A Hands-On Platform for Medical Device Security Education

Modern medical devices integrate hardware and software, thereby expanding the attack surface and creating patient safety risks. Regulators set cybersecurity expectations, and international standards guide implementation. However, outcome-based, method-agnostic policies give manufacturers wide latitude, producing variability, ambiguity, and fragmented, non-reproducible practices in training and education. We address this gap with a reproducible, open-source reference platform that operationalizes security-by-design in alignment with current regulatory expectations and standards. We also report an initial pilot course using the platform as a foundation for consistent medical-device cybersecurity curricula.