MedCrypt

Medcrypt (MedCrypt, Inc.) is a San Diego-based provider of cybersecurity products and services for medical device manufacturers (MDMs). The company positions itself as combining cybersecurity technology products with management consulting, decision science, and regulatory strategy focused exclusively on the medical device sector, with the stated goal of helping manufacturers build devices that are secure by design and bring connected clinical technology to market.

Its current commercial focus is MSI, described as a single platform for medical device cybersecurity compliance that combines tools, data, and expert support to meet FDA requirements. The platform is organized in three stages: a readiness assessment that scores a manufacturer's submission documentation across FDA-relevant domains and identifies gaps; a remediation stage that flags issues an FDA reviewer would catch and helps build compliant documentation from scratch; and an ongoing stage covering automated self-audits, vulnerability monitoring, and alerts when regulatory guidance changes. A free five-minute readiness check is offered as an entry point, alongside threat-model reviews.

Alongside the platform, Medcrypt offers pre-market and post-market services. Pre-market work includes regulatory cybersecurity readiness, threat modeling and risk mitigation, cybersecurity maturity assessments, PKI and cryptography analysis, FDA hold-letter response, and integration of SBOM generation, vulnerability scanning, and security testing into the software development lifecycle using FDA-recognized frameworks such as TIR-57/SW96. Post-market services cover continuous monitoring, cybersecurity risk management and prioritization based on patient-safety impact, SBOM validation and monitoring, incident response, and maintenance of regulatory compliance across a device's lifecycle. Earlier product descriptions cite cryptography, behavior monitoring, and vulnerability inventory products spanning devices from glucose monitors to hospital-based surgical robots.

Founding story

Medcrypt was founded in 2016 with the stated aim of addressing cybersecurity concerns in the medical device manufacturing sector so that connected medical devices would be as safe and secure as technologically possible. CEO Mike Kijewski previously founded Gamma Basics, a radiation oncology software startup acquired by Varian Medical Systems in 2013; CTO Eric Pancoast was a co-founder of the same company. The company's timeline frames its founding against FDA cybersecurity guidance issued in 2014 and 2016, and it has said the FDA's October 2018 premarket cybersecurity guidance update aligned closely with the solution it began developing in 2016.

Business model

Medcrypt sells cybersecurity software and platform access (MSI) together with consulting and regulatory services to medical device manufacturers, spanning pre-market submission preparation and post-market lifecycle compliance. Services are offered on a project basis, with a stated guarantee for new customers that Medcrypt will support them through all FDA feedback until cybersecurity documentation is accepted, with no hidden fees or handoffs.

Revenue derives from cybersecurity products/platform subscriptions and from consulting and regulatory services engagements delivered to medical device manufacturers; specific pricing is not disclosed.

Traction

Publicly stated traction includes 140+ medical device manufacturers as customers, 13 of the top 50 global MDMs, 200+ projects delivered across 60+ clients, a 100% FDA approval rate since 2023, and, as of 2022, security features and services for seven of the top 10 medical device manufacturers. Cumulative disclosed funding reached $34.4 million after the 2022 Series B.

Latest developments

The company's current positioning centers on MSI, a platform combining readiness scoring, documentation remediation, and continuous post-approval compliance monitoring, together with a free readiness check. Recent content addresses 2026 regulatory changes, including FDA inspections under the QMSR quality framework, the EU Cyber Resilience Act's mandatory vulnerability reporting starting September 11, 2026, and regulators' use of AI to detect inconsistencies in submissions. Medcrypt has also announced a partnership with Thirdwayv on medical device cybersecurity and interoperability.