MedISAO

What MedISAO does

MedISAO is a cybersecurity-focused information sharing and analysis organization serving the medical device industry, organized by MedCrypt Inc., a California-based private company founded in 2016. MedISAO operates as a membership-based community for medical device manufacturers, providing coordinated vulnerability disclosure, customized vulnerability alerts, training, and regulatory guidance aligned with the FDA's Postmarket Management of Cybersecurity in Medical Devices guidance. The organization holds registered ISAO status under an FDA Memorandum of Understanding, a regulatory credential that positions it within the FDA's recognized compliance infrastructure.

MedISAO's product portfolio extends beyond community membership into purpose-built software tools: Helm delivers continuous Software Bill of Materials (SBOM) and vulnerability management for the medical device software supply chain, supporting EPSS scores, CISA KEV, and Top 25 CWE references; Guardian provides a cryptographic platform with digital signing, root of trust, and certificate management designed for devices with limited connectivity, storage, or memory. The organization also offers FDA Cybersecurity Readiness consulting services including filing readiness assessment, threat modeling, FDA hold letter response, and submission readiness review using a five-sector framework. As of 2023, the organization reports supporting more than 70 medical device manufacturers.

The business operates on annual subscription membership pricing (undisclosed publicly) with direct sales to mid-market medical device manufacturers, complemented by consulting services and standalone product offerings. Go-to-market is community-led and event-driven, leveraging webinars, a YouTube channel, a knowledge center, and thought leadership authored by leadership that includes former FDA CDRH personnel. MedISAO's strategic positioning is reinforced by the 2023 FDA Section 524B cybersecurity documentation requirements and the October 2023 Refuse to Accept enforcement policy, which together expand the addressable compliance market for ISAO-mediated cybersecurity services.

Name

MedISAO

Legal name

MedCrypt Inc.

Website

https://medisao.com

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

1–10 employees

Short description

MedISAO is an FDA-recognized ISAO providing cybersecurity information sharing, vulnerability disclosure coordination, SBOM management (Helm), and cryptographic tooling (Guardian) to medical device manufacturers seeking FDA postmarket cybersecurity compliance.

Ownership category

akta.pro rank

Product category

Medical Device Cybersecurity

NAICS

Software Publishers (513210), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Prepackaged Software (7372), Services-Health Services (8000)

akta.pro primary industry

Backup, Disaster Recovery & Ransomware Resilience for Healthcare (HLACAJAO)

akta.pro secondary industries

Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL), Privileged Access Management (PAM) & Session Control (HLACAJAB)

Keywords

• Medical device cybersecurity
• Vulnerability management
• FDA compliance services
• Information sharing organization
• SBOM management

Headquarters

HQ city

Irvine

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Membership Subscription: MedISAO operates as a membership-based organization providing cybersecurity information sharing, education, and tools to medical device manufacturers. Members pay for access to vulnerability alerts, coordinated vulnerability disclosure program, training materials, and best practices sharing.

Pricing tiers

Go-to-market motion2 records

Distribution channels1 record

Marketing channels6 records

Core offering

MedISAO provides cybersecurity information sharing, education, and software tools tailor-made for the medical device industry. Its core offerings include a registered ISAO membership program with a coordinated vulnerability disclosure service and customized vulnerability alerts, the Helm SBOM and vulnerability management software platform, the Guardian cryptographic platform for secure device communications, and FDA cybersecurity readiness consulting services. These offerings are aimed at helping small-to-medium medical device manufacturers comply with FDA postmarket cybersecurity requirements.

Product overview

MedISAO (Medical Information Sharing and Analysis Organization) is a cybersecurity-focused organization serving the medical device industry. The portfolio consists of two core software products—Helm (SBOM and vulnerability management) and Guardian (cryptographic platform)—alongside consulting services for FDA cybersecurity readiness. The organization also operates a membership program providing information sharing, vulnerability alerts, and coordinated vulnerability disclosure services. MedISAO is organized by MedCrypt, a healthcare-first cybersecurity company, and holds a registered ISAO status with an FDA MOU for compliance with FDA Postmarket Management of Cybersecurity in Medical Devices guidance.

Differentiator

Problem solved

Functional benefit

Brands

• Helm: Continuous Software Bill of Materials (SBOM) and vulnerability solution for medical device manufacturers
• Guardian
• Medcrypt Security Intelligence

Products and services

• Helm Continuous Software Bill of Materials (SBOM) and vulnerability management solution built specifically for medical device manufacturers (MDMs), providing full visibility across the entire medical device software supply chain to detect, prioritize, and remediate cybersecurity risk. Supports EPSS scores, CISA KEV, and Top 25 CWE lists.
• Guardian Secure and scalable cryptographic platform that enables medical devices to communicate securely, providing data integrity, digital signing, customized root of trusts, and certificate management. Specifically designed for medical devices with limited or no connectivity, limited storage, and limited memory.
• FDA Cybersecurity Readiness Services Consulting services including FDA cybersecurity filing readiness assessment, threat modeling, FDA hold letter response, and submission readiness review using a five-sector framework, delivered to medical device manufacturers seeking to comply with FDA cybersecurity requirements.
• MedISAO Membership Membership program providing cybersecurity information sharing, education, and tools tailor-made for the medical device industry, including a coordinated vulnerability disclosure program, customized vulnerability alerts from a vulnerability database, training materials, and best practices sharing. MedISAO is a registered ISAO with an FDA MOU providing compliance with FDA's Postmarket Management of Cybersecurity in Medical Devices guidance.

Quantifiable outcome

• Members can avoid costly corrective action reporting requirements (21 CFR 806) by reporting vulnerabilities directly to MedISAO
• +1 more outcomes

Named customers2 records

Segments3 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

One partnership is on record.

• MedCryptcoreOthersMedISAO is organized by MedCrypt, a healthcare-first cybersecurity company. MedCrypt provides the underlying technology platform (Helm, Guardian) and organizational support for MedISAO's information sharing activities. MedISAO leverages MedCrypt's products and expertise to serve the medical device community.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Emerging players

• Nozomi Networks: Nozomi Networks provides OT and IoT security visibility and vulnerability management with healthcare deployments. Adjacent competitor with broader industrial focus.
• Dragos: Dragos focuses on industrial control systems and OT security with an emerging healthcare presence. Comparable in OT/IoT vulnerability management depth but lighter on FDA regulatory workflow.

Broad incumbents

• CrowdStrike: CrowdStrike is a broad endpoint and cloud security incumbent that has moved into IoT and connected device security, including healthcare. Bundles device security into a much larger platform that can undercut standalone specialists on price.
• Palo Alto Networks: Palo Alto Networks offers IoT Security and broader healthcare cybersecurity through its Prisma and Cortex platforms, competing in the same regulatory-driven medical device security space with significantly larger scale and channel reach.

Direct peers

• Claroty: Claroty provides cybersecurity for industrial, IoT, and healthcare-connected assets including medical devices. Competes with MedISAO/MedCrypt in the medical device vulnerability management and asset visibility category.
• MedCrypt: MedCrypt is the parent company that organizes MedISAO and provides the underlying Helm and Guardian technology. Effectively the same operating entity from a product and customer standpoint.
• Cynerio: Cynerio specializes in healthcare IoT and connected medical device security, offering device discovery, risk assessment, and vulnerability management — directly overlapping with Helm's positioning.
• Ordr: Ordr provides connected device security with explicit focus on medical devices and clinical environments. Comparable device asset inventory, vulnerability management, and segmentation capabilities.
• Armis: Armis offers an asset intelligence and security platform with strong healthcare vertical penetration, addressing IoT and medical device visibility and vulnerability management.
• Health-ISAC: The Health Information Sharing and Analysis Center is the broader healthcare-sector ISAO. Highly comparable information-sharing-and-analysis model, though Health-ISAC serves the wider healthcare ecosystem rather than medical device manufacturers specifically.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/isao_med
• YouTubeyoutube.com/@medisao6257?feature=shared
• LinkedInlinkedin.com/company/medisao

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about MedISAO