FDA's electronic submission template asks for the penetration test report in one place. The Cybersecurity Testing question of the nIVD eSTAR, version 7.1, reads "Please attach a document(s) that describes the cybersecurity testing performed and the associated test reports," and lists penetration testing beside security requirement, threat mitigation and vulnerability testing. Its help text repeats the premarket cybersecurity guidance FDA issued on 3 February 2026: "Penetration test reports should be provided," with five elements that start with the independence and technical expertise of the testers.
That attachment is read twice. Within about 15 days, FDA's technical screening checks that every applicable attachment question has a relevant attachment and that the answers describe the device accurately, and FDA's cybersecurity FAQ says an eSTAR "will be put on a Technical Screening hold if it does not contain accurate responses and relevant attachments in the Cybersecurity section." Later, a reviewer reads the report itself, and what it lacks comes back as an Additional Information request with a 180-day clock.
Quick answer. The penetration test report goes in the Cybersecurity Testing question of the eSTAR's Cybersecurity section: the original report from the testing firm, plus your assessment of every finding and the rationale for any fix you deferred. Section 524B of the FD&C Act never names penetration testing, but FDA's 3 February 2026 guidance and the eSTAR help text do, and the only alternative eSTAR offers is "a justification for why particular testing was not performed." A missing or irrelevant attachment, or an inaccurate answer, puts the submission on a technical screening hold with 180 days to send a replacement eSTAR; weaknesses in the report return as an Additional Information request, with 180 calendar days to answer for a 510(k). Stingrai, a CREST-accredited penetration testing firm, tests a cyber device's clinician portal, APIs, cloud and mobile app as an external team of named penetration testers, with retesting and an attestation letter; firmware and radio testing goes to a hardware lab.
Which submissions use eSTAR, and when the cybersecurity section applies
eSTAR is an interactive PDF form, and since 1 October 2023 every 510(k) must use it unless exempted. De Novo requests followed on 1 October 2025. FDA's eSTAR page, content current as of 21 September 2026, lists the rest:
Submission | eSTAR use | Template |
|---|---|---|
510(k): Traditional, Special and Abbreviated | Mandatory unless exempted, since 1 October 2023 | nIVD or IVD eSTAR 7.1 |
De Novo request | Mandatory unless exempted, since 1 October 2025 | nIVD or IVD eSTAR 7.1 |
PMA: original, panel-track, real-time, 180-day and 30-day notice/135-day supplements | Voluntary | nIVD or IVD eSTAR 7.1 |
IDE, Q-Submission, 513(g) request | Voluntary | PreSTAR 3.1 |
The cybersecurity section is not optional for a connected product. Its help text applies it when the device or system can communicate with other devices, has a network or server connection, unused network ports, any wireless link (Bluetooth, Wi-Fi, cellular, RF or inductive), a USB port or physical media access such as JTAG, software or firmware downloads, or cloud storage or services, and says: "Providing documentation regarding the Cybersecurity is required if the submission is a 510(k), PMA, De Novo, or HDE, and any of the above conditions are met."
Two version rules matter when a deficiency arrives. If you file on an older major version of eSTAR, FDA says "you may receive additional information requests related to the major changes." Once FDA acknowledges the submission, it is "grandfathered" to that version, and every response goes into the original eSTAR file.
What section 524B requires, quoted
Section 524B of the FD&C Act (21 U.S.C. 360n-2), in force since 29 March 2023, applies to a "cyber device," one that "(1) includes software validated, installed, or authorized by the sponsor as a device or in a device; (2) has the ability to connect to the internet; and (3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats." Its sponsor shall:
(1) submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures; (2) design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems ...; (3) provide to the Secretary a software bill of materials, including commercial, open-source, and off-the-shelf software components
The statute never uses the word penetration. The test answers 524B(b)(2), and FDA reads "related systems" to include "software/firmware update servers, and connections to healthcare facility networks." FDA also reads "ability to connect to the internet" broadly: a USB, ethernet or serial port counts. Failing a 524B(b)(2) requirement is a prohibited act under section 301(q). The medical device penetration testing ranking covers who 524B reaches and how to choose a testing firm; this brief covers the submission.
The eSTAR cybersecurity section, question by question
The nIVD eSTAR 7.1 opens its cybersecurity section with one routing question and then 13 headed parts. FDA's guidance, which never uses the word eSTAR, asks for the same documents in its Appendix 4.
Figure 1: The eSTAR 7.1 cybersecurity section and where penetration test evidence feeds it, read 23 October 2026. Source: FDA, eSTAR Program, nIVD eSTAR version 7.1.
The penetration test touches more of the section than the Testing question:
The routing question reads: "Is the premarket submission for a device modification(s) to an existing FDA authorized device, and is the cybersecurity of the device unaffected by the modification(s)?" Answering "Yes" hides the risk management report, threat model, risk assessment, anomalies, metrics, controls, architecture views, testing and labeling parts, and leaves the general information, the SBOM, two documents on vulnerabilities with uncontrolled risk, and the management plan. The guidance lists "changes to authentication or encryption algorithms, new connectivity features, or changing software update process/mechanisms" as changes that may affect cybersecurity, and those need the full section, testing included.
The risk management report must describe "a separate, parallel, and interconnected security risk management process," and the guidance asks it to "provide traceability between the threat model, cybersecurity risk assessment, SBOM, and testing documentation."
The threat model must address "all the end-to-end elements of the system," name its methodology (eSTAR offers STRIDE, attack trees, kill chain and DREAD as examples), and state whether it contains the four architecture views. The threat model sets what the test has to cover.
The risk assessment question asks whether it "avoid[s] using probabilities for the likelihood assessment and use[s] exploitability instead." A penetration test is direct exploitability evidence, and the guidance spells out why it matters: "If a penetration tester, for example, was able to exploit a vulnerability, the ability of a threat actor to exploit that vulnerability is likely to increase over the device lifecycle."
The SBOM part carries a trap: listing an operating system "no longer supported or nearing end of support ... will generally be considered an inaccurate response," and inaccurate responses are grounds for a technical screening hold.
Unresolved anomalies asks for the cybersecurity impact of each open issue, or "a document stating that no unresolved anomalies exist." Findings still open at submission belong here, with the "criteria and rationales" the guidance asks for.
Cybersecurity Testing is where the report goes, beside the evidence for the other testing types.
Where the penetration test sits among FDA's four testing types
Section V.C of the guidance names four types of testing, "among others," to consider for the submission, and the Testing question repeats them. Penetration testing is the last, defined as tests "that focus on discovering and exploiting security vulnerabilities in the product."
Testing type | What FDA asks for | Who usually produces it | What a software penetration testing firm adds |
|---|---|---|---|
Security requirements | "evidence that each design input requirement was implemented successfully," plus "evidence of their boundary analysis and rationale for their boundary assumptions" | The manufacturer's verification team | Verification of authentication, authorization and session requirements on the portal and APIs |
Threat mitigation | Testing of risk controls "according to the threat models provided in the global system, multi-patient harm, updatability and patchability, and security use case views" | The manufacturer, with its testers | Execution of the security use cases that run through the portal, APIs, cloud and mobile app |
Vulnerability testing | Abuse and misuse cases with malformed and unexpected inputs, robustness and fuzz testing, attack surface analysis, vulnerability chaining, closed box known-vulnerability scanning, software composition analysis of binaries, and static and dynamic code analysis, including hardcoded and default credentials | Manufacturer tooling and test labs | Attack surface analysis, dynamic analysis and vulnerability chaining on the software surfaces |
Penetration testing | A report with the independence and technical expertise of the testers, scope, duration, methods, and results, findings and observations | Independent testers | The report itself |
FDA wants all four tied together. The risk management report must trace the threat model to the testing, and threat mitigation tests are judged against the threat model's views. Our recommendation is a one-page traceability table in the report appendix: threat model entry, the test case that exercised it, the finding (or none), its exploitability score and its disposition. For timing, the guidance says testing "should occur throughout the SPDF" and, after release, "at regular intervals commensurate with the risk (e.g., annually)."
Technical screening hold, refuse to accept and Additional Information requests
eSTAR submissions are not expected to go through refuse to accept
The 510(k) eSTAR guidance says eSTAR submissions "are not anticipated to undergo a refuse to accept (RTA) process," because the portal checks completeness. For cyber devices, FDA's March 2023 policy said it generally would not refuse submissions sent before 1 October 2023 solely for missing 524B information; the FAQ confirms the policy "expired on October 1, 2023."
The technical screening hold
For eSTAR, FDA runs technical screening instead. It verifies "that eSTAR responses accurately describe the device(s)" and that "there is at least one relevant attachment per each applicable attachment-type question," and it is anticipated within 15 days of receipt, once the user fee is paid. The eSTAR page lists the two failures: "none of the attachments to a question are relevant to the question," or "an inaccurate response is provided to any question." It adds that inaccurate answers to drop-down fields "causing the eSTAR to omit subsequent questions" may lead to an early hold. Answering "Yes, unaffected" to the routing question for a change that touches authentication or connectivity would be that kind of answer, because it hides the Testing question.
After a failed screen, FDA emails the submitter, names the incomplete information, and holds the submission. "If a replacement eSTAR is not received within 180 days of the date of technical screening deficiency notification, FDA will consider the 510(k) to be withdrawn," and the De Novo guidance says the same. A submission that passes has its review clock start on the day FDA received it.
Additional Information requests
The substantive review comes next. For a 510(k), FDA aims for a Substantive Interaction within 60 calendar days of receiving the accepted submission, and it "can be an AI request." FDA's deficiency guidance calls these letters "additional information letters" for 510(k)s and De Novo requests and "major deficiency letters" for PMAs, and each deficiency should state what was submitted, the specific issue, the basis for it, and the information needed.
Figure 2: FDA clocks that apply to the cybersecurity section, in calendar days. Sources: FDA, 510(k) eSTAR guidance; FDA, 510(k) review clock guidance; De Novo and PMA review clock guidances.
510(k): FDA "intends to automatically grant a maximum of 180 calendar days from the date of the AI request" and issues a notice of withdrawal under 21 CFR 807.87(m) if the complete response is late.
De Novo: the request is withdrawn without a complete response "within 180 calendar days after the date FDA issues such request" (21 CFR 860.250(a)(1)).
PMA: 180 calendar days under 21 CFR 814.44(g), plus one automatic 180-day extension, for 360 in total; a response after that is treated as a resubmission, with a new PMA number and a new user fee.
The guidance shows where an inadequately answered cybersecurity request ends for a 510(k). In its example of a central nursing station alarm without the encryption needed against a recent threat, "FDA may ask for additional performance data," and "if the data provided is inadequate, FDA would likely make a determination that the new device is not substantially equivalent (NSE)."
How to answer a cybersecurity deficiency about the penetration test
FDA's deficiency guidance gives the response format: restate the issue, then provide "the information or data requested," "an explanation why the issue does not affect or impact the marketing authorization decision," or "alternative information and an explanation describing why the information adequately addresses the issue." Give the deficiency number and "an identical restatement of the Agency's question."
The mechanics sit in the eSTAR itself: modify the original file, select Additional Information under Application Sub-Type, paste each FDA question with your answer below it, and "add new attachments to the sections impacted by the deficiencies," leaving the rest unchanged. A retest report goes into the Cybersecurity Testing question beside the original, because eSTAR accepts several attachments per question.
A working sequence that fits inside the 180 days (our recommendation, not an FDA timetable):
Week | Work | FDA basis |
|---|---|---|
1 | Map each deficiency to the guidance sentence it cites and the eSTAR heading it affects | The deficiency's "statement of basis" |
1 to 2 | Agree a scope addendum or retest plan with the testing firm, naming the build to be tested | Guidance V.C, scope and duration elements |
2 to 5 | Test or retest; fix and retest exploited findings | Guidance V.A.2 on exploitability |
5 to 6 | Update the risk assessment, unresolved anomalies, traceability and any deferral plan | Guidance V.A and V.C |
6 to 7 | Reassemble the original eSTAR with the new attachments and answers | eSTAR page, Responding to CDRH Requests |
Seven penetration test gaps the guidance makes predictable
FDA has not published a list of its most common cybersecurity deficiencies, and this post does not invent one. Each gap below is traced to a sentence in FDA's own text, so a reviewer could cite it as the basis for a deficiency.
Figure 3: Seven report gaps, the FDA text behind each, and the fix. Sources: FDA, Cybersecurity in Medical Devices guidance, 3 February 2026 and nIVD eSTAR 7.1.
No statement of who tested and how independent they are. Reports should say "by whom the testing was performed (e.g., independent internal testers, external testers) and what level of independence those responsible for testing devices have from the developers," and "it may be necessary to use third parties." Fix: an independence statement on the report's first pages, naming the testers and their relationship to the development team.
A summary in place of the report. "For any third-party test reports, manufacturers should provide the original third-party report." Fix: attach the full original report, without password protection, which FDA discourages; an attestation letter or executive summary serves hospital customers, not the eSTAR.
Findings with no disposition. Manufacturers should give "their assessment of any findings including rationales for not implementing or deferring any findings to future releases," and a deferral needs a plan naming the vulnerabilities, the release timeline, whether interim devices get the update, and how long it takes to reach them. Fix: a disposition table for every finding.
A scope that stops at the device. The global system view should include "any software update infrastructure(s)" and "cloud connections," and 524B's related systems include update servers. Fix: a scope addendum test of the missing surfaces, or the "boundary analysis and rationale for their boundary assumptions" FDA asks for under security requirements testing.
Tests that do not trace to the threat model. Threat mitigation testing should follow the four architecture views. Fix: the traceability table described above.
Exploited findings scored by probability. eSTAR asks whether the assessment uses exploitability, and the guidance says vulnerabilities in CISA's Known Exploited Vulnerabilities Catalog "should be designed out of the device." Fix: rescore exploited findings, fix them and retest.
A tested build that differs from the submitted one. FDA asks for the scope and duration of testing; this gap is our recommendation, not FDA text. Fix: name the build and test dates in the report, and retest the submitted build after fixes.
Scope split: software testing and the hardware bench
A cyber device test usually needs two kinds of lab:
Software surfaces: the clinician or patient web portal, the backend REST or GraphQL APIs, the cloud tenancy, the companion iOS and Android apps, and the web endpoints of the update service. This is the work of an application and cloud penetration testing firm.
Hardware surfaces: firmware extraction and analysis, secure boot, debug interfaces such as JTAG and UART, and the device's radios, including Bluetooth Low Energy and inductive links. This needs a hardware bench.
Both reports go into the same Cybersecurity Testing question, and both need the five elements. A SaMD product has no hardware half; FDA expects a SaMD with limited dependencies and connectivity will "likely only need to have single architecture view" for each of the global, multi-patient harm and updatability views, so its test is entirely software. The FHIR API scoping guide covers the health data APIs many of these products expose.
Canadian manufacturers: Health Canada and the same template
Health Canada's Pre-market Requirements for Medical Device Cybersecurity, effective 26 June 2019, asks for its cybersecurity evidence with Class III and IV licence applications (section 1.3), and its Table 2 in section 2.1.3 lists "Structured Penetration Testing" beside known vulnerability, malware and fuzz testing.
The template is converging too. eSTAR 7.1 has an Application Jurisdiction field with US FDA and Health Canada as its options, and Health Canada's eSTAR pilot opened the FDA-developed template to new and significant change amendment applications for Class III and IV devices, for 30 participants. In our view, one report written to FDA's five elements is the stricter specification and can serve both files. The Canadian digital health requirements guide covers the provincial side.
What testing costs
The testing is the part of the cybersecurity section a manufacturer buys. Stingrai's fixed prices cover one web application and associated APIs (pricing, read 23 October 2026), with Canadian dollar figures at the Bank of Canada rate of 1.4021 on 22 October 2026:
Autonomous Pentest: Snipe only, no penetration testers, at US$3,000 (about C$4,206) per assessment, or US$650 (about C$911) a month on a 12-month plan.
Hybrid Pentest: Snipe and penetration testers testing together, at US$6,800 (about C$9,534) per assessment, or US$1,275 (about C$1,788) a month.
A submission-grade test of a device's portal, APIs, cloud and mobile app is human-led and quoted through Get a Quote. The report's first element is the "independence and technical expertise of testers," which named human testers answer directly, so the Autonomous Pentest fits the portal between submissions rather than the eSTAR report.
What to ask a penetration testing firm before the submission
Will the report carry all five FDA elements, including an independence statement and the test dates?
Will the scope follow our threat model and architecture views, including update servers, cloud and mobile apps?
Can you name the build you test, and retest the submitted build after fixes?
Will you give exploitability evidence our risk assessment can use?
How fast can you run a scope addendum or retest when an Additional Information request arrives?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a device or SaMD manufacturer, Stingrai is the external team for the software half of the submission. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, and Stingrai Inc. holds CREST accreditation for penetration testing (CREST Marketplace).
Portal and APIs: authenticated web application and API testing across clinician, technician, administrator and patient roles, aimed at broken authorization, IDOR and business logic.
Cloud: cloud testing from the control plane to the workload in AWS, Azure and Google Cloud, including the update and provisioning services.
Mobile: iOS and Android testing of the companion app and its backend, aligned with OWASP MASVS and MASTG.
Evidence: every confirmed finding is posted to the PTaaS platform with a proof of concept and remediation guidance, retesting is included, and every human-led and hybrid report ships with an attestation letter for hospital customers, beside the full report that goes into eSTAR.
Engagements run as a one-time test timed to the submission or as a continuous program between releases. Snipe, Stingrai's autonomous AI agent, covers web applications and their APIs only. Firmware, debug interfaces and device radios are outside Stingrai's scope and belong with a hardware lab whose report sits beside Stingrai's in the same eSTAR question.
Frequently Asked Questions
Does an FDA eSTAR submission need a penetration test?
Not by statute: section 524B of the FD&C Act never uses the word penetration. FDA's guidance of 3 February 2026 says penetration test reports "should be provided," and the eSTAR Cybersecurity Testing question asks for test reports or "a justification for why particular testing was not performed." For a connected device, a missing report means writing that justification.
Where does the penetration test report go in eSTAR?
In the Cybersecurity Testing question of the Cybersecurity section, which asks for "the associated test reports" and, for third-party testing, the original report and your assessment of any findings. Open findings also belong in the Assessment of Unresolved Anomalies, and exploitability evidence feeds the Cybersecurity Risk Assessment.
What puts the eSTAR cybersecurity section on a technical screening hold?
FDA's cybersecurity FAQ says an eSTAR goes on hold "if it does not contain accurate responses and relevant attachments in the Cybersecurity section." Examples from FDA's own material include an attachment that is not relevant to its question, an inaccurate drop-down answer that hides later questions, and listing an unsupported operating system. A replacement eSTAR is due within 180 days.
How long do I have to answer an FDA cybersecurity deficiency?
For a 510(k), FDA automatically allows 180 calendar days from the date of the Additional Information request and issues a notice of withdrawal if a complete response has not arrived by then. A De Novo request also has 180 calendar days. A PMA has 180 days to answer a major deficiency letter plus one automatic 180-day extension, 360 days in total.
Can an attestation letter or executive summary replace the full penetration test report?
No. FDA's guidance says "for any third-party test reports, manufacturers should provide the original third-party report," along with the manufacturer's assessment of the findings. An attestation letter is useful for hospital procurement teams; the eSTAR needs the full report.
Does a device modification need a new penetration test?
It depends on the change. eSTAR 7.1 skips the Testing question when the modification leaves cybersecurity unaffected, and asks instead for the SBOM, two documents on vulnerabilities with uncontrolled risk, and the management plan. Changes to authentication or encryption, new connectivity or a new update process bring back the full section, testing included.
Is eSTAR required for a PMA?
No. FDA's eSTAR page lists PMAs and PMA supplements under voluntary use, while 510(k) and De Novo submissions must use eSTAR unless exempted. The cybersecurity content is the same either way.
Does Health Canada accept eSTAR?
Health Canada has run an eSTAR pilot for new and significant change applications for Class III and IV devices, and eSTAR 7.1 offers Health Canada as an application jurisdiction. Its 2019 cybersecurity guidance lists structured penetration testing among the expected types of testing.
Related reading
References
FDA. Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. 3 February 2026. https://www.fda.gov/media/119933/download. Final guidance; section V.C sets the four testing types and the penetration test report elements.
FDA. eSTAR Program and Non-In Vitro Diagnostic (nIVD) eSTAR, version 7.1. Page content current 21 September 2026. https://www.fda.gov/medical-devices/how-study-and-market-your-device/estar-program. Mandatory and voluntary use, technical screening, AI and hold responses, and the template's cybersecurity questions.
FDA. Cybersecurity in Medical Devices Frequently Asked Questions. Content current 26 June 2025. https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs. Technical Screening hold for the cybersecurity section; expiry of the cyber RTA policy.
FDA. Electronic Submission Template for Medical Device 510(k) Submissions. 2 October 2023. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-submission-template-medical-device-510k-submissions. Technical screening and the 180-day replacement window.
FDA. Electronic Submission Template for Medical Device De Novo Requests. 23 August 2024. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-submission-template-medical-device-de-novo-requests. Sets 1 October 2025 for mandatory De Novo eSTARs.
FDA. Developing and Responding to Deficiencies in Accordance with the Least Burdensome Provisions. 26 October 2022. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/developing-and-responding-deficiencies-accordance-least-burdensome-provisions. Four elements of a deficiency and the recommended response format.
FDA. FDA and Industry Actions on Premarket Notification (510(k)) Submissions: Effect on FDA Review Clock and Goals. 3 October 2022. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/fda-and-industry-actions-premarket-notification-510k-submissions-effect-fda-review-clock-and-goals. Substantive Interaction and the 180-day AI response window.
FDA. FDA and Industry Actions on De Novo Classification Requests and on Premarket Approval Applications (PMAs): Effect on FDA Review Clock and Goals. 3 October 2022. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/fda-and-industry-actions-de-novo-classification-requests-effect-fda-review-clock-and-goals and https://www.fda.gov/regulatory-information/search-fda-guidance-documents/fda-and-industry-actions-premarket-approval-applications-pmas-effect-fda-review-clock-and-goals. Withdrawal rules under 21 CFR 860.250 and 814.44(g).
US Government Publishing Office. 21 U.S.C. 360n-2, Ensuring cybersecurity of devices, United States Code, 2024 edition. https://www.govinfo.gov/content/pkg/USCODE-2024-title21/html/USCODE-2024-title21-chap9-subchapV-partA-sec360n-2.htm. Section 524B of the FD&C Act.
Federal Register. Medical Devices; Quality System Regulation Amendments, 89 FR 7496, 2 February 2024, and Refuse to Accept Policy for Cyber Devices, 88 FR 19148, 30 March 2023. https://www.govinfo.gov/content/pkg/FR-2024-02-02/html/2024-01709.htm and https://www.govinfo.gov/content/pkg/FR-2023-03-30/html/2023-06646.htm. QMSR effective 2 February 2026; the 2023 RTA policy.
Health Canada. Pre-market Requirements for Medical Device Cybersecurity, effective 26 June 2019, and The eSTAR pilot: Notice to industry. https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/cybersecurity/document.html and https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/estar-pilot-notice-industry.html. Class III and IV testing expectations and the eSTAR pilot.
Stingrai. Pricing. Read 23 October 2026. https://www.stingrai.io/pricing
Talk to Stingrai
Stingrai will test the portal, APIs, cloud and mobile app of your cyber device with named penetration testers, write the report to FDA's five elements, and retest the build you submit, as a one-time test timed to the eSTAR or a continuous program between releases. Get a quote or book a free discovery call.
