Medcrypt

Medcrypt (MedCrypt, Inc.) is a San Diego, California-based provider of cybersecurity products and consulting for medical device manufacturers (MDMs). The company positions itself as combining cybersecurity technology products with management consulting, decision science and regulatory strategy directed exclusively at the medical device sector, with the goal of helping manufacturers build devices that are secure by design and move connected clinical technology through regulatory review.

Its product line centers on MSI, described as a single platform for medical device cybersecurity compliance that operates in three stages: scoring a manufacturer's submission readiness against the domains FDA evaluates and identifying gaps; flagging or generating compliant documentation in FDA's own language; and maintaining readiness after clearance through automated self-audits, vulnerability monitoring and alerts when guidance changes. A separate Medical Device Product Security Intelligence Platform lets manufacturers benchmark product security maturity across business units and against industry peers, model the potential financial impact of unresolved vulnerabilities, and compare remediation options on cost, feasibility and impact. Earlier product descriptions cover cryptography, behavior monitoring and vulnerability inventory tooling for devices ranging from glucose monitors to hospital surgical robots, with software that lets device vendors apply cryptography to data in transit and at rest and receive remote, real-time alerts on suspicious device behavior.

Alongside the software, Medcrypt runs a services organization staffed in part by former FDA reviewers and policy staff. Pre-market services include regulatory cybersecurity readiness, threat modeling and risk mitigation, cybersecurity maturity assessments, PKI and cryptography analysis, FDA hold-letter and AINN response support, and integration of SBOM generation, vulnerability scanning and security testing into the software development lifecycle using FDA-recognized frameworks such as AAMI TIR-57 and SW96. Post-market services cover continuous monitoring, cybersecurity risk management and prioritization, SBOM validation and monitoring, incident response and ongoing regulatory compliance maintenance.

Founding story

The company was founded in 2016 with the stated aim of addressing cybersecurity concerns in the medical device manufacturing sector and ensuring that devices people rely on are as safe and secure as technologically possible. Founder and CEO Mike Kijewski previously founded Gamma Basics, a radiation oncology software startup acquired by Varian Medical Systems in 2013; CTO Eric Pancoast was a Gamma Basics co-founder. The company has framed its product development against successive FDA cybersecurity guidance milestones beginning with the agency's 2014 pre-market recommendations and 2016 post-market guidance.

Business model

Medcrypt sells subscription-style access to compliance and security platforms (MSI and the Product Security Intelligence Platform) together with professional services engagements delivered by regulatory and security experts. Entry points include a free, self-serve readiness check requiring no login, downloadable datasheets, early-access sign-ups for the intelligence platform, and threat-model reviews, which route prospects into paid pre-market and post-market service engagements. For new services customers the company offers a stated guarantee: if the customer follows its guidance and the product meets cybersecurity expectations, Medcrypt supports the customer through all FDA feedback until the cybersecurity documentation is accepted, with no hidden fees or handoffs.

Revenue comes from platform access and expert services engagements sold to medical device manufacturers, spanning pre-market submission preparation and post-market lifecycle compliance work, with a stated no-hidden-fees, no-handoff structure and an approval guarantee for new customers.

Traction

Medcrypt reports 140+ medical device manufacturer customers, 13 of the top 50 global MDMs, 200+ projects delivered across 60+ clients, and a 100% FDA approval rate since 2023. At the time of its 2022 Series B it stated it provided security features and services to seven of the top 10 medical device manufacturers as well as startups and mid-sized companies.

Latest developments

Medcrypt's current positioning centers on MSI, a single platform spanning readiness scoring, documentation remediation and post-clearance monitoring, offered with a free readiness check and a 100% FDA approval rate guarantee. It is also offering early access to its Medical Device Product Security Intelligence Platform for security posture benchmarking and financial risk quantification, and is publishing guidance on the 2026 regulatory framework changes including QMSR inspections and the EU Cyber Resilience Act reporting deadline of September 11, 2026.