health IT systems. We support you with activities such as threat modeling, vulnerability management, and security testing in line with the standard.
Risk management for medical devices. We methodically interlink security risk analysis with your safety risk management so that interactions between safety and security become visible.
Cybersecurity requirements of the Medical Device Regulation and the associated MDCG guidance. We support you with the technical implementation and the corresponding evidence documentation.
Requirements for cybersecurity plans, SBOMs, and update capability for "cyber devices" in the US submission process. We deliver the technical building blocks and evidence for your submission.
Since 2007 we have been building embedded security for industries where evidence generation and auditability are part of daily work — automotive, defense, and industrial. We bring this way of working into medical technology projects.
With kHSM, kFBL, and KSP we rely on proven, integrable building blocks for root of trust, secure updates, and identity management — instead of starting every project from scratch.
From functional safety (ISO 26262) we know how safety and security argumentation interlock — a way of thinking that the ISO 14971 world of medical technology immediately recognizes.
Whether you are starting a new development or securing an existing platform: our experts will analyze your device's security architecture with you and outline concrete paths to regulatorily robust cybersecurity.
