Closed box testing

In device cybersecurity it reflects how an outside attacker sees the device. FDA expects it alongside other testing, such as fuzz testing and code review, rather than as the only security test.

a method of software testing that examines the functionality of an application without peering into its internal structures of workings.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology