HEALTHCARE CYBERSECURITY EXPERTS
We give MDR manufacturers the audit-ready cybersecurity evidence their Notified Body demands under IEC 81001-5-1: pentests, secure code reviews, and the compliance documentation that makes them count. Hospitals turn to us for §17 MPBetreibV assessments; healthcare cloud operators for C5 readiness.
WHO WE SERVE
Your Notified Body demands cybersecurity evidence under IEC 81001-5-1. We deliver it: pentests, secure code reviews, and the compliance documentation that makes them count.
MDR cybersecurity§17 MPBetreibV requires independent security assessments for medical device software in clinical operation. We handle them and deliver reports for your device logbook.
§17 MPBetreibV testing§ 393 SGB V requires a current C5 Type 2 attestation for health data in the cloud. We prepare you end-to-end: from control mapping to audit-ready evidence.
C5 readinessMeet our qualified experts who combine academic research with years of practical cybersecurity experience, specializing in medical device security and compliance.
Senior Penetration Tester & Security Researcher
PhD security researcher who found critical vulnerabilities in hospital systems and contributed to the B3S hospital security standard (BAK MV). Simon turns academic rigor into audit-ready results that protect real patients.
Senior Penetration Tester & Application Security Expert
20+ years as CTO. 50+ million app downloads. Teams up to 35 experts. IoT fleets with thousands of devices. Volker brings deep security expertise and makes complex compliance simple.
PROOF, NOT PROMISES
We don't just test: we find critical vulnerabilities in healthcare systems and coordinate their disclosure with vendors and authorities. Our public track record across gematik, Orthanc, DCMTK, Element, and the Robert Koch Institute is how our clients know our pentests find what matters.
In the media
heise online
Interview
In an interview with Marie-Claire Koch, Dr. Simon Weber discusses our research into ePA client security, the implementation gaps we found, and what developers can learn from them.
Hear from teams we've worked with
“We have been working with Machine Spirits for several years and value their technical expertise and straightforward collaboration. Their actionable recommendations have been instrumental in sustainably strengthening the protection of the patient data entrusted to us.”
“As a security partner for our DiGA, Machine Spirits impressed us with their in-depth pentests. Their competent TR-03161 consulting and clear recommendations were crucial in meeting the demanding BSI requirements quickly and securely.”
“Machine Spirits helped uncover vulnerabilities in our platform early with a structured and in-depth pentest before we went through MDR certification. The clear reports and pragmatic communication helped us quickly close security gaps and efficiently update our documentation.”
We specialize in cybersecurity for healthcare: medical devices, hospital infrastructure, and cloud compliance.
Audit-ready security testing for MDR Class I, IIa & IIb medical devices and SaMD. We deliver the technical evidence Notified Bodies require for IEC 81001-5-1 compliance.
Learn moreThe DICOM standard was built for connectivity, not security. We test PACS systems and medical imaging infrastructure against both protocol-level threats and MDR compliance requirements.
Learn moreSource code analysis by experienced developers. We find security flaws and provide fixes that fit your architecture and accelerate secure releases.
Learn moreIndependent IT security assessments for medical device software per §17 MPBetreibV. Standards-compliant testing that stands up in your medical device logbook and before regulatory authorities.
Learn moreYour cloud provider's C5 attestation covers their infrastructure, not your application. We help healthcare organizations achieve their own C5 Type 2 attestation under §393 SGB V.
Learn moreSecurity assessments for AI-powered medical devices navigating the intersection of MDR and EU AI Act compliance. From prompt injection to model manipulation and data extraction.
Learn moreGet in touch to discuss your security requirements.
We typically respond to all inquiries within 24 hours during business days.
Average response time: 6-12 hours