Connected Medical Devices: 2025 Cybersecurity Budget Shift

Connected medical devices after the FDA's 2025 cybersecurity guidance: where development budgets are moving

For most of the past decade, connected medical devices were priced and planned around features: what the device measures, what the companion software shows, how the data reaches a clinician. That era is ending. Between late 2022 and mid-2025, US regulators rebuilt the rules around one question that used to sit at the bottom of every project plan: can this device be defended, patched, and documented for its entire life on the market? The answer now determines whether a product reaches the market at all, and development budgets across the sector are being redrawn to match.

What changed, and when

The turning point was legislative, not technical. In December 2022, Congress amended the Federal Food, Drug, and Cosmetic Act with section 524B, which took effect in March 2023. The section created a formal category of "cyber devices": products that contain software and can connect to the internet. For these devices, manufacturers must submit a plan for monitoring and addressing vulnerabilities, commit to shipping patches on a regular cadence plus out-of-cycle fixes for serious flaws, and provide a software bill of materials covering commercial, open-source, and off-the-shelf components.

Enforcement followed quickly. Since October 2023, the FDA has been able to refuse to accept submissions that arrive without the required cybersecurity documentation. In June 2025, the agency finalized an updated premarket cybersecurity guidance that added a dedicated section interpreting 524B obligations, and it has continued refining that document since. The guidance reaches further than many manufacturers expected: its recommendations apply even to devices that are exempt from premarket submission requirements.

The legal exposure widened along the way. By late 2025, law firms advising the sector were warning that cybersecurity gaps could trigger liability under fraud statutes such as the False Claims Act, on top of the FDA's own authority to treat noncompliant devices as adulterated or misbranded. A missed patch commitment is no longer a support ticket. It is a regulatory event.

Security moved to the front of the budget

The financial consequence of all this is a reallocation, not just an increase. Under the old model, security spending clustered at the end of a program: penetration testing before submission, documentation written retroactively, patches funded from a maintenance budget. Under 524B, the most expensive security decisions are architectural, and architecture happens in the first months of a program. Signed and verifiable update paths, partitioned firmware that can be patched without full recertification, and component-level traceability for the software bill of materials all have to be designed in, because none of them can be bolted on at a reviewable cost later.

That shift favors engineering organizations that can carry a device across layers rather than owning one slice of it. Yalantis, a company doing medical device development within a portfolio that, by its own published count, is now roughly 40 percent IoT projects, pairs an in-house hardware lab covering electronics, enclosures, and firmware with embedded and cloud software teams. The structure reflects how submissions are now judged: on how the firmware, connectivity, and cloud layers document together, not on the quality of any single layer.

For manufacturers, the budgeting implication is concrete. Programs that once split spending 80/20 between features and compliance are moving toward models where a third or more of premarket engineering time goes to security architecture, documentation, and update infrastructure. The money is not disappearing from features. It is being pulled forward from post-market maintenance budgets that used to absorb these costs quietly and inefficiently.

The vendor chain is consolidating

A second-order effect is showing up in procurement. The software bill of materials requirement spans every component in the device, regardless of who wrote it. When a manufacturer assembles a product from a firmware shop, a separate mobile vendor, a cloud contractor, and a compliance consultant, the SBOM becomes a reconciliation exercise across four organizations with four documentation cultures. Gaps tend to surface at the worst possible moment: during submission review, when a refuse-to-accept decision resets the timeline.

The predictable response is a shorter vendor chain. Manufacturers are consolidating development scope with partners who can produce submission-grade documentation across layers, and they are writing patch-response times and SBOM maintenance into contracts rather than treating them as goodwill. Suppliers who cannot commit to vulnerability-response terms in writing are being priced accordingly, or dropped.

None of this guarantees better devices by itself. A single accountable vendor can still build a weak product. What consolidation does change is the failure mode: documentation gaps become visible inside one organization during development, instead of between organizations during review.

Legacy devices are the unresolved line item

The 2025 guidance left one major question open: it does not explain how legacy devices, built on hardware and software that can no longer be patched or updated, are supposed to meet 524B expectations. For manufacturers with a large installed base, that silence is itself a planning problem. Every legacy product line now needs a decision: retrofit connectivity and update mechanisms where the hardware allows it, wall the device off from networks and accept the commercial consequences, or redesign.

Redesign is the expensive option on paper and, increasingly often, the cheaper one in practice, because a clean redesign can be built inside modern quality frameworks from day one. Teams that align their software processes with IEC 62304 and ISO 13485 from the first sprint avoid the retroactive documentation work that makes retrofits so unpredictable to estimate. The manufacturers moving fastest in 2026 are the ones that made the retrofit-or-redesign call per product line in 2025, rather than deferring it as a portfolio-wide question.

There is also a quieter cost here: engineering talent. Retrofit programs are documentation-heavy and unglamorous, and several manufacturers have found it harder to staff them internally than to contract them out. That, too, is shaping where development spending lands.

A test for 2026 planning

Market forecasts for connected medical devices will keep disagreeing on size and growth rate. The regulatory direction, by contrast, is settled and one-way. Before signing off on next year's device roadmap, run a simple test: ask every vendor and internal team on the program to produce a current software bill of materials for their own deliverables, this week. The teams that respond in days are ready for the market as it now works. The ones that respond with questions are telling you where next year's budget overrun will come from.