SecDevOps Does Not Solve the Economic Problem

Security vendors touting “shift left” and “DevSecOps” tools do not address this microeconomic challenge in healthcare.

Evolving the Economics of Healthcare Software Procurement

For better or worse, we have reached the point of Something’s Gotta Give. The FDA now requires a software bill of materials (SBOM) for medical device approval — a game-changer for hospital safety.

The Broken Economics of Vulnerability Management

In the private and the public sectors, vulnerability management is becoming a mandatory business process, and it is a required control in security frameworks or regulatory initiatives (NIST, SOC2, EO 14028). However, the processes for detecting and remediating known vulnerabilities are doomed from the start—for several reasons. The first is that most vulnerable and exploitable software, including malware in medical devices, does not have a common vulnerability and exposure (CVE), and never will.

How SBOMs Help Hospitals Assess Maintainability

SBOM analysis allows hospitals to evaluate whether software vendors are updating components proactively. Exiger’s research shows that many open-source vulnerabilities in healthcare platforms stem not from the OSS community, but from vendors using outdated components. Technical debt metrics can expose when a PACS or EHR platform is six versions behind on critical dependencies.