Finite State's Series C, and What Comes Next

Today, I'm proud to share that we've raised $27 million in our Series C, a round led by The O.H.I.O. Fund. It's a real milestone for our team. Here's why we raised it, and what it lets us build.

We started Finite State in 2017 for a reason that has only grown more urgent. A connected product is built mostly from code other companies wrote. The company whose name is on it answers for every line. We help manufacturers see what is really inside what they ship and prove it is secure, so the trust people place in those products is earned. Our research drew international attention in 2019, when we exposed backdoors in Huawei networking gear bound for 5G networks, and today our global team works with device makers across North America, Europe, and Asia-Pacific.

The People Who Got Us Here

As one sign of that momentum, we were honored this year to see Finite State named to the Inc. 5000, among the fastest-growing private companies in America, in industries from healthcare to automotive to AI. That growth belongs to our customers and to the people here who do the work. Thank you to our customers, who trusted us with the products their own customers rely on, and to the team at Finite State, who do hard, careful work most people never see, protecting things most people never think about: the camera in a nursery, the pump in a hospital, the meter on the side of a house.

I'm grateful, too, to the investors behind this round, to The O.H.I.O. Fund for leading it, and to CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners for joining them. Thank you as well to our long-standing backers, including Drive Capital and Zetta Venture Partners, for their continued support.

Security Runs End to End

Securing a connected product isn't a one-time check at the finish line. It runs end to end, across the product's whole lifecycle, from the first design decision through years in the field. Much of the software is firmware written by others across the software supply chain, and a device can stay in service for a decade on networks its maker doesn't control. The earliest and cheapest place to catch a problem is at design, and a fix only holds if the work continues across every release.

And it keeps getting harder, because attackers keep getting faster. AI has made finding vulnerabilities cheap, so a single device can surface thousands of them, and turning a fresh one into a working attack now takes minutes, not months. The response still runs at human speed. Someone has to work out which of those thousands actually put the product at risk, fix them, and show what they did. Much of what a scanner flags is never reachable in the shipped product, so the job is separating the few risks that matter from the noise, fast. Done well, work that once took a team hours takes minutes.

None of this is hypothetical. Recently, our researchers pulled apart an inexpensive Wi-Fi camera sold as a baby monitor and found a flaw first disclosed in 2002, a more than two-decade-old bug still shipping in a 2026 product. A single unauthenticated request was enough to expose the camera's administrator credentials and cloud tokens, and because the device runs on a white-label platform sold under other brands, the same exposure likely reaches well beyond one label.

Proof Is Now the Requirement

For years, how seriously a device maker took product security was largely up to them. That's over. In Europe, the Cyber Resilience Act now makes manufacturers responsible for the security of what they ship, with its first reporting duties in force since September 11, 2026. The FDA already requires it for medical devices, and the automotive and industrial worlds tie the same kind of evidence to whether a product can reach the market at all.

A company that can't show, on demand, that a product is secure is starting to lose the right to sell it. Boards that never asked about this are asking now. Meeting that demand takes product security expertise that few teams have in-house, and almost none have enough of. That is the part we take on. We turn what a manufacturer ships, analyzed down to the binary, into a current record of which vulnerabilities matter and what was decided about each, so the evidence is ready the moment a customer, a regulator, or an auditor asks.

Where We Go Next

This round matters most for what it lets us do, at a moment when the demand reaching our customers is neither optional nor on their own schedule.

Most of it goes back into the platform and the AI-driven analysis that drives it, always with a person accountable for the calls the software makes. Beyond the platform, we're investing in the services and programs that support our customers' own teams. Product security is one of the hardest roles to staff, so we work alongside those teams or run parts of the program ourselves, including managed services for Europe's Cyber Resilience Act, with the FDA, automotive, and industrial rules bringing the same demands. We're also growing our go-to-market team to reach the manufacturers who need this. These obligations land on fixed dates, and we intend to be ready ahead of them.

We've believed from the start that the proof a product is secure should be ready before anyone asks for it, not rebuilt under deadline once they do. This round lets us bring that to more manufacturers, across more of the products the world quietly depends on. There's a lot of work ahead, and we're glad to be doing it.