Finite State, a product security and software supply chain risk management company, has closed a $27 million Series C round. The O.H.I.O. Fund led the investment through its private funds. CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners also participated.
What the platform does
Finite State’s platform uses AI to examine the software and firmware inside finished devices, rather than relying only on what developers say went into them. It covers products ranging from automobiles and medical equipment to industrial machinery, consumer electronics, and utility infrastructure. It surfaces known and previously unknown (zero-day) vulnerabilities, then helps manufacturers prioritize and fix those that are actually exploitable.
The company says the new capital will go toward three goals: growing its international footprint, building out its presence in key overseas markets, and advancing the platform’s autonomous features. The aim is to help manufacturers close the gap between the software they intended to ship and what actually runs on the device.
The “Vulnpocalypse” backdrop
The timing is notable. In October, AI-assisted research exposed serious flaws in widely deployed software, including a PHP vulnerability, a wave that some in the security community have started calling the “Vulnpocalypse.” Time from discovery to working exploit, once measured in weeks, can now be days or even hours.
Connected devices feel this acutely. One flaw in a shared open source library can end up in millions of shipped products that are difficult to inventory and slow to update. As Finite State frames it, manufacturers have moved past asking whether a vulnerability exists. Now they must determine which of their products are affected.
Regulation raises the stakes
Regulators are also pushing manufacturers to prove security before products reach the market. The EU Cyber Resilience Act, FDA premarket cybersecurity expectations, UNECE R155 and R156 for vehicles, and IEC 62443 for industrial systems all put the burden of proof on the maker. Falling short can mean lost market access, recalls, and legal liability.
The challenge is that modern devices are assembled more than built. Open source libraries, third-party components, and inherited legacy code from numerous suppliers all end up in the same firmware, and the shipped result frequently diverges from the source code and software bill of materials.
Investor and customer perspectives
Mike Venerable, founding partner at The O.H.I.O. Fund, noted that everything from cars and infusion pumps to baby monitors and home routers depends on third-party code, which makes inspection difficult. He said governments are tightening rules because AI-enabled attackers move so quickly, and that Finite State addresses a hard technical problem with a platform that has earned trust.
Brittany Blanco of CIBC Innovation Banking said the company recognized the shift early and is positioned to meet it globally.
Finite State says its customers include national power grids, a U.S. national security research lab, global automakers, and medical device makers. The company cites a forecast that the IoT security market will reach $80.3 billion by 2031. Bruce Lin of JET Optoelectronics, a Tier 1 automotive electronics supplier, praised the platform’s binary-level analysis, its visibility into direct and transitive dependencies, and its compliance mapping to the regulations his team faces.
CEO and founder Matt Wyckhouse argued that the current surge is not a passing event but the new normal, with attackers now able to find flaws faster than manufacturers can trace which products contain them. He said the funding will drive both the next generation of platform capabilities and the company’s global growth.
Recognition
Finite State recently landed on the 2026 Inc. 5000 list of fastest-growing private U.S. companies and was named a finalist in the Security category of SiliconANGLE’s 2026 TechForward Awards.
