Risk Management (for MDMs, Medical Device Manufacturers)
Risk management involves risk evaluation, risk control, …
- Risk evaluation: SBOM can provide detailed information about the software components, then with the external vulnerability databases, MDMs can identify potential vulnerabilities, including their risk severity, potential exploitability, and impact…
- Risk control: With the information of the vulnerabilities, MDMs can monitor and routinely verify whether the risk is still at an acceptable level.
So SBOMs can also be used for automatically vulnerability exploitation (attack) and patching (defense).
Transparency (for HCPs, Healthcare Providers)
Like the food ingredient list, with SBOM, HCPs can know what is included in the device software and thus the risks that may be associated with the device, BEFORE PROCUREMENT.
Also HCPs can use the SBOM to manage their patching or update process,