Managing Cybersecurity Across the MedTech Lifecycle
00:02 Good morning or good afternoon, depending on where you are. Hello and welcome. My name is Rick Biros, and I am the content director and founder of MedTech Intelligence, and I will be your host and moderator for today's webinar, Managing Cybersecurity Across the MedTech Lifecycle, which is sponsored by PTC. Today's event is more of a conversation between two industry experts and will be quite interesting. During the webinar, you will have the opportunity to ask questions.
00:33 To submit your text questions for today's presenters, type your questions into the questions panel. You may send your questions at any time during the presentation, and I will be reading your questions out loud to the speakers as they come in, so this broadcast will truly be interactive. Also, we have two polls for you to participate in during the webinar, and you'll be prompted for those. We encourage everyone to participate. It just makes the pr- the, the webinar that much more interesting and more interactive.
01:05 You are listening in using your computer's speaker system by default. If you have problems with the audio, please try to increase the computer's volume, and if you're still having issues, please log out and reconnect. The broadcast is being recorded, and everyone will receive an email with a link to the archived recording within twenty-four hours. On that same email will be a link to an industry survey that MedTech Intelligence is, is conducting, as well as a link to PTC's new cybersecurity landing page with a
01:40 wealth of information. Now, let me introduce our speakers. First, we have René Zofall, is, who is the global MedTech industry advisor at PTC with a, with deep expertise in guiding MedTech companies through dig- digital transformation and regulatory complexity. Since joining PTC in two thousand and ten, he has led the MedTech practice in Germany and serves as chair of PTC's Healthcare Executive Advisory Council.
02:15 René has contributed to the Acatech Industry four point oh Maturity Index. He brings extensive experience in digital thread, digital twins, and AI, helping organizations enhance innovation, streamline o- operations, and ensure compliance across the product life cycle. Joining him is Alex Wirth, who is the chief security strategist at MedCrip, where he provides strategic vision and guides critical security decisions for the
02:48 company and its customers. An advocate for compliance, privacy, cybersecurity, and patient safety in healthcare, he brings more than thirty years of international industry experience. His background includes engineering leadership and business development roles with Siemens, Analogic, Mitra, ADFA, and Simat-- S-Sym- Sympatec. Sorry about that, Axel. Axel holds a BSEE degree from the University of Applied Sciences in Düsseldorf and
03:23 a MSEM from the Gordon Institute at Tufts University. Gentlemen, let me turn things over to you now. Yeah. Thank you very much, Rick, and also a very warm welcome, from my side here. Thank you very much for joining the conversation here, and I'm really excited to discuss with, Axel that, I think very increasing, topic or the topic that's really getting increasing importance for medical device manufacturers.
03:56 So, and as Rick said, we will have the conversational, but I, again, also encourage you to, to enter your questions, so that we can take those while we are discussing, that topic. So, Axel, you have been introduced already, but, you know, let's start a little bit with based on you have spent, as Rick also said, more than thirty years in the medical device industry, with more than half of it focusing on security. You had the leadership roles at Siemens,
04:27 Symantec, and now with MedCrip. So when, when you're looking back, what aspect of the field that we are to- discussing today would have been most surprising ten years ago? So let's look at it, you know, from two sides. I think on the positive side, we need to recognize the, the concerted effort that, international regulators, industry organizations, standards organizations,
04:57 hospitals, device manufacturers, have made over the last, you know, ten, fifteen years. No matter where you look, you see cybersecurity work, that is being done. New regulations, updated regulations, new standards that come out to help the industry dealing with cybersecurity and guiding their way on cybersecurity. And in fact, cybersecurity has now become a market entry gate that's similar
05:27 to, product safety, clinical efficacy, and so forth, right? So if you have a medical device product that contains software, you won't be able to get it in the market without complying with regulations and standard. Specifically, manufacturers have now adopted, security lifecycle management and, secure engineering practices, and we see those practices become more
05:58 mature and, and certainly, increasingly manufacturers are able to produce and demonstrate that they are producing secure products. So there was a positive side. On, on the other side, we still need to ask ourselves what has taken us so long, right? I mean, the first time I encountered a security incident with a medical device was back in, 2009. It was a malware worm that infected over 100 medication cabinets, shut down medication
06:33 delivery, automated medication delivery, across multiple locations in a hospital chain. In 2014, five years after that, FDA released its, first pre-market cybersecurity guidance. And now in 2026, we're still looking at an industry that is evolving, right? As I said initially, we've done a lot, but there's still a lot to be done. And if I would encounter myself from 15 years ago,
07:09 I would probably be surprised how slow the progress has been, right? 15 years ago, I f- I thought as an industry in 10 years we will have solved the problem. Yeah. Now we're still in the midst of solving it. Yeah. And it's interesting that you also already mentioned, the, the hospitals. I just recently read an article where there was a very impressive number, I believe, where I think it was stated that the majority of, buyers in hospitals would reject,
07:40 a medical device being impl- installed in their hospital facilities because of cybersecurity risks that they cannot, That, where they are afraid of, right? And so when we talk already about hospitals, so if you were to describe the current state of med tech cybersecurity to that, hospital, is it the CIO, the CISO, in a single sentence, what would that be?
08:11 Yeah. So, so to your point, right? Hospitals are certainly on the forefront of security. You know, that is where the attacks happen. Hospitals have a reputation among cyber adversaries that they have a fairly weak security, in- infrastructure. They have valuable data. They have pressure to restore operations in case of a ransomware attack and,
08:44 are more likely to pay because of that pressure. So they're clearly, they're clearly a target, right? Yes, they're improving their cybersecurity, position and, maybe in the EU the situation is, is a little better because there's more pressure on hospitals through the NIS2 regulation. But, if we look at the US here, the, the, the backbone of hospital security strategy is still the HIPAA security rule, which has only seen minor
09:18 updates in the last 25 years, right? And, and in my opinion, it is just not mature enough to withstand s- today, today's attacks. Yeah. So, s- cyber adversaries are becoming smarter. They use tooling. They work together. They coordinate attacks. They use AI-based tooling to develop exploits, so they discover vulnerabilities. And, and again, as an industry, we are still largely compliance-driven, and,
09:53 and follow regulations like HIPAA and, and NIS2, which is not necessarily, in my opinion, a good security strategy. So back to your question, what advice would I give? I think hospitals need to buckle up. I think things are gonna get worse- before they get better. Yeah. Yeah. Yeah. So let's, let's do it a little bit interactive here. And before we go into the details about a lot of topics, that, you already mentioned, of, so let's see what the biggest
10:26 challenges are for our audience today. So we have prepared a little poll, and, we would be interested in your view. So maybe you could select out of those, five topics that we have listed here, maybe up to three, where you see for your organization, the biggest challenge in managing cybersecurity. And, you know, take it really from the complete product life cycle of a product, so considering pre-market, but also, post-market, phases of your, of your product.
11:07 And I guess we, keep that, keep that open for 60, 90 seconds or so.
11:41 So they're still coming. Um- I'll keep it open for about another- 15 seconds or so. Yeah. Cool. So But, maybe we can, already start because I think, the There won't be a big shift in the, in the priorities. Axel, when you, when you look at the results here, is that surprising for you or is that also what you see in, in your conversations with med tech and even
12:12 maybe with, with hospitals? Yeah, I mean, I, I think this confirms what, what our general experience is across the industry, right? Mm-hmm. Yeah. Regulations, and then we'll be talking about more detail later, but regulations are, are changing. Yeah. Regulations are complex across the globe. Yeah. And keeping pace with that and operating in a global med tech market with multiple regulators, is, is
12:45 a challenge, right? And translate regulation to actual security decisions and actions, and provide evidence that you did so correctly, is I think a co- a complex challenge. Yeah, and then I think the, the, the first one here, defining ownership, yeah, I do believe that that is the, you know, the non-technical, the cultural side of the problem. Whether it is about, developing a culture of security as you develop products,
13:21 whether it is about convincing your leadership that security has to become a strategic priority, those are all things I think on the non-technical side that organizations are struggling with. Yeah. It's interesting that this, this management topic comes up, right? And then I was really surprised. I, I, I was at an, at an, med tech e- event, earlier this year, and there was one executive from a medical device manufacturer. He said for the first time they needed to, postpone the release of a
13:56 product because of, additional cybersecurity risks, and they also run out of budget for the, for the project. So that's At least I would say the awareness is, is definitely increasing. But still, I believe there's maybe some, some more work to do, especially when it comes to, to ownership accountability in, in organizations. So maybe let's see if we can, touch, most of the topics that we also ask, right? Maybe start with the regulatory landscape as you already made that point, and it seems the,
14:27 the most pressing challenge for most of the, the attendees here. So we see when we look into, let's say, look into the two major regions, the, Europe and North America, so both FDA and also the European, Union, they are driving higher cybersecurity standards for medical devices, yet their approaches differ, right? So where do organizations, in your view, most commonly encounter challenges when attempting
14:57 to satisfy both sets of requirements? Yeah, to your point, I mean, yes, there are regulatory differences between global markets and the EU and the US being the, the two biggest ones. We certainly see those differences, but I think there are actually more similarities if you take the right approach, right? Yeah. Both regulations, both regulatory frameworks are taking a risk-based approach to security and put a strong emphasis on concept such as
15:32 secure development lifecycle, SDLC, such as post-market security surveillance and management, right? So those are strategic similarities. On the tactical, on the practical level, yes, there are differences. For example, FDA is very prescriptive in their guidance. As an example, FDA very specifically spells out their requirement for a software bill of materials, SBOM, and even defines what they expect to see in an SBOM,
16:07 whereas in Europe, under MDR and IVDR, it is more a general requirements a- as, called out as a list of subcomponents. Yeah. So it's, not as detailed in, in, its definition. Also Europe is putting more focus on, bringing old devices up to today's security standards, right? MDR emphasizes, that processes, documentation,
16:39 implementation of older products should be brought up to today's level over time, right? That's a- Yeah dreaded MXF in IEC 81001-5-1 that, that MDR, refers to as a harmonized standard, right? So that is an area where there's a specific focus in the, in the EU. Now, as a manufacturer, how do you deal with that? I think you need to look at the similarities.
17:09 You need to maximize and optimize your processes, to, to focus on those similarities and then spend minimal separate efforts for your respective markets, EU, US, Australia, you name it. And then, try to again minimize, that, that difference. And in, in some cases it can be as simple as the name of a document. Mm-hmm. Right. But, yes, there are some specifics you
17:41 need to deal with in language, in materials, supplied. But again, to my initial point, I think there are probably more similarities than there are differences. Yeah. Yeah. Now, recently we have we, we also have seen that, s- some significant changes at the, at the FDA, regulations re- especially with regard to the quality management system regulations, QMSR, which, in
18:12 general affecting, organizations but also cybersecurity in specific. Mm-hmm. In your view, what are the key changes that we as an industry need to be aware of? So let's, let's start with the second part. Let's start with, cybersecurity. Right. So we already mentioned FDA released their first cybersecurity guidance, back in two thousand and fourteen. Back then it was a nine-page high-level document. The most recent, update in two thousand twenty-six in February, is now sixty-four
18:46 pages, right? So clearly there's much more meat in, in, in, in the guidance document. There's a much higher bar, set by the FDA. But also what is important to understand is that the legal context of cybersecurity has changed over the last ten years. Initially, FDA, enforced security as an extension of the traditional quality management system regulation.
19:18 And it was an extension of patient safety, right? That was the context of cybersecurity. Now, what happened here in the US, on a, on a legal level is that in two thousand twenty-three, the so-called Food, Drug, and Cosmetics Act was released. And in that act, Section five twenty-four B actually gave FDA the legal authority to enforce cybersecurity. In fact, it established the legal mandate for FDA to enforce security.
19:53 What that means is that, all of the sudden FDA can enforce cybersecurity period rather than just focus on the safety aspect on cybersecurity. And we've seen that reflected in the two thousand twenty-five update, of the pre-market guidance. And then in two thousand twenty-six, FDA moved to the, an ISO thirteen four eighty-five based quality system, which helped with the alignment across global markets.
20:24 The US was a little bit behind to where the other regulators were in terms of ISO thirteen four eighty-five adoption. So US is now more aligned with a few tweaks and exceptions. But also that then again, led to a two thousand twenty-six update of the cybersecurity pre-market guidance, to bring it in line with that new, quality system that the FDA has established. Yeah. Yeah. So we talked about, FDA.
20:57 I think for, for Europe, the, the situation is, is a bit different. I mean, you mentioned the NIS two already, but I think in Europe the cybersecurity requirements for the medical device industry, or the medical device as a product and the, the requirement to manage the associated risk within the device risk management process are governed by, you mentioned it al- also already, MDR, slash IVDR in annex, one, right?
21:27 But then we have also, when we look at it from an organizational perspective, so looking at cybersecurity from an organizational perspective, like, and then also include supply chain and the non-device product cybersecurity, those are governed by different regulations like I already mentioned, NIS two. We just, have now en- enforced the, the Cyber Resilience Act. And then also for AI-enabled devices, we have the European AI Act. So for example, an, an imaging device may be regulated on the MDR, but the associated
22:02 storage system may be then governed by CRA and, NIS two. So in your view, Axel, is there a risk that the growing number of regulations may also create a false sense of security, encouraging compliance-focused behavior rather than meaningful risk reduction? There is always a, a fine balance in cybersecurity, and that is a, a struggle not only in healthcare, not only in Europe, it's all industries a- across the globe, right?
22:35 On one end, especially in critical industry trees, we need regulation. We need standards so that we, you know, know which road to walk down, so to speak. But at the same time, regulations and standards enforce a compliance-oriented culture rather than a security, focused culture, right? And in several cases, there's actually a conflict between the two, that organizations
23:10 spend money, on becoming compliant, but not considering whether that, also means you're being secure, right? To put it a little bit in a, in a sarcastic tone, as a friend of mine once said, "You can only win in compliance if your enemy is the compliance auditor." In cybersecurity, that is unfortunately not true, right? Your enemy are cyber criminal organizations out, out of Russia.
23:40 They are, nation state, organizations out of North Korea, Iran, China, you name it, that are, after our infrastructure, after our intellectual property, and, and, and. And that creates a conflict, right? Because compliance implies a formal process and specific checkpoints. Yeah. Security requires to be nimble and change quickly, and that is a conflict, and we need to solve for that conflict.
24:10 Otherwise, we will never be able to become secure. So the approach I always recommend is actually a security-first approach. Think about how secure you need to be and how to build your security program, and then map that back to your compliance, requirements and your regulations rather than the, other way around. That way you lead with security and demonstrate compliance, but y- you retain that nimbleness and the
24:46 ability to adapt to change, that, that is required in security. Yeah. Yeah. Can we t- can we just, quickly talk about, the Cyber Resilience Ex- Act? I, I already mentioned that. And specifically I, I have a lot of conversation, I get a lot of, communication with also with med tech companies, asking, "So what, what does this mean for me?" And it's a really hot topic because it, went into enforcement, by, September, what was it, 11
25:18 with the first, reporting. But you know, medical device manufacturers, as we already discussed, operate within the frameworks of MDR and IVDR. But in your view, does the Cyber Resilience Act also introduce new requirements or duplicate existing obligations or create areas of overlap and potential conflict for manufacturers? Yeah, so you're right, right? CRA explicitly exclude already regulated
25:48 medical devices, right? They are already regulated under MDR. Dual regulation, creates, conflicts, disconnects unnecessary, dual work, dual reporting, and all those things. So typically regulators are smart and try to avoid that, as they have done in this case. But as you already mentioned, even if I'm a medical device manufacturer, there are a couple of scenarios where CRA may, apply. For example, I have combined or, different product lines-
26:24 Mm-hmm that are medical devices on one end and consumer devices such as personal health devices, on the other end. And all of a sudden I have some devices I need to get approved under MDR, other devices that need to comply with the Cyber Resilience Act. I mean, generally speaking, because CRA is the more recent regulation, it has actually established a higher bar on security, including a very aggressive timeline for
26:55 incident, and critical vulnerability disclosure. Uh- Mm-hmm 24-hour early warning reporting to the, ENISA, portal, then 72 hours for full notification, including details and, corrective, measures. And then depending on the product, the industry, 14 days to one month for a final report, right? That is a very aggressive timeline. You need to watch your infrastructure very closely and be able to report and collect
27:26 information very quickly. So clearly this affects many industries and on the periphery also the medical device industry. For example, again, if you're producing wellness apps, patient engagement platforms, tooling, to be used, like software tooling, connected hospital hardware, and, and, and, that typically doesn't require MDR certification, then for you CRA is in scope
27:57 with the reporting, as you said already, required as of Sep- September 11th, and then full compliance by December 2027. But also your supply chain, right, may contain CRA regulated, devices. Which means that your suppliers, your software suppliers chain, needs to be able to report to you if they have actively exploited or high risk vulnerabilities, and you have to have an in- process to take in these type of reports and respond to it.
28:31 And then lastly, your medical product, medical devices run on a supporting infrastructure. Mm-hmm. You may provide value-added cloud-based services, knowledge bases, maintenance systems, and, and, and that are all not part of the regulated medical device. And yes, then CRA applies. So clearly, again, even though regulated devices are excluded, it does not mean that
29:02 CRA does not apply to, device manufacturers. Which, which again speaks a little bit for a more holistic approach to, approaching, cybersecurity within an, within an organization, right? Yes. So Alex, before we go to the next, before we go to the next, topic or area, Rick, are there questions in the chat? Yes, there is.
29:34 Now let me click on it. All right. How do you see notified bodies and competent authorities expecting manufacturers to operationalize compliance when a cybersecurity event may be reportable under both CRA and MDR frameworks? So the hypothetical case, right? Let's, let's make it more specific and, and, and give an example.
30:08 A medical device manufacturer, has, has a security event, has a breach, infrastructure gets compromised, including their medical devices, but also including, their corporate infrastructure, their customer facing services and whatnot. And, and yes, in, in those cases, um- Multiple reporting venues may need to be followed.
30:38 CRA certainly because your infrastructure is impacted, your services may be impacted. MDR, maybe because devices that were in your production line, were incorrectly configured, got the wrong software, had computer viruses attached to their software and were shipped, right? Then you have a medical device, situation. Or your, your manufacturing capacity is impacted. You have to shut down, production lines.
31:09 Then you may have to notify about, product shortages. Even, even if your device itself is not software-based, it may be an accessory, it may be a pharmaceutical product. Certain products need to be reported, if there's production impact that leads to shortages in the market and, and, yeah, drop in supply to hospitals, because of the respective products or drugs criticality.
31:40 So multiple reporting is always on the table, in complex and broad, security situations. All right. One example I forgot to mention, if you are hosting patient data on behalf of your- Yeah customers, there is yet another reporting scenario- Mm-hmm where you may have to report, a breach under GDPR in, in the EU or under HIPAA here in the US, because it impacts, i-in the US, residents' data here in the US.
32:14 It's, specific to, what is called protected health information, PHI. Yeah. So very, very complex setup and a very complex, reporting framework, that manufacturers need to operate. So any further question, Rick? Not at this point. Okay. So then, let's change topic a little bit, because we, we already talked about that cybersecurity is, is more in a holistic
32:47 approach, and it not only concerns or shouldn't concern, organizations, pre-market, but it also, you know, post-market. They are also something that, the, the organizations have to, to focus on. So, for, for organizations that have not yet begun addressing these requirements that we discussed earlier, what in your view, Axel, would be the mo-most important first step?
33:18 I mean, obviously that depends where you are in your- Mm-hmm product development life cycle. But if you're still at the beginning, I think you do need to take the time, take a step back and outline your security requirements, your process needs- Yeah your security activities, your evidence, your documentation, and, and, and, so that you can build security into your development processes from the get-go.
33:49 Putting it aside now and get started and trying to figure it out later will increase the risk and will probably, result in more significant delays later on because, you need to do your homework after the fact and, and that may become a greater effort. You may have to go back and fix things. So certainly start as early as you can and make sure you have the required cybersecurity expertise, either on board, or under contract.
34:23 However, if you're already past that, if you're already, down the development track with your product, start as early as possible and look back and see what you missed. Did you miss any of the early cybersecurity activities as in, for example, defining your requirements, doing your threat modeling, and, and, and. I mean, one, one objection I, I always hear from manufacturers, they say, "Well, you know,
34:56 two or three years ago with our last product, that wasn't an issue. Why is it now? Because the regulations haven't changed significantly." as we discussed that A, it's not quite true. There were changes in regulations over the last two or three years. CRA was added in Europe to the mix. FDA pre-market guidance was updated, 2025 and 2026. So things are happening. But also we see regulators and, and notified bodies that do the approval raising their bar.
35:33 Things that they overlooked couple years ago, they are now rejecting products for, for. And so they now find them, unacceptable. They're basically saying, "Uh, 'Hey, industry, we gave you time to get up to speed. Now show us that you have taken the time and used it wisely.'" And for some, unfortunately, that's a, that's a painful wake up. Yeah. Yeah.
36:05 In, in your view, why should cybersecurity be managed as a, as a real life cycle discipline, so from product conception definition through retirement, rather than as a one-time activity prior to market release? So that is the good old, you know, security bolted on topic. Yeah, I don't think, and ba-based on my experience, that- That is a realistic approach. It's a high-risk approach.
36:35 It's an approach that's gonna cost a lot of time because you potentially get your products rejected. You end up with a less secure product. You end up with a product that is more difficult to maintain once it's out in the field. And, and, and, right? So start with your requirements and make it clear from the beginning. Define your security life cycle activities, the,
37:09 security steps you perform and how do you document, the outcome and the steps. And then demonstrate traceability, right? You need to demonstrate that not only you defined your security requirements and identified security risks and mitigated those, but also all the way to the end that you demonstrated through testing that those requirements were met and that the risk controls and mitigations you put in place do actually, what they were supposed to do as, as
37:43 in mitigate the risk. So you need to have demonstrated evidence that you not only have your security processes, but also that you're following those, processes. So just providing a final test report that shows that the device passed a level of security testing will not suffice, right? You need to have traceability all the way back to your security requirements. And then should you get through the regulatory gate and in the post-market, you need to
38:16 be able to demonstrate patch ability. You need to be able to monitor your devices in the field and provide updates. If that process wasn't thought through and designed into the device from the beginning, yes, you can still patch by sending your service technicians out with a USB thumb drive, but that is a very expensive process. So design for security from the get-go. Design for security maintainability from the get-go.
38:49 Yeah. Yeah. And then, I mean, especially when we also consider that nowadays, products are shipped as hardware, but the value and also the capabilities are defined by software, so we, we see more often and more regular updates on the software for the devices. I think that, that last point, that you just made is, is very, very important for, for manufacturers of, medical devices. So let's, let's ask our audience again.
39:21 We have, another poll and, we would, be interested to understand, which capabilities you think, to focus on within, let's say, the next maybe 12 to 18 months. Yeah, so especially with the focus on the cybersecurity capabilities, which are the, of the highest, priority for your organization. And you can also I think you can select, all that we have,
40:06 Maybe asking to Ri- Ask the question to Rick, are there any further questions in the chat? Hi, Rene. Not yet. Okay. And, I believe the poll is just one selection. Oh, yeah. Right. You're right. Yeah. We said- The first one- We said that choice. All right. Yeah. Right. Right. Okay. Yeah. We'll keep it open for another 45 seconds or so. Good to see some of the results coming in.
40:46 And I think the, the As of the current state of the response, I would say that's also some point, Axel, that you, that you already mentioned earlier, right? This end-to-end requirements and risk traceability, from your requirements, from your architecture into the maintenance of the product seems to be the priority for most of them. Is that something also that you, that you see when you have conversations with your, with your clients? That is in line with my observations, but that
41:19 is also a significant pain point, right? If you- Mm-hmm need to demonstrate traceability and y- you don't start that activity until the very end, you don't have the right connective tissue, so to speak- Yeah built into your processes, then it's gonna be extremely high effort to do so. Yeah. So, a lot of manual work, a lot of Excel spreadsheets that need to be cross-checked, and, and, and so. Yeah.
41:50 You can do it, but it will be painful. Yeah. Well, that's a perfect transition to our, to our next topic that we wanted to discuss is, you know, we talked about the complexity of the, of the regulations. We now understood also that the majority of the audience, is will focus on that, complete traceability. And so why is it becoming more difficult to manage, those, processes through, spreadsheet and then email alone?
42:22 And then what do you think, what are the most significant risks or gaps that arise from, continuing as we, as the industry, as we may, did so in the past? So using Excel, you mentioned that already, using email, whatever there is. Yeah. Yeah. I mean, that, that is, I think exactly the point, right? The high level of complexity in your security activities- Yeah asks for tooling, right? If you wanna be efficient, if you wanna do the right things right, you need
42:58 to have continual security processes through your entire life cycle. Yeah. We already talked about traceability. I think that's the, the prime example. Yeah. Right? You need to be able to trace from your initial requirements, your initial architecture, the identified risks, the implemented mitigations, through your software builds or materials, your vulnerability management process, your linkage between your security and safety risk management, all the way to
43:29 your final testing, right? You need to be able to demonstrate that as a continual, logical, piece of evidence. Yeah. And you need to maintain all of that through the device's useful life, right? Your device gets released, you maintain it for 5 to 10 years. It's got use in the hospital for 10 or more years, depending on the type of device. You still need to maintain it. You need to demonstrate that your device is secure and can remain secure.
44:04 So clearly, only the right tooling makes these security processes reproducible. Yeah. Everybody can be lucky once and design a secure product. But if you have multiple product lines and a long-term roadmap, you need to be able to do so every single time repeatedly, and you need to be able to demonstrate it, right? So- Yeah at the same time, we also know that regulators and notified
44:39 bodies are stepping up their game. They're also starting to use tooling. In the past then, I mean, you've seen those reams of paper that get submitted for device approval. They end up on the desk of a human reviewer, and that human reviewer, based on their experience, picks out certain areas, select samples, does some cross-checking, and, and, and. And then you get feedback based on that.
45:09 Yeah. But as those regulators and notified bodies are now starting to use AI-based systems- Yeah every single line of your submission will be scrutinized. Not saying that those AI-based systems will do everything correctly. Yeah. But you will get much more back, many more questions, higher volume of findings- Mm-hmm including certainly, false positives and false, false negatives, but you still need to respond to them and explain them. Yeah. So clearly, if you don't have the
45:43 tooling in place on your side, the tooling on the regulator and notified body side will overwhelm, overwhelm you. Yeah. Yeah. Very good. So before we wrap up, Rick, are there questions in the chat we need to take? No, there is not. I just sent out a, just a kind of a last call, text to everyone. So this is the time, that if you wanna ask a question to Rene or Axel,
46:17 now's the time to do it. So, let's see if there are questions coming in. Anyways, Axel, first of all, thank you very, very much for being with us today. So if, if, if I bring our discussion together, I think the strategic message is, is very clear. Cybersecurity and MedTech is no longer a technical side topic. It has become a board level priority.
46:47 It is a regulatory gate, and it also, a core element of patient safety and, and market access. So what we heard today, and to summarize that a little bit, is that both the FDA, Europe, but also the broader regulatory environment, are all moving toward the same principle, which is cybersecurity must be managed across the full product life cycle. So that means designing it in from the start, connecting requirements, risks,
47:20 architectures, evidence, software bill of materials, and post-market ni- signals, and also being able to demonstrate that discipline with confidence. So maybe my, my Really my final, my closing thought for, for you as the, as the audience, is don't treat cybersecurity as a compliance exercise, or, a final hurdle before submission, and that's also what Axel really, made very clear, I think.
47:51 Really treat it as a strategic capability, one that, protect, protects patients, but also builds a trust with regulators and the healthcare providers. It also enables innovation to reach the market more safely and, more predictably. So with that, again, thank you very much to all our attendees that, tuned in today. And again, Axel, thank you very much for sharing your perspective with us today.
48:21 Thank you. Thank you. And if you don't have any other question, Rick, then I think we can also close a little bit earlier. Yeah. Yes. We, we did get another question coming in, and, the question is, "Do you have a frequently asked questions available that I can share with the rest of my cybersecurity team?" And, you know, I just wanted to mention that in the follow-up email That everyone will receive that has a recording of the, of this broadcast, there is a link to a PTC,
48:53 landing page that is, kind of a wealth of information, about this topic. But, Rene is You know, you're more familiar with this page than I am. You wanna talk a little bit about it? Well, yeah, as you said, we are, we are just started to build that up, couple of, couple of weeks ago, but, we could also add a frequently asked questions section to that page. But then also, you know, don't hesitate, you see our profiles, you see our email addresses,
49:24 just reach out to, to either Axel or, or myself if you have, if you have questions, and we can also work with you on getting, getting answers to what your cybersecurity team or your product development or product management team, have. Great. Great. Okay. Ah, well, we, we picked up Yep, I got it. You, you got a thank you. Very good. All right, gentlemen.
49:54 Again, thank you for, making this, this, webinar possible. Axel, thank you for joining us. Your insight was, was really, really helpful. And again, like I said, the recording will be available tomorrow. There's a link to the PTC landing page. And then lastly, their, MedTech Intelligence is conducting a market research survey, and we would really appreciate, the registrants and attendees of this webinar to
50:26 participate in that. It's about eight to 10 minutes long, and we'll be developing information and probably another webinar from that information that we gather in that research project. So with that, I wanna thank everyone for joining us, and, again, appreciate the support from PTC. And thank you Rene, and thank you Axel. And everyone, have a great rest of the day. Thank you. Thank, thanks for having me. Thank you. Appreciate it.