Our Series C funds Finite State's next stage of growth, a global team and an end-to-end platform helping manufacturers secure the connected products t...

Who owns a grid supplier is only part of what Executive Order 14421 asks. DOE can act on that answer only if someone can verify what's inside the equi...

Finite State is not affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619). Our platform is not built on PHP, and no action is needed by customers.

Attackers drove French supermarket coolers toward 50°C through a controller anyone could reach online. Run blind, our agents re-found two of its three...

Conventional grid compliance treats a patched, signed, CIP-013-compliant relay as a safe one. Executive Order 14421 asks who owns the company that wro...

Most of the conversation in Anaheim was about putting more intelligence into devices. The harder question, and the one Finite State's sessions took on...

Under UN R155 and ISO/SAE 21434, the OEM answers for every supplier component. Here's how to verify a supplier SBOM against the firmware that actually...

A seven-question CRA readiness assessment you can score in about ten minutes. See where you have evidence, where the gaps are, and which deadline is c...

September 11, 2026, tends to get described as a deadline for the CRA. In practice, it behaves more like a starting line.

Conventional advice treats the Cyber Resilience Act as a 2027 problem with a fine attached. The obligation that binds first lands on September 11, 202...

The regulation establishes what manufacturers have to achieve, but it doesn’t tell you how. Filling that gap takes human expertise and judgment – and ...

Most CRA mistakes come from the same root cause: teams working from what they assume is inside the product instead of what they can verify shipped.