Perspective
Plan and Fund Security Support for a Connected Device Before You Sell It
A connected device keeps meeting new vulnerabilities after it is installed. We turn that into a ranked, costed plan, so security support is funded for as long as the device is in service.
5-minute read5 November 2026
In Brief
- Device software keeps meeting new vulnerabilities in components you did not write. Unplanned, that becomes an unfunded obligation that grows with every unit installed.
- Four actions settle it before the next sale: know what is installed, record each component's end-of-support date, decide who responds to a new vulnerability, and price patching into the device.
- Thinqmesh ranks your device risks by business impact, tightens access, rehearses your response, and hands you a costed plan within four weeks.
For the manufacturer's finance team, a connected device is largely finished business once it has been installed and invoiced. Its software is not finished at all. It keeps running in a hospital while new vulnerabilities are published in components you did not write, on a timetable you do not control.
Security Support Is a Cost That Lasts as Long as the Device
In the United States, section 524B of the Federal Food, Drug, and Cosmetic Act asks the sponsor of a cyber device to plan for postmarket vulnerabilities, to make updates and patches available, and to supply a software bill of materials. FDA reads the idea of connection broadly, so a product you regard as stand-alone deserves a second look.
A filing describes how the company will behave for years after the sale, and keeping to it takes registers, a rota of people who can judge a new vulnerability, field engineers able to deliver a patch, and a way of telling the customer what to do. Those are support capabilities, and they need a budget that lasts as long as the devices do. We start by ranking the risk in business terms, because a figure leadership can read is the one that gets funded.
Four Actions That Put Security Support on the Budget
Each one can start from records you already hold, and together they give finance a figure to plan against.
Know Exactly What Is Installed, and Where
A register of units, sites and software versions is the base for every later decision.
When a vulnerability is published, the first question is which devices are affected. We help you build the register that answers it, with each unit's site, its software version and the last time anyone had contact with it. Gaps in that register show where support has already thinned out.
Get started
- Pick one connected product family and list every installed unit with site and version.
- Mark units with no contact in the last year.
Record the End-of-Support Date of Every Component
The earliest date in the bill of materials sets the real limit on the device's service life.
Components you did not write have their own support periods. Set each date beside the service life you expect, and the shortfall becomes a figure finance can plan for. Where a device will outlive a component, you can decide in advance how it will be handled and tell customers plainly.
Get started
- List each component with its supplier and support end date.
- Compare the earliest date with the service life you expect.
Decide Who Responds When a Vulnerability Is Published
A named person judges each new vulnerability against the device and reaches the customer quickly.
We rank risk by business impact, then agree roles in advance: who hears first, who decides, who speaks to the hospital's technical teams and what happens first. Your team rehearses a realistic scenario so these decisions have been practised before they are needed.
Get started
- Write down who hears about a new vulnerability and who decides what happens next.
- Walk through a critical vulnerability published on a Friday and note every gap.
Price Patching Into the Device
Security updates belong inside the price or a clearly stated support term.
If patches arrive only with a live maintenance contract, unpatched devices collect among customers whose contracts have lapsed. Our view is that the cost belongs in the price of the device or in a stated support term, so it is visible when the product is sold and funded for as long as the device is in service.
Get started
- Estimate the yearly cost of monitoring, testing and delivering patches for one product family.
- Decide where that cost appears in the price or the support terms.
How Thinqmesh Solves This
We start by establishing what matters most to the business, then rank your exposure against it. Four weeks produce a risk assessment in business terms and a costed plan.
- Week 1
What Matters Most
We establish which data, systems and processes matter most to the business. That ranking directs each later stage.
- Week 2
Access and Exposure
We review who can reach what, and where the organisation is exposed, against that ranking.
- Week 3
Risk in Business Terms
Findings are ranked by business impact, so leadership can see what each risk could cost and decide accordingly.
- Week 4
A Costed Plan
You receive the risk assessment and a costed plan to close the gaps, in the order that matters most.
You finish with a ranked view of your device risk, a costed plan you can take to finance, and a response your team has worked through. Support becomes a planned cost with named owners.
