Open Security for Connected Care.

API-first security platform for healthcare infrastructure. BlueFlow asset management, Tapirx passive device discovery, and VulnFWRD™ AI risk orchestration — MIT-licensed open core you can inspect, extend, and deploy on your own terms.

Four tools. One platform.

Use independently or together. Each component exposes a versioned REST API and connects via the pluggable connector framework — designed for maximum flexibility with no vendor lock-in.

BlueFlow™

Open-core asset platform

  • Open Source
  • MIT
  • Python / Django

Now free and open source. Django REST API for healthcare IT asset management. Versioned API at /api/v1/ with full OpenAPI 3 schema, pluggable connector framework, SBOM generation, and role-based access control. Deploy with Docker Compose or install as a Python package.

Key Features:

  • Connector plugin framework — discovery, vuln, CMMS, SIEM, webhooks
  • SBOM generation in SPDX and CycloneDX formats for FDA compliance
  • Built-in RBAC: viewer, editor, biomed, security admin
  • Full Docker Compose stack — web, worker, beat, Postgres, Redis
  • Audit trail via django-simple-history on every model

API Endpoints:

  • GET /api/v1/assets/
  • POST /api/v1/assets//sbom/
  • POST /api/v1/webhooks/
  • POST /api/v1/connectors//sync/
  • GET /api/v1/schema/ → OpenAPI 3

Tapirx™

Passive device discovery

  • GPL-3.0
  • Go

Free, open-source medical device discovery written in Go. Passively identifies devices from HL7 and DICOM network traffic via SPAN port, live interface, or pcap file — with zero impact on clinical operations. Plugs into BlueFlow as a discovery-type connector.

Protocols:

  • HL7 ADT/PRT (UDI extraction) and DICOM
  • Runs on Linux, macOS, Windows — no network disruption

Gurney

Clinical testbed scanner

  • Open Source
  • Python

Reproducible, self-contained test environment that exercises BlueFlow's passive (pcap/protocol observation) and active (Nessus/Tenable-backed) scanning pipelines — topology- and scenario-driven, runs via Docker Compose.

VulnFWRD™

AI risk orchestration

  • Proprietary

AI-powered risk orchestration with bidirectional BlueFlow integration. BlueFlow emits structured risk events when vulnerabilities map to assets or Pulse feed items match tracked devices. VulnFWRD returns scored remediation intents — the full closed-loop for healthcare vulnerability management.

API Reference

Versioned. Documented. Complete.

Every endpoint lives at /api/v1/ with full OpenAPI 3 schema auto-generated by drf-spectacular. Swagger UI served at /api/v1/schema/ui/.

API Endpoints:

  • GET /api/v1/assets/
  • POST /api/v1/assets//sbom/
  • GET /api/v1/vulnerabilities/?asset=a3f1b2c4

Access Control

Every role. Every team.

Built-in RBAC with scoped API tokens. Permissions enforced at the ViewSet level on every endpoint. From read-only leadership dashboards to full security admin control.

  • Viewer: Read-only access for leadership and auditors.
  • Editor: Create and update assets, groups, and tags.
  • Biomed: Clinical engineering access.
  • Security Admin: Full platform control.

Active Research

Virta Labs cofounders co-authored the world's first research on cardiac implant cybersecurity in 2008. They shaped FDA medical device security guidance, led industry standards bodies, and introduced PowerGuard™ in 2015 — the NSF-funded malware detection system that identifies infected medical devices by analyzing power consumption patterns, requiring no software installation and causing zero disruption to patient care. Now funded by ARPA-H's UPGRADE program to build hospital-scale digital twins for autonomous vulnerability remediation.

Built by the Pioneers

The team that shaped the industry.

Federal Advisory Experience. Industry-Changing Research. Federal-Validated Technology.

Get Access

Take control of your security stack.

  • Deploy locally.
  • Own your data.
  • Export anytime.
  • FDA SBOM generation — SPDX and CycloneDX.
  • NIST CSF coverage tracking built-in.