He was hired by Muddy Waters to help validate the MedSec findings after St. Jude filed its lawsuit. "An attack on this level is low-probability but very high-impact." He called it "probably the most impactful vulnerability I've ever seen." Green said many of the more severe vulnerabilities identified by MedSec for the devices themselves have not been fixed, but the new software would make the home system a little more secure. The FDA has been urging manufacturers to update their products, software and security measures since at least 2013. However, agency guidelines issued last year are not binding. The FDA does not review the vast majority of cyber security updates made to devices, under its own rules intended to streamline medical device upgrades. In 2015 the FDA issued two separate safety alerts to hospitals over drug pumps made by Hospira, now owned by Pfizer.