Sternum

Deliberate C, and this record is worth reading as a demonstration of what the index measures. Sternum's flagship technology is emphatically NOT AI and the company says so plainly: EIV is DETERMINISTIC, using binary instrumentation to verify execution flow and memory integrity, and the company presents that determinism as the feature rather than a limitation, since it is what allows the claim of zero false positives. Deterministic integrity checking either fires or it does not; there is no model, no probability and no threshold. Real AI does exist in the second layer, providing anomaly detection for operational intelligence and AI-based insights in the XDR-like threat detection tier, which is identifiable and gradeable, so the vendor qualifies under the same test that admitted ModMed. But the capability that makes this company technically distinctive contains no machine learning at all. Graded honestly at C. The wider point is genuinely interesting editorially: arguably the most elegant security engineering in this category has the least AI in it, and pretending otherwise to raise the grade would defeat the purpose of grading.

Genuinely autonomous prevention, and uniquely defensible in this category because of the determinism. EIV blocks exploit attempts at runtime without human involvement, and the device protects itself even when disconnected from any network. Elsewhere in this lane autonomous enforcement is dangerous, since automatically isolating a misidentified infusion pump is a patient safety event. Here the risk profile inverts: because the check is deterministic rather than probabilistic, the system is not guessing whether behaviour is anomalous, it is verifying whether execution flow was diverted, so it does not carry the false positive exposure that makes autonomous action hazardous for behavioural detection systems. Every blocked attack is reported with detailed logs and attack path analysis for root cause work, so autonomy on prevention is paired with full transparency after the fact.

The clearest technical explanation in the category, alongside Cylera and Finite State, and it earns the grade by explaining the reasoning rather than the outcome. The mechanism is named precisely: binary instrumentation placing checkpoints in compiled code, verifying integrity of execution flow and dynamic memory. The rationale is stated as a first principle a reader can evaluate independently, that any attacker must divert the intended execution flow to run malicious code, so blocking diversion defeats the attack regardless of which vulnerability was used. Overhead is quantified specifically at 1 to 3 percent latency and around 10 percent code footprint, which is exactly the number an embedded engineer needs and which most vendors would avoid publishing. Compatible environments are enumerated by name rather than claimed generically.

Credible technical validation but no independent performance evidence. The Zephyr Project selecting Sternum as its first embedded runtime security partner is meaningful third party endorsement from a Linux Foundation project whose ecosystem includes Google, Intel and NXP, and a Fortune 500 proof of concept reportedly surfaced four security bugs including memory leak and corruption vulnerabilities during firmware profiling, which is a concrete named-scale result. But no independent benchmark, published penetration testing result or peer-reviewed evaluation was located, and the zero false positives claim, while logically supported by the deterministic design, is asserted rather than measured. The company is also not healthcare-only, so evidence is spread across IoT verticals.

Structurally the cleanest position available. The technology operates on device firmware execution integrity, not on clinical data, so no protected health information is processed at any point. The architecture is also privacy-favourable in a stronger sense than policy can achieve: protection runs on the device itself and functions when the device is entirely disconnected, so security does not depend on shipping telemetry off the device. Where telemetry is used for the observability layer, it is device and fleet operational data rather than patient data, and it routes to the customer's own SOC, SIEM or SOAR.

Largely inapplicable. The customer is the device manufacturer and the data handled is firmware execution telemetry rather than protected health information, so a BAA would not ordinarily be required. No terms were located.

No third party attestation such as SOC 2 Type II or ISO 27001 was retrieved at the time of review, consistent with all twelve vendors now indexed in this category. Notable here because the product is embedded directly into medical device firmware, which is about as privileged a position as software can occupy, so a manufacturer should require supply chain assurance on the instrumentation itself.

Not itself an FDA regulated product, but positioned deliberately against the regulatory and operational pressures manufacturers face. The company maps its offering to IEC 62443, FDA expectations, NIST guidance and FBI recommendations for Internet of Medical Things endpoint protection. The most substantive regulatory argument is practical rather than documentary: runtime prevention reduces dependence on field patching, which for deployed clinical devices is slow, expensive and sometimes impossible without revalidation, so the product addresses the postmarket security obligation from a direction that documentation-focused tooling cannot. Graded B rather than A because the mapping is framed at guidance and standards level without the specific statutory detail MedCrypt and Finite State provide on Section 524B, SBOM requirements and VEX documentation.

No governance framework located, though the exposure is unusually limited by design. The prevention layer is deterministic rather than model-driven, so it carries none of the bias or drift risk that behavioural detection systems do. The AI in the observability and anomaly detection layer is advisory to engineering teams rather than consequential to individuals or patients, which is a materially lower-stakes application than the workforce surveillance and clinical decision products elsewhere in this index.

Interoperability here means embedded platform compatibility and security tooling integration, and both are strong. Operating at bytecode level rather than requiring source changes gives universal compatibility across RTOS and embedded Linux environments including Zephyr, FreeRTOS, VxWorks, Micrium, OpenWrt and general Linux distributions, explicitly including legacy devices regardless of manufacturer or year of production, which is decisive in a fleet where equipment lifespans run to decades. Native plug-and-play integration into development environments means adoption does not require rearchitecting firmware. Security telemetry feeds into the customer's existing SOC, SIEM or SOAR rather than demanding a separate console, and the Zephyr partnership embeds the capability into an ecosystem used by major silicon and platform vendors.

The most favourable deployment position of any vendor in this category. Protection is resident on the device and self-sustaining, running whether or not the device is connected, which solves the isolated and air-gapped equipment problem that network-based monitoring cannot address at all. Agentless with 1 to 3 percent overhead means it fits resource-constrained embedded hardware where a conventional agent would be impossible. Because security executes locally, there is no dependency on shipping data to a vendor cloud for the protective function, which resolves data residency concerns structurally rather than contractually.

Better than the category norm, which is uniformly opaque. Sternum publishes a genuine no-time-limit FREE licence covering up to three OpenWrt devices, giving engineers a real hands-on evaluation path without a sales conversation, alongside a premium licence for RTOS and other embedded Linux environments. Publishing a free tier at all is unique in this category. Graded B rather than A because the premium licence has no published rate or scaling basis, so a manufacturer cannot model cost across a device portfolio from public information.

Broad across device types and operating environments but not healthcare-exclusive. Covers medical devices alongside payment, gaming and general IoT and industrial equipment, spanning RTOS and embedded Linux, new and legacy hardware. The company does argue that medical devices stretch the IoT security challenge to its extreme, citing real-time operating systems with no prior security options, heavy third-party library dependence and life-critical function, and states the medical device security standard should set the tone for the industry. Graded B rather than A because healthcare is one vertical among several and the functional scope is runtime protection plus observability rather than the full lifecycle Finite State covers.