Cyber-Physical Systems (CPS) Security
Helm
Vulnerability management platform for medical devices with automated SBOM and compliance reporting.
Helm Overview
What it does
Helm is a Software Bill of Materials (SBOM) vulnerability management platform that automates creation, analysis, and validation of software supply chain data to identify and remediate cybersecurity risks in medical device software components while meeting Food and Drug Administration (FDA) premarket submission requirements. Built by former FDA reviewers, Helm eliminates up to 95% of false positives generated by generic cybersecurity tools through AI-powered intelligence that detects affected technology stacks and medical device-specific exploitability analysis, enabling engineering teams to focus on vulnerabilities that pose real risk to patient safety rather than investigating thousands of irrelevant alerts.
How it works
The platform integrates into development pipelines to automate SBOM ingestion and vulnerability detection at every build phase, continuously monitoring software components against Exploit Prediction Scoring System (EPSS), Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV), ExploitDB, Metasploit, National Vulnerability Database (NVD), and Common Weakness Enumeration (CWE) Top 25 databases while providing bulk rescoring across product versions, automated remediation workflows with short-term mitigations and upgrade paths, and rule-based compliance automation including alias rules for consistent component matching and lifecycle rules for End of Support/End of Life metadata management.
Credentials and traction
MedCrypt was named a Representative Vendor in the 2025 Gartner Market Guide for Medical Device Risk Management Platforms, and appeared on Becker's Hospital Review "116 Healthcare Cybersecurity Companies to Know" list in 2025. It was recognized in the 2023 Cybersecurity Excellence Awards for vulnerability management. Helm is used by three of the top five medical device manufacturers, serving engineering and product security teams responsible for FDA premarket cybersecurity submissions.
Key Capabilities
mapped to solution categoriesDiscovers and classifies connected medical devices by device type, manufacturer, model, and firmware version, including devices that do not support standard endpoint agents.
Maps identified vulnerabilities, network exposure, and control gaps to HIPAA Security Rule safeguards (164.312 technical safeguards), for compliance evidence.
Generates or ingests device SBOMs to track component CVEs across the medical device fleet, increasingly required by FDA and EU MDR for post-market security management.
Supports the documentation artifacts required by FDA cybersecurity pre-market guidance (threat model, SBOM, security architecture description, patch management plan), for device submission.
Discovers and fingerprints purpose-built connected devices (printers, cameras, infusion pumps, smart meters, building systems), classifying make, model, OS, firmware, and function, including unmanaged devices that cannot run an endpoint agent.
Identifies, prioritizes, and helps remediate device vulnerabilities, including outdated firmware and exposed network services, across the connected-device fleet.
Assesses overall device-ecosystem risk (device trustworthiness, exposure, and operational context) as a continuous posture, distinct from per-CVE vulnerability management.
Integrations
compatible toolsImplementation & support
Info last updated on May 27, 2026
Vendors
Is this your product?
Claim your profile to connect with the teams looking for your solutions.