Finite State has raised $27M in Series C funding led by private funds managed by The O.H.I.O. Fund, with CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners participating, to inspect the code running inside connected products after they leave the factory.
The company’s platform analyses the software and firmware baked into finished devices – vehicles, infusion pumps, industrial gear, home routers – and surfaces both known and zero-day vulnerabilities. That is a different job from scanning source code, because what ships in a device rarely matches the bill of materials its maker believes it built.
Why the timing tightened
Two forces converge. AI-powered research has compressed the interval between finding a flaw and weaponising it from weeks to days, a surge security leaders have started calling the Vulnpocalypse. In parallel, regulators now push proof of security onto manufacturers: the EU Cyber Resilience Act, FDA premarket requirements, UNECE R155 and R156 for vehicles and IEC 62443 for industrial systems.
Modern products are assembled rather than written. A single device carries open-source libraries, third-party components and legacy supplier code, so the exploitable surface is often invisible to the people accountable for it.
Who is buying
Finite State’s customers span national power grids, a US national security research laboratory, automakers and medical device firms. Chief executive Matt Wyckhouse argues the flaw wave is a permanent baseline rather than a bad month.
