HEALTHCARE ADVISORY INTELLIGENCE
From advisory
to informed action.
Medical-device security deserves more than another list of CVEs. Bring advisories, healthcare priorities, and software-component evidence into one clear workflow.
Free to use. No account required. Apache 2.0 licensed.
Know what needs
a closer look.
Component identity match
A product match is the start of a review. Check affected versions and the original advisory before deciding on action.
THE PROBLEM
The advisory is public.
The review still takes work.
A hospital security team needs to understand which devices may be involved, what the source actually says, and what deserves attention first. DeviceLantern brings that evidence together with healthcare-focused prioritization.
Built with small and rural healthcare security teams in mind—and open for anyone to inspect, use, and improve.
THE WORKFLOW
Less hunting.
More informed review.
Start with the advisory landscape.
Follow the evidence to your next step.
Urgency with healthcare context.
Browse medical-device advisories with deterministic scoring that considers source authority, healthcare context, and other available evidence. Open a record to inspect its sources and scoring factors.
Priority is a review aid. It is not a clinical decision or proof of exploitability.
Browse advisoriesYour inventory stays with you.
Import CycloneDX or SPDX JSON in the app. Compare component identities against the full tracked advisory history, including records outside the latest dashboard window.
Findings are candidates for review. Installed versions are displayed; affected-version ranges are not evaluated.
Open Device SBOMKeep the reasoning inspectable.
Follow advisory links, inspect product-match evidence, and see coverage limitations. Download the SBOM findings and component inventory as a local JSON report for further review.
No match does not mean safe. Confirm applicability and operational actions with authoritative guidance.
Read the matching policyDEVICE SBOM
Start with a file.
Keep control of it.
You don't need to connect a hospital network or create an account to explore component matching. Bring a supported SBOM—or start with our synthetic example.
Check an SBOMA sample, not a real device.
Download the synthetic Medfusion example. Open Device SBOM, choose the file, and select Check components. Inspect the linked evidence and review-required labels.
Download sample SBOMCycloneDX 1.6 · JSON · synthetic inventoryThe example demonstrates matching behavior. It does not establish that the listed version is vulnerable.
PRIVACY BY DESIGN
Private inputs.
Public, inspectable code.
The Device SBOM workflow processes your file in the current browser tab. DeviceLantern does not upload it to an inventory service.
Read the data-handling details- Browser-local processing
- SBOMs and device labels stay in page memory. Reloading or closing the app clears that import.
- Local report export
- You choose whether to download a report. Treat downloaded inventory and findings as confidential.
- No patient information needed
- Use software inventories without patient names, records, or treatment details. DeviceLantern is a security review tool.
- Clear limits
- Product matches require review. The tool does not verify version applicability, reachability, or exploitability.
A FEW PRACTICAL ANSWERS
Before you launch.
Is DeviceLantern free to use?
Yes. The public dashboard and browser-based SBOM checker require no account. The code is Apache 2.0 licensed. Optional AI-assisted pipeline runs on your own infrastructure may incur provider charges.
Is this a network scanner?
No. DeviceLantern brings together public advisory evidence and supports local SBOM component matching. It does not discover devices on your network, inspect traffic, or enforce network controls.
Does a match mean my device is vulnerable?
No. It means the component identity has a candidate relationship to an advisory. Review affected versions, deployment conditions, and manufacturer guidance before deciding on action. A missing match is not proof of safety.
Can I inspect or run the code myself?
Yes. The public repository includes the source, tests, matching-policy documentation, and pipeline instructions. Explore the repository ↗
What does this website track?
The homepage and application count visits with free, cookie-free Cloudflare Web Analytics in an isolated frame. The counter receives only a fixed public page address and basic browser performance data. It cannot read SBOMs, device labels, searches, findings, reports, or the parent page URL. There are no advertising pixels or session recordings. Browser privacy tools may block counting.
OPEN SOURCE. HEALTHCARE FOCUSED.