Finite State, a provider of product security and software supply chain risk management, has closed a $27m Series C round as manufacturers face a narrowing window between the discovery of a software flaw and its exploitation by attackers.
The O.H.I.O. Fund led the round through private funds under its management. CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners also took part. Finite State plans to use the capital to scale its existing global operations, strengthen its footprint in major international markets and speed up work on the autonomous features of its platform.
The company says this will help more manufacturers detect the difference between the software they intend to release and the code that actually runs inside a finished device, while continuously spotting and reducing risk across complex supply chains.
The investment arrives during a period of upheaval for product security. Last month, AI-assisted research exposed serious weaknesses in heavily used software, among them a flaw in the PHP programming language, which supports a large share of the web. Security leaders have labelled this wave the “Vulnpocalypse.”
According to the company, AI has compressed the gap between finding a weakness and weaponising it from weeks to days, and in some cases to hours. Connected hardware carries particular risk, because one defect in a common open source component can be embedded across millions of devices that are difficult to track and slow to update. The pressing issue for manufacturers has shifted from whether a flaw exists to identifying which of their products are affected.
Regulators are adding further pressure. Authorities around the world increasingly require connected products to be secure by design, with protections proven before release rather than bolted on afterwards.
Frameworks including the EU Cyber Resilience Act, FDA premarket cybersecurity rules, UNECE R155 and R156 for vehicles and IEC 62443 for industrial systems all require manufacturers to demonstrate compliance. Failure can result in lost market access, product recalls and legal liability.
Compliance is complicated by the way modern devices are built. Products are typically assembled from open source libraries, third-party components and older code drawn from numerous suppliers, and the firmware that eventually ships frequently diverges from what the source code and bill of materials record.
Finite State’s AI-based platform examines the software and firmware within completed devices, giving manufacturers a clear view of what sits inside the vehicles, medical devices, industrial machinery, consumer electronics and utility infrastructure they produce. It detects both known and zero-day vulnerabilities and helps teams remediate those that can be exploited before they are targeted.
The company’s customers include operators of national power grids, a US national security research laboratory, global carmakers and producers of life-saving medical devices, along with makers of connected hardware used in homes, hospitals and factories. Finite State points to forecasts that the IoT security market will reach $80.3bn by 2031, and says its expanding international client base shows the problem is not confined to any single country.
Finite State founder and CEO Matt Wyckhouse said, “The Vulnpocalypse isn’t a one-month event. It’s the new baseline. AI-equipped attackers can now find a flaw faster than most manufacturers can figure out which of their products contain it. Governments are rightly advancing regulations to protect the public good, leaving security teams to prove that risks they identify are understood and addressed.
“Finite State delivers the evidence, intelligence, and automation to protect manufacturers, organizations, and consumers. This Series C round will enable our talented team to both drive the next generation of remarkable platform advances and expand our global reach to safeguard both our customers and theirs.”
Stay ahead of the deals, regulation and threats reshaping the sector. Executives who need early, decisive intelligence rely on RegTech Analyst newsletter. Subscribe today here.
Copyright © 2026 RegTech Analyst
