CVSS Isn’t a Risk Score: Threat Modeling for Medical Device Security | Medcrypt

CVSS is the common language for vulnerability severity. Suppliers, NVD, CISA advisories and FDA all use it. But CVSS was built to rate enterprise IT vulnerabilities, not medical device product risk. If it’s all you rely on, its gaps show up exactly where patient safety is at stake. In this webinar, Medcrypt’s product security and regulatory team covers: • Why medical device manufacturers need one risk scoring method across the SDLC, from threat modeling and SBOM to testing and postmarket • Where CVSS falls short for product risk: it was calibrated for IT, it adds scores where risk analysis multiplies them, it’s weighted toward Impact, and it measures harm to data rather than to patients • What CVSS v4 improves, and the new problems it creates for product risk work • Our recommendation: use CVSS Exploitability as the likelihood input, assess Impact as patient harm on your ISO 14971 scale, and document how a CVSS score becomes a risk decision for FDA 🔗 Learn about Medcrypt’s threat modeling services: https://www.medcrypt.com/platform/thr... 📅 Book a conversation with our team: https://calendly.com/aj-medcrypt/30min Resources mentioned: • FIRST CVSS v4.0 User Guide: https://www.first.org/cvss/user-guide • CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/speci... • OWASP Risk Rating Methodology: https://owasp.org/www-community/OWASP... • FDA Postmarket Management of Cybersecurity in Medical Devices: https://www.fda.gov/regulatory-inform... About Medcrypt: Medcrypt helps medical device manufacturers build security into their products, from threat modeling and SBOM management to FDA premarket submissions. Our team includes former FDA CDRH premarket reviewers. #MedicalDeviceSecurity #ThreatModeling #CVSS