In Part 1 we reframed how you rate a threat to a connected medical device: severity alone flattens everything to "Serious," so we paired it with exploitability - how reachable the attack actually is: to turn a flat list into an ordered one. That gives us an initial risk for every threat, before anything is done about it. This second part is about what you do with those ratings. It turns on one idea that separates medical-device security from ordinary infosec - that some of th

A walk-through of how we reason about medical-device security at the edge of hardware and software - the logic behind a SW96-aligned security risk analysis, illustrated on one deliberately ordinary device. Most security writing lives comfortably on one side of a line. Either it's about software, such as web apps, APIs, and cloud misconfigurations - or it's about hardware: chips, buses, and side channels. Medical devices refuse to stay on one side. A modern connected device is