Finite State Raises $27 Million to Help Device Makers Fight the ‘Vulnpocalypse’ with AI-Powered Product Security

COLUMBUS, OH, November 10, 2026 -- Finite State, a leader in product security and software supply chain risk management, today announced a $27 million Series C funding round led by private funds managed by The O.H.I.O. Fund, with participation from CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners to continue its mission to secure the world’s connected devices.

Finite State’s AI-driven product security platform analyzes the software and firmware inside finished devices, giving manufacturers visibility into the products they build and sell, from vehicles and medical devices to industrial equipment, consumer electronics and critical utility infrastructure. The platform uncovers both known and zero-day vulnerabilities and guides manufacturers in fixing the exploitable ones before attackers strike, making everyday life safer and more secure.

The new capital will expand Finite State’s already global operations, deepen its presence across key international markets, and accelerate development of the platform’s autonomous capabilities. These investments will enable more manufacturers around the world to uncover the gap between the software they plan to ship and what actually runs in the finished device, and to continuously identify and mitigate security risks across increasingly complex software supply chains.

The funding comes at a turning point for product security. In October, AI-powered research uncovered critical flaws in some of the world’s most widely used software, including a vulnerability in the PHP programming language that underpins much of the web, in a surge security leaders have dubbed the “Vulnpocalypse.” AI has shrunk the time it takes to find a flaw and turn it into an attack from weeks to days, and sometimes hours. Connected devices are especially exposed: a single flaw in a shared open source component can sit inside millions of shipped products that are hard to inventory and slow to patch. For manufacturers, the urgent question is no longer whether a vulnerability exists. It is which of their products contain it.

In parallel, regulators worldwide now expect connected products to be secure by design, with security built in and demonstrated before a device ships rather than added after it reaches the market. The EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE R155 and R156 for vehicles, and IEC 62443 for industrial systems all place the burden of proof on the manufacturer, and the cost of falling short includes blocked market access, recalls, and liability.

Meeting that standard is difficult because modern connected products are assembled, not written from scratch. A single device can contain open source libraries, third-party components, and legacy code from many suppliers, and what ships in the finished firmware often differs from what the source code and bill of materials describe. Manufacturers cannot secure what they cannot see.

“Every connected product—cars, infusion pumps, toys, OT, baby monitors, your home router—runs on third-party code and components, making inspection and security exceptionally challenging,” said Mike Venerable, Founding Partner, The O.H.I.O. Fund. “Governments worldwide are imposing new regulatory pressures on manufacturers, recognizing how quickly AI-enabled attackers can exploit vulnerabilities. Finite State is solving an incredibly difficult product and technology security challenge by deploying a platform that has earned the trust of investors and customers. We are delighted to support Finite State through this financing and believe the company will be an important solution for connected device security and supply chain risk mitigation.”

“Moments like this separate the companies built for what’s coming from those still catching up,” said Brittany Blanco, Innovation Banking Director II, CIBC Innovation Banking. “We’re excited to back a team that saw this shift early and is ready to meet it on a global scale.”

Finite State customers span the world’s critical infrastructure and connected device ecosystem—from national power grids and a U.S. national security research laboratory to global automakers, life-saving medical devices, and the connected hardware running inside homes, hospitals, and factories worldwide. With the IoT security market projected to reach $80.3 billion by 2031, Finite State’s growing international customer base reflects a challenge that increasingly transcends borders: manufacturers must understand exactly what software is inside their products, whether it can be exploited, and what they need to do about it.

Bruce Lin, Senior Manager, Software Department at JET OPTOELECTRONICS CO., LTD., a Tier 1 supplier of automotive electronics and smart cockpit solutions serving global automakers, said: "The depth of Finite State's binary and firmware analysis, the insight it yields into what's in a shipped device and not just the build manifest, the direct and transitive dependency visibility, and audit-ready compliance mapped to the regulations we actually face, are all invaluable."

Finite State founder and CEO Matt Wyckhouse said: “The Vulnpocalypse isn’t a one-month event. It’s the new baseline. AI-equipped attackers can now find a flaw faster than most manufacturers can figure out which of their products contain it. Governments are rightly advancing regulations to protect the public good, leaving security teams to prove that risks they identify are understood and addressed. Finite State delivers the evidence, intelligence, and automation to protect manufacturers, organizations, and consumers. This Series C round will enable our talented team to both drive the next generation of remarkable platform advances and expand our global reach to safeguard both our customers and theirs.”

Among its latest honors, Finite State was named to the 2026 Inc. 5000, an annual ranking of the fastest-growing private companies in America, and chosen as a finalist in SiliconANGLE’s prestigious 2026 TechForward Awards in the Security category.

Additional Resources:

Finite State's Series C, and What Comes Next

Automotive Cybersecurity Standards: A 2026 Compliance Guide

Medical Device Vulnerability Management: A Practical Guide

A 20-Year-Old Vulnerability Is Still Shipping in a 2026 Home Camera

How IoT Security Challenges Impact Regulatory Compliance

EU CRA SBOM Requirements: Formats, Docs & The Upcoming Deadline

Executive Order 14421: What Grid Asset Owners Need Before the December Rulemaking

The Pain in the Cold Chain: How Weak Firmware Made Warm Freezers

About Finite StateFinite State empowers device OEMs to ship securely while enabling engineering teams to move at the speed of AI, immediately transforming product artifacts into audit-ready assurance through a single automated workflow. Leveraging deep binary analysis and AI-native execution, the platform unifies code, compiled components, and firmware in minutes—connecting security design with deployed software. By continuously generating SBOMs, VEX, and signed compliance packages, Finite State enables connected device companies across industries such as medical devices and automotive to meet evolving regulations, including the EU Cyber Resilience Act (CRA), and deliver continuous compliance at speed.

Learn more at https://finitestate.io/

About The O.H.I.O. Fund

TOF Manager, LLC dba The O.H.I.O. Fund is a private investment firm committed to investing in and partnering with innovative entrepreneurs, business leaders, and co-investors who, like them, call Ohio home. With a unique investment thesis focused on leveraging Ohio’s momentum, The O.H.I.O. Fund supports growth in advanced manufacturing, biotech, real estate, infrastructure, and other sectors where Ohio leads. The team brings deep experience and a robust statewide network to connect leaders and unlock the state’s most promising opportunities.

Contacts

Media Contacts:Finite State Media Relations | press@finitestate.io

The O.H.I.O. Fund | jgriffith@werthpr.com

Important Information and Disclosures

This press release is provided for informational purposes only and does not constitute an offer to sell, or the solicitation of an offer to purchase, any securities in any private investment fund (the “Fund”) managed by TOF Manager, LLC (“The O.H.I.O. Fund” or the “Adviser”). Any such offering will be made solely to qualified investors by means of a confidential private placement memorandum and other offering documents, which should be reviewed carefully before any investment decision.

The O.H.I.O. Fund is an investment adviser to one or more private investment funds. References to investments, capital deployed, or portfolio companies reflect investments made by private funds advised by The O.H.I.O. Fund, and not investments made directly by the investment adviser itself. Interests in the private funds advised by The O.H.I.O. Fund are offered only to eligible investors and are subject to investor qualification requirements.

Statements regarding expected growth, anticipated revenue, production capacity, expansion plans, or future business prospects are forward-looking statements based on current expectations, assumptions, and market conditions. Such statements are inherently uncertain and subject to risks and uncertainties, and actual results may differ materially from those expressed or implied. There can be no assurance that projected outcomes, expectations, or plans will be achieved.

Past investments or portfolio company developments discussed herein are not indicative of future results. Investment performance varies, and no assurance can be given that any investment will achieve its objectives or avoid losses.

Comments or quotes from portfolio company representatives and references to portfolio companies, customers, or counterparties are provided solely for illustrative purposes and do not constitute an endorsement, guarantee, or recommendation. No representation is made that any investment strategy has been or will be successful.

This communication is not intended to be, and should not be construed as, investment advice, accounting advice, legal advice, or tax advice. Prospective investors should consult their own advisers before making any investment decision.

This press release is intended only for persons located in jurisdictions where distribution is permitted under applicable law, and may not be reproduced, distributed, or used for any other purpose without the express written consent of the Adviser.