MedCrypt

Artificial intelligence is a layer on a platform whose value stands on rules, curated data and people. Medcrypt Security Intelligence combines readiness scoring, threat modeling, document templates, Helm for SBOM and vulnerability management, and advisory hours with former FDA reviewers; the company says "The software does the heavy lifting. The humans make the judgment calls."

Learned components are described: the Helm changelog says "Our advanced Large Language Model (LLM) now enriches vulnerability data" from the National Vulnerability Database and that an AI copilot generates identifiers for components that lack them, Helm offers AI guidance on mitigations and upgrade paths and a beta that tags affected technology stacks, and the FDA audit scan is described as "An AI-driven design and implementation gap analysis". Component matching still runs on an alias rules engine and lifecycle rules, and exploitability comes from named public feeds (EPSS, CISA KEV, ExploitDB, Metasploit, NVD, CWE Top 25).

The oversight structure is described, and what happens when the AI is wrong is not. The Helm documentation labels AI guidance a supplement: "AI recommendations are meant to supplement, not replace, security expertise. Always validate suggestions against your specific environment and security policies", and each recommendation carries source links for checking. Technology stack tagging is a beta shown as badges and filters rather than an automatic exclusion.

The FDA audit scan says each finding cites the requirement it came from and shows the evidence behind it, and that every human reviewer change is captured in an audit log; the platform pairs its output with expert submission reviews.

One step runs without a gate: the changelog says the AI copilot automatically generates and assigns identifiers to components that lack them, and those enriched identifiers flow into FDA SBOM and vulnerability reports, labeled as enriched but with no approval step described. Bulk rescoring and bulk remediation apply one decision across many product versions.

The approach and the data sources are named; the model is not. The Helm documentation names every exploitability feed it draws on (EPSS, CISA KEV, ExploitDB, Metasploit, NVD and CWE Top 25), explains the alias rules that match components and the lifecycle rules for end of support, and publishes data source update frequency.

It says a large language model enriches National Vulnerability Database records and generates CPE and PURL identifiers for unmatched components, with AI guidance listing what it evaluates and its current limitations, including that technology stack detection "is still being refined". The product itself is versioned publicly: a dated changelog carries a web interface version and a core infrastructure version for each release, most recently v4.6.58 and 2.132.0 on 21 September 2026. The language model is not identified, and nothing says how it is versioned or when it changes.

The architecture is described and no model provider is named. Helm runs as SaaS, and its AWS Marketplace listing, sold by Medcrypt, says it is deployed on Amazon Web Services. The documentation describes the public feeds the platform reads (EPSS, CISA KEV, ExploitDB, Metasploit, NVD, CWE Top 25) and says a large language model enriches vulnerability data and generates component identifiers, and the FDA audit scan reads a customer's threat model, risk assessment and SBOM together.

Those feeds are sources the platform reads, not parties that receive customer data. No subprocessor list is published, the language model's provider is not named, and nothing says what a model provider retains from the SBOMs and submission documents it sees. The Enterprise tier offers "deployment options that satisfy your AI governance policy" without describing them.

Vendor reported figures with no method or named customer. The home page states 140+ medical device manufacturers as customers, 13 of the top 50 global manufacturers, 200+ projects delivered and a "100% FDA approval rate"; the Helm page says it can "Eliminate up to 95% of false positives" and claims "Proven superior accuracy in head-to-head competitive testing", and a vendor-authored competitive analysis compares Helm with Grype, Dependency Track and Black Duck.

Case studies are unnamed: a global manufacturer that cut vulnerability review time by 90 percent, a 100-plus device maturity assessment, a cardiac device PMA remediation and a surgical robotics encryption review. None gives a denominator, baseline, period or method, and no independent evaluation of component matching or exploitability scoring is published.

Nothing is published on how customer data moves through the platform or its AI features. The product handles device manufacturers' software bills of materials, threat models, risk assessments and submission packages, which map a device's known weaknesses; it is not described as handling patient data, and Guardian's device telemetry is not described either. The only privacy document is a website policy dated 18 September 2023, written for visitors to the Medcrypt site.

No retention period, deletion commitment, statement on whether customer documents are used to train or tune the language model, or de-identification practice is published, and nothing covers guardrails on AI output or how a safety event is handled. The Enterprise tier mentions deployment options that satisfy a customer's AI governance policy, without saying what they are.

No status and no privacy document that reaches the product. The customers are medical device manufacturers and the platform works on software composition, vulnerability and submission documents, so business associate status may well not arise, but Medcrypt does not say so: no page states whether the platform or Guardian's device protection and telemetry ever handles protected health information.

The only privacy document is a website policy dated 18 September 2023 that covers visitors to the site. A plain statement that the product takes in no patient data, backed by a privacy document for the service itself, would give a buyer a position to rely on.

Nothing independent is published about Medcrypt's own security. The site, the Helm documentation and the AWS Marketplace listing name no SOC 2 report, ISO/IEC 27001 certificate, HITRUST certification, penetration test of the platform or trust center, and a search for one found none.

Medcrypt sells penetration testing to manufacturers as an add-on, and its platform holds, across customers, software bills of materials, the vulnerabilities found against them, their remediation status and, through Guardian, encryption keys and device identity for fielded devices.

No device claim; the product works the device regime for the manufacturers who buy it, without stating its own position. Medcrypt's platform is compliance software for medical device manufacturers and holds no FDA clearance, and none is claimed.

It is built around Section 524B and FDA's premarket cybersecurity expectations: an eSTAR readiness check, audit scans of submission packages against FDA requirements, deficiency letter responses, threat models and risk assessments feeding 510(k), De Novo and PMA documents, SBOMs checked against NTIA minimum elements and 524B, and postmarket monitoring through MedISAO membership, which the company says brings relief from 21 CFR 806 correction reporting. EU MDR and Health Canada submissions are covered too. The regulatory position it serves is the customer's device, not the tool, and no page states an intended purpose for the platform itself.

Governance is stated as a working practice, with no evaluation behind it. Helm is described as "Continuously refined by in-house former Food and Drug Administration (FDA) reviewers", AI guidance is labeled a supplement to expert judgment with its current limitations listed, and the Enterprise tier offers deployment options that satisfy a customer's AI governance policy. No governance framework, model evaluation, validation method or outside review is published.

The failure that matters here is a false negative: a vulnerability wrongly judged not to affect a device, or a component given the wrong identifier, drops out of the remediation queue and may drop out of a submission. No false negative rate, and no result by technology stack, component type or source, is published.

Mechanisms let a customer check the output; nothing commits Medcrypt to it. AI guidance in Helm comes with the source documentation behind each recommendation, audit scan findings cite the requirement and evidence they rest on, and changes made by human reviewers are kept in an audit log.

The home page says "100% FDA approval rate, guaranteed", but no page states what the guarantee covers, what a customer receives if a submission is refused or put on hold, or any terms behind it, so it is recorded as a claim rather than a commitment. No accuracy figure for component matching, identifier enrichment or technology stack detection is published, and no warranty or remediation terms for the platform are public.

It has no clinical record surface; the systems it connects to are a device manufacturer's development and issue tracking tools. The Helm documentation covers an API and SDK, a GitHub Action and an Azure DevOps extension that ingest SBOMs from build pipelines, and exports that send vulnerabilities to Jira and to AWS; SBOMs are accepted in CycloneDX and SPDX, and reports export as FDA SBOM, VEX and VDR files. Threat modeling works from AWS, Visio and draw.io architecture diagrams. Each named connection runs in one direction, and no customer is shown running one in production.

A single hosted option with the location implied. Helm's AWS Marketplace listing, sold by Medcrypt, describes it as software as a service deployed on AWS; no region, tenancy model or data location is stated. The Enterprise tier offers "deployment options that satisfy your AI governance policy" without saying what they are. Nothing published says where the language model runs, where SBOMs and submission documents rest, or whether processing leaves the United States.

Tiers with figures, a stated unit, and a way to start without a sales call. The pricing page lists a free readiness check ("No login wall, no sales call"), Medcrypt Security Intelligence at $35,000 per product line per year with 15 expert advisory hours and unlimited users, and a custom Enterprise tier with volume pricing across product lines; penetration testing is a scoped add-on. Helm on its own is priced on Medcrypt's AWS Marketplace listing at $499 per user per month including five SBOMs, with $200 for each additional SBOM, and a free 14-day Helm trial is offered.

Deliberately narrow and clearly named, with validation behind part of it. The platform serves medical device manufacturers: regulatory affairs, quality, product security and engineering teams preparing FDA 510(k), De Novo and PMA submissions, EU MDR and Health Canada filings, and postmarket monitoring for the life of a device.

Case studies name device types rather than customers: a cardiac device PMA, surgical robotics, a radiotherapy system, a 3D mapping system and a 100-plus device portfolio. The company states 140+ manufacturer customers, including 13 of the top 50. No hospital or health system use is offered.