Threat

Threats are what threat modeling identifies and security risk management assesses. A threat becomes a risk to patients when it can exploit a vulnerability in the device or its environment.

Threat is any circumstance or event with the potential to adversely impact the device, organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, or other organizations through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. Threats exercise vulnerabilities, which may impact the safety or essential performance of the device.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.H, Definitions

any circumstance or event with the potential to adversely impact the device, organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, or other organizations through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. Threats exercise vulnerabilities, which may impact the safety or effectiveness of the device.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology