When your insulin pump connects to your phone or your glucose monitor shares data with the cloud, is it secure? And what does "secure" even mean?

In this episode of Inside MedTech Innovation, Shannon Lantzy sits down with Jacob Combs, Chief Information Security Officer and VP of Cybersecurity at Tandem Diabetes Care. Jacob brings deep expertise from across telecom, defense, financial services, and healthcare—and now protects connected devices that deliver life-sustaining insulin therapy to people with diabetes.

This conversation explores the unique challenges of medical device cybersecurity: the tension between usability and security, the reality of legacy systems and security debt, how to scale security by design across engineering teams, and why regulatory requirements can actually be a competitive advantage.

Jacob and Shannon discuss:

• Why medical device security is fundamentally different from enterprise IT security

• The critical balance between safety risk and security risk in insulin delivery systems

• How threat modeling becomes a verb that transforms engineering culture

• The challenge of maintaining security across interoperable diabetes management ecosystems

• Why "secure enough" requires sophisticated risk management, not just risk assessment

• How compensating controls and lifecycle management address security debt in fielded devices

• The role of FDA guidance in driving security programs forward

• What it takes to push software updates quickly while maintaining quality and regulatory compliance

Timestamps

• 00:00 Introduction to Medical Device Cybersecurity

• 01:03 Meet Jacob Combs: Expert in Medical Device Cybersecurity

• 02:12 The Mission-Driven Approach to Cybersecurity

• 03:16 Balancing Safety and Security in Medical Devices

• 05:18 Challenges in Medical Device Cybersecurity

• 09:57 The Role of a CISO in Medical Device Companies

• 13:55 Risk Management and Cybersecurity in Medical Devices

• 17:17 Interoperability and Complexity in Medical Devices

• 26:55 Future of Cybersecurity in Medical Devices

• 36:08 Cybersecurity in Med Tech: A Non-Competitive Necessity

• 36:30 The Ethical Dilemma of Charging for Security

• 37:25 Product Security as a Growth Engine

• 38:50 Marketing Security: A Competitive Edge

• 39:32 Quality and Security: A Symbiotic Relationship

• 41:08 Regulatory Challenges and Operational Efficiency

• 42:36 Measuring Cybersecurity Quality

• 43:57 Navigating Regulatory Requirements

• 51:23 Innovating with AI in Security Documentation

• 55:25 Threat Modeling: A Cultural Shift

• 59:23 Legacy Devices and Security Debt

• 01:06:03 Balancing Security and Innovation

• 01:09:08 Rapid Fire Questions and Closing Thoughts

Follow Shannon and Jacob:

Connect with Shannon : 

LinkedIn: https://www.linkedin.com/in/shannonlantzy/

Website: https://www.shannonlantzy.com/

Connect with Jacob: 

LinkedIn: https://www.linkedin.com/in/jacobcombs/

Website: Left to Our Own Devices Podcast

When Justin Eastzer was misdiagnosed with type 2 diabetes at 30, he turned to TikTok to share his experience with a new glucose meter. The community's response changed everything: he actually had type 1 diabetes, and his doctor had missed it. That moment launched Diabetic Tech, now one of the most trusted patient education platforms in the diabetes space with over a million downloads. 

In this conversation with Shannon Lantzy, Justin breaks down the disconnect between what medtech companies think users want and what actually matters. He shares why the DIY diabetes community has been building their own automated insulin delivery systems since 2016, how AI meal-snap features could transform daily management, and why companies announcing problems matters more than the problems themselves. Justin also discusses the regulatory tension between innovating for advanced users versus protecting the broader population, and offers a compelling vision for how continuous software updates could bring diabetes tech to the speed of consumer technology.

Timestamps:

[00:00:00] Introduction and Justin's misdiagnosis journey

[00:04:15] What makes Diabetech's approach unique

[00:08:25] Balancing entertainment, education, and technical accuracy

[00:12:10] Language matters: "diabetic" vs "person living with diabetes"

[00:14:30] Creative bursts during low blood sugars

[00:18:35] Interviewing executives and asking hard questions

[00:21:50] The Dexcom G7 sensor issues and transparency problems

[00:25:10] Real-time discussion of Tandem pump safety alert

[00:29:30] Why transparency matters more than the problem itself

[00:33:20] Justin's business model and team structure

[00:37:45] The innovation speed problem in diabetes tech

[00:40:30] AI meal-snap features: the holy grail that's already here in DIY

[00:46:35] What it's like to calculate carbs for every meal

[00:49:05] Exercise management and the temp basal feature gap

[00:51:25] A1C vs time in range vs lived experience

[00:56:00] CGMs for wellness: opportunity or distraction?

[01:02:20] Balancing innovation for advanced users vs general safety

[01:05:10] Shannon's moonshot proposal for trustworthy software updates

[01:13:25] Cybersecurity, safety testing, and the path to faster features

[01:14:50] Rapid fire questions

Follow Shannon and Justin:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com/

Connect with Justin: 

LinkedIn: https://www.linkedin.com/in/justin-eastzer-70402034

Website: https://www.tiktok.com/@diabe_tech

Most medical device companies think quality systems slow them down. Kyle Rose proves the opposite is true.

Kyle Rose is the founder and president of Rook Quality Systems, a consulting firm that helps early-stage medical device companies build efficient, compliant quality management systems. With 13 years of experience and nearly 40 employees, Rook has guided companies through FDA submissions, acquisitions, and their first audits by focusing on lean processes over bureaucracy.

In this conversation, Kyle shares stories from the trenches: the software company that accidentally logged thousands of "complaints" in Zendesk, the smart pill dispenser that failed to block light properly, and the COVID diagnostics work that helped get critical products to market fast. He explains why quality systems actually help companies catch problems before they become catastrophic, how AI is changing regulatory submissions, and why more over-the-counter medical devices could transform healthcare access.

Timestamps:

• [00:01:30] Introduction to Rook Quality Systems

• [00:02:10] Kyle's journey from industry to consulting

• [00:05:20] Professional lessons and standout moments

• [00:08:05] When software companies realize they're medical devices

• [00:09:15] The Zendesk complaint story

• [00:13:05] Success story: acquisition and first FDA audit

• [00:15:20] When companies don't buy into quality systems

• [00:16:40] The FDA warning letter discussion

• [00:19:00] How quality systems catch device failures

• [00:19:50] The smart pill dispenser light-blocking failure

• [00:24:30] How tech is changing consulting and compliance

• [00:28:45] MDSAP and international standards

• [00:31:15] FDA's Medical Device Development Tools program

• [00:34:00] Regulatory pathways that need improvement

• [00:37:10] What would help FDA reviewers most

• [00:42:05] Verifying hyperscalers like AWS and Google

• [00:44:35] Rapid-fire questions

  
  

Follow Shannon and Kyle:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com/

Connect with Kyle: 

LinkedIn: https://www.linkedin.com/in/kyle-rose-rook

Website: https://rookqs.com/

When Oleg Yusim joined Baxter in 2016 as one of the first dedicated medical device security architects, the industry was just beginning to understand that shared PINs like "4444" across entire product fleets weren't acceptable security. Ten years later, as Chief Product Security Officer at Illumina, he's mastered something far more difficult than technical security: translating cybersecurity risks into language that CEOs, CFOs, and boards actually understand and act on.

In this conversation with Shannon Lantzy, Oleg breaks down why medical device cybersecurity fundamentally differs from enterprise IT (hint: confidentiality takes a backseat to integrity and availability when lives are at stake), how to use data-driven benchmarks to show executives where they stand against competitors, and why the question isn't "can we afford this security investment" but rather "does this help us survive and do good in the world, or does it push us toward failure?" He also shares pointed advice for cybersecurity startups trying to break into medtech: elegant technical solutions mean nothing if they don't solve the industry's actual pain points, and coming from a DoD environment often raises red flags because commercial companies won't accept the productivity hits that military mandates require.

Timestamps:

• [00:00:00] Introduction and Oleg's recent AI hackathon success

• [00:03:40] How coincidence and life-critical systems shaped his career path

• [00:06:25] The jump from military communications to medical devices at Baxter

• [00:09:30] What it was like being a security architect when the field barely existed

• [00:11:05] Why medical devices had rudimentary security before 2014

• [00:13:00] CIA triad differences: why confidentiality isn't king in medtech

• [00:16:00] Integrity attacks on infusion pumps and why "nobody would do that" isn't valid

• [00:18:25] Medical devices as perfect attack footholds for hospital networks

• [00:20:40] HIMSS data: 5-10% of hospital attacks start from compromised devices

• [00:22:20] Building product security teams and changing company culture

• [00:26:10] The CEO presentation: three slides with data, thirty slides in your pocket

• [00:28:15] How to quantify cybersecurity posture as percentage of requirements met

• [00:30:55] Using benchmarks: FDA guidance, customer requirements, and competitor analysis

• [00:33:20] Why better security means faster sales and integration

• [00:36:50] Headcount vs vendor costs in security budgets

• [00:40:20] Risk acceptance conversations when budgets get cut

• [00:42:20] The critical importance of data-driven decision making

• [00:44:25] Framing security investments as business survival, not just cost

• [00:47:30] Advice for cybersecurity startups targeting medtech

• [00:49:30] Why DoD-derived solutions often miss commercial pain points

• [00:52:20] Rapid fire questions

Follow Shannon and Oleg:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com/

Connect with Oleg: 

LinkedIn: https://www.linkedin.com/in/olegyusim

Website: https://www.illumina.com/

Remote surgery across continents exists today, so why isn't it widespread in the United States?

Dr. Omar Al-Kalaa spent 15 years at FDA's Office of Science, Engineering and Laboratories, where he became the bridge between telecom operators, medical device manufacturers, and regulators. His work on wireless coexistence and 5G connectivity shaped how next-generation networks intersect with medical device safety. He convened 70+ stakeholders to create the Landscape Analysis of 5G in Healthcare and developed new evaluation methods for connected medical systems.

In this conversation, Omar reveals why your continuous glucose monitor competes with Netflix for wireless spectrum, what's actually preventing telesurgery in the U.S., and how he's continuing to advance connectivity innovation through his company Inovectrum.

Timestamps:

• [00:00:30] Introduction to Dr. Omar Al-Kalaa

• [00:02:50] Remote surgery: Science fiction or reality?

• [00:08:10] The Lindbergh Operation: First transatlantic telesurgery

• [00:15:25] How Omar convened the 5G healthcare working group

• [00:16:15] FDA's Office of Science, Engineering and Laboratories: Future-proofing the agency

• [00:22:30] Building the Medical Device Innovation Consortium working group

• [00:26:10] The Landscape Analysis of 5G in Healthcare

• [00:34:30] Wireless coexistence: Why your glucose monitor competes with Netflix

• [00:42:55] Omar's journey from PhD to FDA to entrepreneurship

• [00:45:30] Launching ECTRA and the future of connectivity innovation

• [00:49:35] Rapid-fire questions

Follow Shannon and Omar:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com/

Connect with Omar: 

LinkedIn: https://www.linkedin.com/in/omar-al-kalaa/

Website: https://www.linkedin.com/company/inovectrum/

What does it take to transform cybersecurity from reactive patch management to proactive secure design? Adam Shostack, the world's leading expert on threat modeling, takes us inside Microsoft during its pivotal security transformation in the early 2000s and reveals how those lessons shaped FDA's approach to medical device cybersecurity today.

From the auto-run vulnerability that infected millions of computers monthly to creating the STRIDE methodology now used worldwide, Adam shares the origin stories behind fundamental cybersecurity practices. He explains how threat modeling evolved from expert-driven whiteboard sessions to systematic, scalable processes that any engineering team can implement.

Shannon and Adam explore the critical difference between risk management and threat modeling in design, why "pouring concrete and then wondering about properties" fails in cybersecurity, and how FDA's pre-market guidance ensures patient safety while fostering innovation. They dive deep into the four key questions every threat modeler must answer and why starting threat modeling with a simple napkin sketch can prevent costly architectural changes later.

Key Topics:

• Microsoft's trustworthy computing transformation and lessons learned

• The invention and evolution of STRIDE methodology for systematic threat analysis

• How FDA adopted threat modeling for medical device cybersecurity regulation

• The fundamental difference between threat modeling and risk management

• Why current approaches to software understanding and composition analysis fall short

• Practical advice for scaling threat modeling across organizations

• The future of threat modeling with AI assistance

Timestamps:

[00:00] Microsoft's security crisis and transformation

[07:03] The auto-run story and data-driven decision making

[14:10] Birth of scalable threat modeling and STRIDE methodology

[23:43] FDA's systematic approach to adopting threat modeling

[32:41] Engineering fundamentals vs. risk management in cybersecurity

[42:49] The software understanding problem and why it's so hard

[55:20] Innovation vs. regulation balance in different industries

[57:21] Rapid fire: Current projects, heroes, and startup advice

[1:02:05] Scaling threat modeling and AI integration

Connect with Shannon:

LinkedIn: https://www.linkedin.com/in/shannonlantzy/ Website: https://www.shannonlantzy.com/

Connect with Adam:

Website: shostack.org

Books: "Threat Modeling: Designing for Security" and "Threats: What Every Engineer Should Learn from Star Wars"

What if the LED lights and screens we rely on daily are causing neurological injuries we can't see? Dr. Jennifer Hackett, a molecular biologist who discovered her own sensitivity to LED flicker in 2018, takes us deep into the science and silence surrounding this invisible health threat. From her research background at Johns Hopkins and Harvard to becoming a patient advocate, Jenny shares how she used scientific methodology to investigate her own injury and what she discovered could change how we think about modern lighting. Shannon and Jenny explore the difference between visible and invisible flicker, why current safety standards may be inadequate, and what this means for public health as LED adoption accelerates worldwide.

Timestamps: 

[00:00] Personal injury from LED workplace lighting

[05:20] Jenny's scientific background and career transition

[14:45] The moment of LED injury recognition

[28:30] Testing the flicker hypothesis with scientific rigor

[42:15] Professional flicker measurement and data collection

[54:10] Current lighting industry standards and their limitations

[1:03:30] Population-level health correlations and research gaps

[1:21:00] Support resources and next steps for research

[1:34:00] Accessing medical care and basic needs with LED sensitivity

Connect with Shannon:

LinkedIn: https://www.linkedin.com/in/shannonlantzy/

Website: https://www.shannonlantzy.com/

Connect with Jenny: 

LinkedIn: https://www.linkedin.com/in/jennifer-hackett-molbio/

Website: flickersense.org & ledstrain.org

When Lane Desborough's 10-year-old son was diagnosed with type 1 diabetes in 2010, this chemical engineer did what came naturally: he applied industrial-scale automation principles to save his child's life. What followed sparked a movement that continues reshaping medical device innovation today. Lane's journey from creating Nightscout (one of GitHub's most-forked repositories) to founding the revolutionary "We Are Not Waiting" movement reveals how patient-driven innovation can outpace traditional development. Now, with support from the Helmsley Charitable Trust, Lane is building the Automated Insulin Delivery Interoperability Framework (AIDIF), an FAA-level simulator designed to accelerate innovation and expand access to life-saving diabetes technology for millions who can't "crawl through broken glass" to build their own solutions.

Timestamps: 

[00:00] Opening: Personal hero who sparked a movement 

[04:25] Why Lane entered medical technology 

[08:20] Cross-disciplinary innovation and "exclusionary language" 

[10:25] The "We Are Not Waiting" origin story 

[14:00] The burden of being your child's pancreas 

[21:40] From remote monitoring to open source revolution 

[24:35] Scaling beyond the most engaged 10,000 users 

[32:25] The Automated Insulin Delivery Interoperability Framework 

[38:45] Why clinical trials aren't enough: recruitment bias 

[41:20] Building FAA-level simulation for medical devices 

[46:15] Medical Device Development Tools and regulatory innovation 

[49:00] Heroes, help needed, and ecosystem engineering

Follow Shannon and Lane:

Connect with Shannon: 

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com

Connect with Lane: 

LinkedIn: https://www.linkedin.com/in/lanedesborough/

Website: http://www.nudgebg.com/

Obesity is one of the most complex and misunderstood chronic conditions in the world, affecting more than 60% of adults globally and 75% in the U.S. Yet, despite its prevalence, care systems continue to underdeliver, relying on one-size-fits-all advice, outdated stigma, and underutilized data.

In this episode of Inside MedTech Innovation, Elina Onitskansky, founder and CEO of Ilant Health, joins Shannon Lantzy to challenge the status quo. Ilant’s model integrates behavioral science, AI, human coaching, and comprehensive care pathways, from bariatric surgery to anti-obesity medications, to deliver truly personalized obesity care at scale.

Elina shares:

• Why obesity care has been treated differently from other chronic conditions and how stigma, bias, and lack of physician training keep it that way

• How evidence-based personalization can replace decades of fad diets and miracle cures

• Why “pizza night” matters: the importance of designing care that fits real lives

• The role of employers, health plans, and policy in making equitable obesity treatment available to all

Timestamps:

00:00 – Should we treat all patients with obesity the same?

01:00 – Shannon’s personal connection to the topic

02:46 – How Ilant Health blends AI, behavioral science, and human coaching

04:36 – Why personalization matters in obesity treatment

06:00 – The impact of stigma and bias in clinical care

07:22 – Elina’s personal and professional journey into obesity care

10:42 – From fad diets to evidence-based solutions

13:50 – Designing treatment that fits patients’ real lives

17:00 – Rethinking how medications are labeled and prescribed

20:18 – The role of patient preferences in regulatory decisions

22:25 – Why obesity should be coded with greater granularity

24:50 – Why Ilant partners only with employers and health plans

27:00 – What a patient’s journey with Ilant looks like

31:00 – Building trust through peer navigators and empathy

33:00 – The power of longitudinal care and evolving goals

Follow Shannon and Elina:

Shannon Lantzy

LinkedIn: https://www.linkedin.com/in/shannonlantzy

Website: https://www.shannonlantzy.com

Elina Onitskansky

LinkedIn: https://www.linkedin.com/in/elinaonitskansky

Website: https://www.ilanthealth.com

Shannon Lantzy sits down with Dr. Richard O'Neill, a regulatory innovator who spent 40 years working in energy markets at FERC and ARPA-E. Dr. O'Neill shares the development and implementation of market optimization software that now generates billions in annual cost savings for American consumers through more efficient electricity markets. The conversation covers the 18-year timeline from algorithm development to full adoption across Independent System Operators, the institutional challenges of innovation in critical infrastructure, and Dr. O'Neill's current work on next-generation market algorithms as AI drives increased energy demand. This discussion provides insights into how regulatory innovation happens, why proven technologies face adoption barriers, and the intersection of academic research with real-world policy implementation.

Key Timestamps:

• [00:01:00] Dr. O'Neill's background at FERC and ARPA-E

• [00:03:00] Development of market optimization algorithms

• [00:05:00] PJM's beta test results and cost savings

• [00:07:00] Market efficiency and participant benefits

• [00:11:00] 18-year adoption timeline across ISOs

• [00:15:00] AI energy demand and infrastructure challenges

• [00:16:00] Current work on algorithm improvements

• [00:18:00] Expected impact on power generation markets

• [00:21:00] Risk management in critical infrastructure

• [00:23:00] Resource allocation and implementation barriers

• [00:27:00] Case study of completed but unadopted beta test

• [00:29:00] Federal and state regulatory jurisdiction

  
  

Richard O’Neill: LinkedIn | Website

Shannon Lantzy: LinkedIn | Website