Finite State raises $27 million for shipped-device security

By James Calloway

Finite State has raised $27 million in a Series C funding round to expand its AI-driven product security platform and international operations. The Columbus, Ohio-based company said private funds managed by The O.H.I.O. Fund led the round. CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners also participated.

Founder and CEO Matt Wyckouse framed the challenge as “a widening gap between the speed of AI-assisted vulnerability discovery and manufacturers’ ability to identify affected products.” The announcement discloses no valuation, revenue, customer count, or third-party benchmark for the platform’s AI claims. The funding therefore shows investor appetite rather than analysis accuracy.

What problem is the funding meant to solve?

Finite State says manufacturers need to know what software actually runs inside the devices they sell. A flaw in a shared component can affect vehicles, medical equipment, industrial systems, or consumer electronics. Identifying which finished products contain that component can be difficult.

Manufacturers often control their own source code but lack visibility into compiled components supplied by other vendors. Finite State describes connected products as combining several software sources:

• An operating system
• Open-source libraries
• Supplier SDKs (development kits)
• Board-support packages
• Proprietary applications

Finite State’s documentation contrasts a build manifest with firmware analysis. A build manifest describes what a development process expects to include. Firmware analysis examines the resulting software artifact (a compiled file or package), which can differ when packaging adds a component, a supplier modifies a library, or a dependency compiles directly into an executable.

The company says security decisions should follow the contents of the finished product, not depend entirely on its accompanying documentation. The commercial premise is simple: inspect what shipped, rather than trust a component list that may describe an earlier build.

How does Finite State inspect what actually ships?

Finite State’s binary-analysis documentation describes unpacking firmware images, containers, archives, and executables. It then identifies components through binary software composition analysis, which examines a compiled product for embedded components.

The company also applies static application security testing, checking compiled code for weaknesses beyond a simple list of package names. The resulting inventory can include modified and statically linked components (libraries linked directly into an executable). Finite State enriches those entries with vulnerability, exploit, and license information.

The analysis also looks for hard-coded credentials, exposed keys, and cryptographic issues. Finite State lists these supported inputs:

• Firmware and shared libraries
• Mobile application binaries and third-party software
• Source code, when available

Finite State presents this evidence as the basis for decisions about finished products rather than accompanying documentation. The announcement provides no accuracy rate, false-positive rate, or scan-time comparison to support the claim. The practical value lies in finding embedded code that a simple package list can miss.

How does a component inventory become a remediation decision?

Finding a vulnerable component is only the beginning, according to Finite State. A product team must determine whether affected code can run on the device, whether an exploit fits its configuration, and which releases or product variants need a fix. Finite State’s platform overview says prioritization uses reachability (whether vulnerable code can execute), exploit intelligence, and product context.

An SBOM, or software bill of materials, records the components in a product. VEX, or Vulnerability Exploitability eXchange, adds whether a particular vulnerability affects that product. Together, the records separate component presence from the risk it creates.

The platform aims to reduce the time engineers spend investigating findings with lower practical exposure. Finite State says it can identify known and previously unknown vulnerabilities by matching components against disclosed issues and examining compiled code for weaknesses. The announcement offers no public benchmark, accuracy rate, or independent validation for either capability.

Alerts alone do not establish risk. Teams still need evidence that a finding affects the product.

Can AI prove that it unpacked the software?

The AI Unpacking Evaluation Agent, introduced earlier in 2026, evaluates how completely an uploaded artifact was extracted. It explains gaps that may limit the subsequent analysis.

A scan cannot assess code it never successfully extracts. Encrypted containers, nested archives, or unusual firmware packaging can leave part of an artifact outside the scanner’s view.

The agent supplies a quality rating and identifies likely causes of incomplete extraction. It recommends decrypting content, unpacking it locally, or repackaging an archive before another upload.

The broader platform architecture brings firmware, binaries, source code, supplier SBOMs, and documentation into a common process. That process generates security findings, verification evidence, and reports.

Finite State presents the agent as a way to show what each analysis covered, rather than treating every completed scan as equally comprehensive. The announcement provides no extraction-completeness rate or independent evaluation of its quality ratings. The practical test is whether the scanner saw the whole artifact.

Why does compliance matter alongside vulnerability discovery?

The financing announcement places regulatory pressure alongside faster vulnerability discovery as a demand driver. Manufacturers increasingly need evidence showing how they identified software risks, assessed their impact, and addressed them across the product lifecycle.

Finite State generates SBOMs, VEX records, and compliance packages and ties them to product artifacts. It also links architecture, security requirements, and verification work, connecting design decisions with software that reaches customers.

That linkage can make release-to-release changes easier to track. When a supplier updates a component or a manufacturer ships new firmware, the security evidence must reflect the new artifact rather than remain a static document from an earlier release.

Bruce Lin, a senior manager in JET OPTOELECTRONICS’ software department, highlighted “Finite State’s visibility into shipped devices, direct and transitive dependencies, and compliance evidence mapped to the requirements the supplier faces.”

The customer reference supports the vendor’s claim about product visibility. It does not quantify deployment time, inspection coverage, or compliance outcomes, and the announcement names no specific regulation or regulator. Compliance teams still need evidence tied to each shipped release, not a generic inventory.

What will the $27 million buy next?

Finite State plans to use the capital to deepen its international market presence and develop more autonomous platform capabilities. The announcement gives no release dates, feature milestones, or hiring targets for either effort.

The announcement presents the investor group as reflecting the range of systems exposed to software supply-chain risk. Finite State identifies power infrastructure, industrial operations, transportation, and healthcare as connected-device environments beyond conventional IT.

In those settings, identifying a flaw and deploying a safe fix can involve many parties. The Series C backs a strategy of inspecting shipped software, connecting findings to affected products, prioritizing meaningful exposure, and preserving evidence of the response.

As AI makes potential weaknesses easier to find, Finite State sees a commercial opportunity in helping manufacturers turn a growing volume of findings into defensible action. The announcement offers no figures for that volume or the size of the commercial market. That evidence remains absent from the financing announcement.

Finite State’s next proof point is measured improvement in extraction, prioritization, and remediation across real product releases. Real deployments will need to show those gains rather than merely demonstrate that AI can generate alerts.