Product security company Finite State has announced the successful completion of a $27 million Series C funding round, aimed at strengthening its international presence and evolving its security platform to become more autonomous through the integration of advanced artificial intelligence technologies.
The round was led by The O.H.I.O. Fund, with participation from several major financial institutions including CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners.
Increasing Security and Regulatory Challenges
This investment comes in response to two primary pressures currently facing manufacturers: the first is the wave of critical vulnerabilities revealed by AI-powered research last October, known as "Vulnpocalypse," and the second is the continuous increase in regulatory and legislative requirements related to digital product security.
The Finite State platform scans code that is actually shipped within devices, covering both software and firmware. What distinguishes this technology is its ability to work directly from binaries and compiled firmware without the need for access to source code, which expands its utility in critical sectors such as automotive manufacturing, medical devices, industrial equipment, and utility infrastructure.
Compliance with International Standards
In addition to detecting known and zero-day vulnerabilities, the platform helps companies meet strict compliance requirements by generating automated technical documentation, such as Software Bill of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) documents. The platform supports companies in addressing global regulations such as:
- The EU Cyber Resilience Act.
- The U.S. Food and Drug Administration (FDA) pre-market cybersecurity requirements.
- UNECE R155 and R156 regulations for the automotive sector.
- The IEC 62443 industrial standard.
What is Changing Practically?
Finite State is moving toward fully automating security operations; AI agents within the platform perform analyses, categorize vulnerabilities, conduct tests, and even draft regulatory reports. The platform also allows customers to connect their own AI agents via an API and an MCP server, reducing the time gap between vulnerability discovery by AI-supported attackers and the ability of manufacturers to identify and remediate affected products.