Finite State Raises $27M Series C for Device Security

Matt Wyckhouse is putting human accountability inside Finite State's plans for more autonomous product security. The founder and CEO says the new investment will deepen AI-driven analysis while keeping a person responsible for the software's decisions, a useful detail in a market where finding another vulnerability also creates another job for the manufacturer.

Finite State, based in Columbus, Ohio, announced a $27M Series C on November 10, 2026. Private funds managed by The O.H.I.O. Fund led the round, with CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners participating. The company intends to expand internationally and develop more autonomous capabilities for analyzing software inside connected products.

The operating consequence reaches beyond a faster scan. Manufacturers need to connect a finding to a specific product, decide what action it requires and retain enough evidence to explain that decision when the product changes or a customer asks about it.

Finite State's Series C finances the work around the analysis

Finite State's announcement puts international expansion and platform development at the center of the financing. In his account of the round, Wyckhouse also describes investment in services, managed programs and the go-to-market team. Those allocations belong together: a manufacturer buying deeper software visibility still needs people and processes capable of using the results.

Founded in 2017, Finite State grew from work on connected-device and embedded-system security. Wyckhouse previously served as founding CTO of Battelle's Cyber Innovations Unit, and David Harvilicz is a co-founder. The company's current leadership page also lists Tim Quock as COO, putting commercial execution alongside the technical work as Finite State expands.

The company disclosed a $30M Series B in 2021 and a $20M growth round led by Energy Impact Partners in March 2024. Those announcements establish a financing history without supplying a complete lifetime funding total. The Series C materials reviewed do not disclose a valuation or break out the financing instruments contributed by each participant.

For the investors, this is exposure to a recurring manufacturing responsibility. A connected product receives software changes, its suppliers change components and new vulnerabilities can alter the significance of code already in service. That creates continuing work around the installed product, including after the original sale has disappeared from the manufacturer's current-quarter priorities.

The shipped device becomes the starting point

Finite State describes its software inventory capability as a way to reconcile source code and supplier information with observations from firmware and compiled binaries. The distinction matters because the ingredients a team intended to include and the software inside the finished device can diverge during assembly and packaging.

A software bill of materials, or SBOM, inventories components in a product. Finite State says its inventory links entries to observed artifacts and maintains that record across builds and releases, giving a security team somewhere to investigate when another affected component is identified. The practical value depends on how accurately that record represents the customer's actual product portfolio.

The company's prioritization tools add reachability analysis, exploit intelligence and product context. Reachability examines whether a vulnerable code path can be reached in the shipped software; that supplies context for a decision about engineering effort. A vulnerability's presence and the action a manufacturer chooses to take therefore belong in the same investigation.

These are vendor-described capabilities rather than independently established guarantees for every device. For a buyer, the useful conversation starts with its own firmware, release history and response workflow. An analysis product earns its place when the team responsible for the device can use the result, inspect the rationale and carry the decision into its ordinary engineering work.

Evidence has to survive the next handoff

Finite State's evidence and compliance workflow connects requirements, verification results and supporting artifacts. The company describes control mapping, exception reporting and evidence reuse across releases, alongside vulnerability exploitability exchange, or VEX, records that communicate a vulnerability's product impact and the rationale behind that assessment.

That introduces a second audience for the security team's work. An engineer may need enough detail to investigate a component, while a customer or reviewer needs a clear account of the product's exposure and the manufacturer's response. Keeping those explanations connected can reduce the amount of reasoning that disappears between a technical decision and the document eventually supplied outside the team.

The integration layer is part of that proposition. Finite State lists connections to development and work-management tools, including GitHub Actions, GitLab CI, Jenkins, Jira and Slack. A product-security record has a better chance of remaining useful when new builds and decisions can reach it through the systems employees already use.

Regulatory pressure forms part of the company's stated demand case, but purchasing the software does not itself establish a product's compliance. The editorial implication is narrower and more practical: evidence generation is becoming a product capability that buyers can examine alongside detection. They still need to understand who reviews an automated conclusion and what happens when the record is incomplete.

Expansion brings the service obligation with it

Finite State's current careers page lists opportunities across product, sales, penetration testing and AI/ML quality assurance. That mix fits the breadth of the operation Wyckhouse describes: building analysis, helping customers apply it and supporting the commercial relationships that bring more products into the system.

DevCuration's coverage of PreScalar's factory firmware testing examines another point where software meets manufactured hardware. Finite State's financing follows that relationship into the security record maintained around a product, where each new version can change the facts a previous assessment depended on.

The Series C gives Finite State more resources to reach manufacturers and develop that continuing workflow. As those customers release updates, the useful record has to travel with the device: which components changed, which decisions remain supported and which engineer needs to open the investigation again.