Supply Chain SecurityCyber-Physical Systems (CPS) Security

Threat Detective

Validates medical device SBOMs, triages component CVEs, and produces FDA eSTAR submission evidence.

Threat Detective Overview

What it does

Threat Detective is a Software Bill of Materials (SBOM) management and vulnerability documentation platform built for medical device manufacturers rather than software development teams. It takes the CycloneDX or SPDX SBOM a device team already produces, validates it against the NTIA minimum elements, matches every component to known vulnerabilities, and turns the resulting exploitability decisions into the cybersecurity evidence that FDA premarket reviewers and EU Notified Bodies expect, then keeps that evidence current through post-market surveillance of every fielded software version.

How it works

The platform ingests the Software Bill of Materials (SBOM) a team already produces, validates supplier, version, identifier, and dependency fields, and pulls component end-of-life dates from endoflife.date. Components are matched daily against the National Vulnerability Database, GitHub Security Advisories, and OSV, merging duplicates into one triage queue. Analysts prioritise with CVSS, EPSS, and CISA Known Exploited Vulnerabilities (KEV) data, record exploitability and compensating controls once across all affected versions, and a later KEV listing reopens a closed decision. Outputs include FDA eSTAR cybersecurity sections, EU Notified Body summaries, enriched SBOMs, and Vulnerability Exploitability eXchange (VEX) statements on a hosted portal.

Credentials and traction

Threat Detective publishes a vulnerability disclosure policy aligned with the NCSC toolkit and ISO/IEC 29147 and its own Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) statements through the same hosted transparency portal customers receive. It is UK GDPR and EU GDPR compliant with a Data Processing Addendum, hosts standard-plan customer data in Germany, and processes no protected health information. The product targets medical device manufacturers preparing 510(k), De Novo, PMA, and EU MDR or IVDR submissions.

Key Capabilities

SBOM Management

Medical Device Security

Generates or ingests machine-readable SBOMs for medical devices (CycloneDX, SPDX) covering commercial, open-source and off-the-shelf components, and keeps them current per device model and software version. Serves a manufacturer documenting its own device portfolio for premarket submissions and postmarket management, and a healthcare provider tracking component vulnerabilities across the devices it operates. Required of cyber devices by FD&C Act section 524B and expected under EU MDR.

Assembles the cybersecurity documentation a premarket submission needs (security risk management report, threat model, security architecture views, SBOM, a cybersecurity management plan with vulnerability monitoring sources and patch release timelines, and labeling) in the structure the FDA premarket cybersecurity guidance and FD&C Act section 524B expect, and maps the same evidence to EU MDR cybersecurity requirements for devices sold in Europe.

Continuously rechecks the components in a manufacturer's device SBOMs against vulnerability and exploit intelligence (the NVD, EPSS, the CISA Known Exploited Vulnerabilities catalog and exploit databases), records an exploitability decision for each finding in the context of the device, and produces VEX and vulnerability disclosure report (VDR) documents that evidence the postmarket vulnerability monitoring plan FD&C Act section 524B requires of cyber devices and that EU MDR post-market surveillance expects.

At a glance

Deployment: Private Cloud · SaaS
Compliance: GDPR
Integrations: 9 tools
Support: Customer Success Manager (CSM) · Email Support · +1

Info last updated on September 8, 2026

Buyers

Start a shortlist with Threat Detective

Compare options, add your notes, and run informed evaluations.

Vendors

Is this your product?

Claim your profile to connect with the teams looking for your solutions.

Claim your profile