# Supporting Cybersecurity Risk Management for Medical Devices via the SECUMAN Ontology and Shapes

arXiv: https://arxiv.org/abs/2608.00698 · HTML: https://mlsanity.com/paper/2608.00698/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 63 references that are in the map.
- First posted on arXiv 1 Aug 2026.

## Builds on (most cited first, 6 of 6)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Models](https://mlsanity.com/paper/2405.06211/) (2024)
- [Integration of Formal Proof into Unified Assurance Cases with Isabelle/SACM](https://mlsanity.com/paper/2009.12154/) (2020)
- [CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models](https://mlsanity.com/paper/2502.15932/) (2025)
- [Structuring Security: A Survey of Cybersecurity Ontologies, Semantic Log Processing, and LLMs Application](https://mlsanity.com/paper/2510.16610/) (2025)
- [The Security Assessment Domain: A Survey of Taxonomies and Ontologies](https://mlsanity.com/paper/1706.09772/) (2017)

## Abstract (arXiv)

We propose the SECUMAN ontology and shapes for representing and analysing cybersecurity risk-management documentation for medical devices. Cybersecurity risks are increasingly relevant for connected medical devices and may have direct consequences for patient safety. Current risk-management files are often maintained as semi-structured natural language text, which makes consistency checking, certification review, and reuse difficult. SECUMAN provides a formal OWL-based vocabulary for modelling security-risk context, assessment, control measures, and residual-risk evaluation, and uses SHACL constraints to check structural completeness and conformity with the intended documentation model. The ontology is aligned with VDE Spec 90025 and the related RISKMAN ontology and shapes, while extending their safety-oriented approach to concepts relevant to cybersecurity risk documentation such as threat scenarios, protection goals, attacker profiles, exposure levels, assets, and secure design arguments. SECUMAN is intended to support automated first-pass validation, traceability, and integration of cybersecurity and safety risk-management documentation.