Finite State Lands $27 Million to Scale Device Security

By Grace Kim

Finite State said it raised $27 million in Series C funding to expand its AI-driven product security platform and international operations. The financing announcement said private funds managed by The O.H.I.O. Fund led the round, with CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners participating.

The Columbus, Ohio-based company said it will use the capital to deepen its international market presence and develop more autonomous platform capabilities. Its core problem is concrete: manufacturers need to know which software runs inside finished devices, even when vendors control compiled components.

A shared-component flaw can reach vehicles, medical equipment, industrial systems or consumer electronics, but finding every affected product can be difficult. Founder and CEO Matt Wyckhouse described “a widening gap between the speed of AI-assisted vulnerability discovery and manufacturers’ ability to identify affected products.”

The financing announcement included feedback from JET OPTOELECTRONICS, a Tier 1 automotive electronics and smart-cockpit supplier. Bruce Lin, a senior manager in its software department, highlighted Finite State’s “visibility into shipped devices, direct and transitive dependencies, and compliance evidence mapped to the requirements the supplier faces.”

What will the $27 million change?

Finite State said the money backs a system for turning software-component inventories into remediation decisions. The platform combines analysis of shipped software artifacts with vulnerability intelligence and compliance workflows.

The goal is to give manufacturers evidence about what actually shipped, then connect that evidence to products, risk and required action. That is a broader job than flagging a vulnerable library: the company must assess reachability, exploit relevance and product context before engineers can choose a fix.

How does Finite State see what actually ships?

Finite State’s documentation describes connected products as combinations of an operating system, open-source libraries, supplier SDKs, board-support packages and proprietary applications. Manufacturers may control their own source code while seeing little of the compiled components vendors supply.

The company contrasts a build manifest, which states what a development process expects, with firmware analysis of the artifact that process produced. Packaging can add a component, a supplier can modify a library, or a developer can compile a dependency directly into an executable.

Finite State’s binary-analysis documentation describes unpacking firmware images, containers, archives and executables, then identifying components through binary software composition analysis. It also applies static application security testing to compiled code, looking beyond package names.

The resulting inventory can include modified and statically linked components, enriched with vulnerability, exploit and license information. The analysis also searches for hard-coded credentials, exposed keys and cryptographic issues.

Supported inputs include firmware, shared libraries, mobile application binaries and third-party software, plus source code when available. The company’s pitch is straightforward: security decisions should follow the contents of the finished product, not depend entirely on accompanying documentation.

How does the platform decide what needs a fix?

Finite State’s platform overview says finding a vulnerable component starts the work rather than ending it. A team still must test whether the affected code is reachable, whether an exploit fits the device’s configuration, and which releases or product variants require a patch.

In Finite State’s overview, a software bill of materials, or SBOM, records a product’s components. Vulnerability Exploitability eXchange, or VEX, adds whether a vulnerability affects that product. Together, the records separate component presence from the risk the component creates.

The platform prioritizes findings through reachability, exploit intelligence and product context, with the stated aim of reducing engineering time on issues with less practical exposure. Finite State says it can identify known and previously unknown vulnerabilities by matching components with disclosed issues and examining compiled code for weaknesses.

Finite State says the usefulness of a finding depends on its evidence and relevance to the device, not the raw number of alerts. That makes the analysis more useful for remediation than a component list alone.

What can the AI unpacking agent verify?

Finite State introduced its AI Unpacking Evaluation Agent earlier in 2026. The agent evaluates how completely an uploaded artifact was extracted and explains gaps that could limit the later analysis.

The company says the step matters because a scanner cannot assess code it never successfully extracts. Encrypted containers, nested archives or unusual firmware packaging can leave part of an artifact outside the scanner’s view.

The agent assigns a quality rating, identifies likely causes of incomplete extraction and recommends corrective steps. Finite State says those steps can include decrypting content, unpacking it locally or repackaging an archive before another upload.

The broader platform brings firmware, binaries, source code, supplier SBOMs and documentation into a common process that produces security findings, verification evidence and reports. The agent shows how much of the artifact that evidence covers, rather than treating every completed scan as equally comprehensive.

How does product security connect to compliance and scale?

The financing announcement placed faster vulnerability discovery alongside growing regulatory pressure. It said manufacturers increasingly need evidence showing how they identified software risks, assessed their impact and addressed them across the product lifecycle.

Finite State generates SBOMs, VEX records and compliance packages tied to product artifacts. It also links architecture, security requirements and verification work, connecting design decisions with the software that reaches customers.

That linkage can help teams track release-to-release change. When a supplier updates a component or a manufacturer ships a new firmware image, the security evidence must reflect the new artifact rather than remain a static document from an earlier release.

The investor group reflects the range of systems exposed to software supply-chain risk. Finite State’s announcement said connected-device security reaches beyond conventional IT into power infrastructure, industrial operations, transportation and healthcare, where identifying a flaw and deploying a safe fix can require coordination among several parties.

Finite State’s stated strategy is to inspect shipped software, connect findings to affected products, prioritize meaningful exposure and preserve evidence of the response. As AI helps teams find potential weaknesses faster, the commercial opportunity is to turn a growing volume of findings into defensible action.

The Series C now tests whether Finite State can scale that model internationally without losing product-level precision.