What Vehicle Security Can Learn from Medical Device Security

Explore how nearly two decades of medical device security research can inform and improve automotive cybersecurity practices in this keynote presentation from VehicleSec '25. Discover the surprising similarities between medical devices like pacemakers and infusion pumps and modern automotive systems, including their shared challenges of long product lifecycles, real-time embedded software, RF communication, complex supply chains, and safety-critical operations. Learn how both industries operate in regulatory environments that struggle to keep pace with technical innovation, while examining why only medical device security is codified in U.S. statute. Analyze the medical device industry's experiences with coordinated vulnerability disclosures, government-mandated recalls, supply chain risk management, and the pressure to align safety engineering with modern security practices. Examine the FDA's evolving regulatory framework and increasing transparency around postmarket cybersecurity as models for building trust and resilience into safety-critical systems. Understand how the healthcare sector approaches threat modeling, security engineering, postmarket risk management, and incident response, including both successful strategies and critical missteps. Gain insights into how regulators, researchers, and industry engineers have collaborated to improve security outcomes in deployed systems, and discover practical lessons for designing and securing automotive platforms to avoid repeating past mistakes and accelerate vehicle cybersecurity maturity before the industry faces a crisis.