Check a device’s software components
Import a CycloneDX 1.2–1.7 or SPDX 2.2/2.3 JSON SBOM and compare its components with the full tracked advisory history.
Your SBOM stays in this tab’s memory. It is not uploaded or saved. Clear or close the tab to remove it. A downloaded report contains device inventory; keep it private.
Matches identify products for review. Installed-version applicability and exploitability require confirmation against the source advisory.
Choose a device SBOM to check.
Live self-check
Full-corpus metrics come from meta.json. Optional metrics remain unavailable when the build does not publish them. Reproduction commands are linked below.
Clone travisfunk/advisoryops and run:
python -m pytestpython scripts/validate_medical_device_bucket.pypython -m pytest tests/test_no_pharmaceutical_sources.pyThe dashboard is served from docs/ on GitHub Pages and loads meta.json when opened. Test counts appear only when supplied in metadata; the README records the latest documented full test run.
How scoring works
AdvisoryOps uses a deterministic, healthcare-aware scoring system. Each issue receives points based on observable evidence — source authority, exploit status, attack vector, healthcare context, and patch availability. The system does not rely on AI judgment for scoring; every point is traceable to a specific evidence factor.
Source authority tiers
Each source is assigned an authority tier from T1 (highest) to T5 (lowest) based on its institutional mandate, editorial rigor, and proximity to the vulnerability disclosure process. Higher-tier sources contribute more points to an issue's score.
How AI is used
Each issue is evaluated across 8 evidence fields: CVEs, summary, affected products, severity, vendor, patch status, mitigations, and source consensus. The evidence completeness score reflects how many of these fields contain meaningful data from authoritative sources.
Full-corpus check: exact structured CVE-ID overlap
The verifier compares the complete canonical medical-device corpus against the full CISA KEV catalog. Authoritative strict overlap means an exact structured CVE-ID match. These results come from meta.json, not the bounded serving feed. Vendor exact and partial substring matches are diagnostic only and are not evidence of KEV medical-device overlap.
Only when a medical-device record has an exact structured CVE ID in the full KEV catalog, the is_kev_medical_device badge activates automatically and feed_medical_device_kev.json becomes non-empty. See kev_medical_device_analysis.md for the full methodology.
The count above measures exact structured CVE-ID overlap for the current canonical medical-device corpus and the full CISA KEV catalog. A zero result is specific to those records and identifiers; it does not prove that KEV has no medical-device coverage universally or that exploitation never occurs.
This is why the project exists. AdvisoryOps aggregates from specialized sources where medical device advisories actually live (CISA ICS-Medical, FDA recalls, FDA safety communications, vendor PSIRTs, Health Canada recalls) and applies an FDA clinical-severity floor so Class III devices surface even without a KEV listing. The KEV cross-reference is exposed live on every build — only medical-device records with an exact structured CVE ID in KEV receive the strict overlap badge. Vendor matches do not activate it.
Full methodology and reproduction commands: kev_medical_device_analysis.md
What is AdvisoryOps?
AdvisoryOps combines healthcare advisory intelligence with private device SBOM component matching. It ingests government, vendor, and research advisories, scores them for healthcare relevance and urgency, and provides source-linked issue records and remediation guidance for hospital security teams.
Connect device software to tracked advisories
Import a CycloneDX or SPDX JSON SBOM in Device SBOM to compare software components with the full tracked advisory history. Review installed versions, matching evidence, coverage gaps, and source links, then download a local JSON report. Your SBOM stays in the browser; no upload or account is required.
Matches identify products for review. They do not confirm that an installed version is affected or exploitable. See supported formats, privacy, and matching limits. Anonymous visit measurement runs in an isolated frame that cannot read your device data.
Why this exists
Small and rural hospitals face the same cyber threats as large health systems but with a fraction of the security staff. A 25-bed critical-access hospital cannot afford a dedicated vulnerability analyst, yet its patient monitors, infusion pumps, and imaging systems carry the same CVEs as those in a 900-bed academic medical center. AdvisoryOps exists to close that gap — providing structured, prioritized intelligence that would otherwise require a full-time analyst to produce.
The Issues tab supports two presentation modes on top of the standard filter pipeline (Medical devices / FDA CLASS / KEV / search):
Subscribe to filtered feeds in your RSS reader: