Week 1: Top 5 Cyber Threats to SaMD in 2025 — And How to Stay Ahead.

As Software as a Medical Device (SaMD) grows in intelligence and clinical relevance, cybersecurity threats grow in both volume and sophistication. This article outlines the top five emerging cyber threats to SaMD in 2025 and how medical device developers can mitigate them with a proactive, risk-based security strategy.

1. AI/ML Model Tampering

Modern SaMD solutions often rely on machine learning models for diagnosis or monitoring. Attackers may attempt to poison training data or manipulate models through adversarial inputs, leading to incorrect diagnoses or actions.

Mitigation:

• Use secure and validated datasets for training

• Implement robust input validation and anomaly detection

• Regularly retrain models with controlled data pipelines

2. Insecure Over-the-Air Updates

Frequent software updates are essential, but improperly secured OTA channels can become a vector for malicious payload injection or denial of service.

Mitigation:

• Enforce strong code signing and update validation

• Use secure transport protocols (e.g., TLS 1.3)

• Implement rollback protections and OTA logging

3. Cloud API Exposure

Many SaMD platforms use cloud-based APIs for data storage, processing, or integration with EMRs. Poorly configured or exposed APIs can lead to data breaches or unauthorized access.

Mitigation:

• Use OAuth2.0 and mTLS for API access control

• Perform regular API security testing (OWASP API Top 10)

• Enforce RBAC and data minimization

4. SBOM Exploitation & Open-Source Dependencies

As SBOMs become mandatory for regulatory compliance, attackers may use disclosed dependencies to identify exploitable components.

Mitigation:

• Maintain real-time SBOM inventories with CVE scanning

• Use trusted repositories and validated third-party libraries

• Monitor OSS vulnerabilities continuously

5. Weak Identity & Access Management

Improper identity provisioning or weak access controls for cloud dashboards, mobile apps, or admin portals can allow privilege escalation or unauthorized operations.

Mitigation:

• Enforce multi-factor authentication (MFA)

• Apply least privilege and JIT access models

• Audit access logs and integrate IAM with SIEMs

Takeaways:

• SaMD security must evolve beyond basic encryption and anti-malware.

• AI integrity, secure updates, API hardening, SBOM management, and IAM are all mission-critical.

• Developers should integrate threat modeling and secure SDLC practices early in the design phase.

Need help securing your SaMD platform?
Contact the RedBlue Cyber team for expert guidance on product security, risk analysis, and regulatory compliance.

Author: @BeatTheCIA