Frenos Raises $1.52M Seed Extension for AI-Native OT Security

Frenos has raised a $1.52M seed extension to expand customer success and AI research for its simulated operational technology penetration-testing platform. Momenta and Exposition Ventures co-led the round, Riptide Ventures participated, and Frenos says the financing brings its total funding to $6.4M.

The round matters because operational technology security has a physical-world constraint most software categories never face: testing a defense cannot be allowed to interrupt the system being defended. Frenos is betting that digital twins and AI-driven attack-path reasoning can give critical-infrastructure teams better evidence without making production equipment the laboratory.

What Happened

Frenos announced the seed extension on July 28, 2026. Momenta and Exposition Ventures co-led the investment, with Riptide Ventures joining the round. The company plans to grow its customer-success organization for critical-infrastructure and defense customers while expanding the AI R&D team behind its platform.

The financing follows Frenos' $3.88M seed round led by DataTribe in January 2025. Frenos now reports $6.4M in total funding, although the two public round announcements account for $5.4M and do not separately explain the remaining capital. That gap is worth keeping clean rather than filling with startup arithmetic performed by vibes.

The current Frenos leadership page lists Brian Proctor as Co-Founder and CEO, Harry Thomas as Co-Founder and CTO, and Eric Profittlich as Co-Founder and Board Member. Proctor built the company around a problem he encountered during more than a decade defending OT environments: vulnerability lists are long, but only a small subset of weaknesses can be combined into an attack path that reaches something important.

How Frenos Tests OT Without Touching Production

Frenos creates a digital twin of a customer's OT environment, then uses SAIRA, its AI reasoning agent, to simulate how an adversary could move through that model. The platform analyzes vulnerabilities, network conditions, tactics, and existing controls to identify feasible attack paths and prioritize mitigations. Because the testing occurs away from production, teams can investigate aggressive scenarios without scanning live industrial systems or introducing downtime.

That approach targets a structural weakness in OT cybersecurity. Traditional penetration tests can be disruptive, so they are often performed periodically and cautiously. Vulnerability scanners can generate large backlogs without explaining whether an attacker can chain those findings into an operational consequence. Frenos is trying to turn the question from "What is vulnerable?" into "What is defensible, what is reachable, and what reduces risk first?"

The company also announced SAIRA Co-Work, which it describes as a persistent OT security co-worker that reasons over live digital-twin data and guides investigations with evidence. The product direction moves Frenos from a point-in-time assessment tool toward a continuing decision layer. That is a more ambitious role, but it fits the operating reality: industrial environments change, adversary behavior changes, and a quarterly PDF ages with impressive speed.

Why Industrial Investors Are Leaning In

Momenta's investment rationale is unusually aligned with the product's constraint. The firm argues that OT security cannot depend on tools borrowed from IT when industrial operators must protect uptime, safety, and operational continuity. Frenos gives those operators a way to validate cyber resilience continuously without treating live equipment as a test bench.

Exposition Ventures brings an early-stage industrial-infrastructure lens, while Riptide Ventures focuses on companies serving regulated markets. That investor mix is useful because Frenos does not merely need capital to train models. It needs help navigating buyers who are cautious for good reason, sales cycles shaped by operational risk, and deployments where technical credibility matters more than theatrical AI language.

Frenos says its commercial metrics are moving in the right direction. The company reports ARR at more than 10x its level at the start of 2025, including 215% growth in the first half of 2026. It also reports pipeline growth of 2.7x year over year, a 5x increase in average deal size, and 2026 bookings already at 4x full-year 2025 with five months remaining. These figures are company-reported and not independently audited, but they explain why the extension is framed around customer success and deeper product development rather than basic market discovery.

The Signal Behind 12,000 Findings

The clearest product example in the announcement is also the least glamorous, which is usually where enterprise value hides. In one customer environment, Frenos says SAIRA analyzed more than 12,000 OT vulnerability findings and identified eight that were exploitable under the modeled network's actual conditions. The company reports that this reduced remediation noise by 99.9%.

That does not prove every deployment will produce the same result, and the metric comes from Frenos rather than an independent evaluation. It does illustrate the product thesis in plain terms. An industrial team with 12,000 findings has a data problem; a team that knows which eight can form a real attack path has a decision.

The timing also extends beyond startup positioning. In May 2026, the Google Threat Intelligence Group reported identifying a threat actor using a zero-day exploit it believed was developed with AI, alongside broader evidence of AI-assisted vulnerability research and attack operations. Faster offensive experimentation raises the cost of relying on slow, episodic defensive validation.

What This Funding Signals

The $1.52M extension is small by growth-round standards, but its strategic shape is clear. Frenos is adding customer-success capacity while investing in the AI system that makes the product differentiated. One team helps industrial buyers turn findings into operational changes; the other improves the reasoning engine that decides which findings deserve attention.

For operators, the relevant question is not whether an OT security product uses AI. The question is whether it can produce evidence that survives contact with engineers, safety requirements, and production constraints. Frenos has designed around that burden from the start, using digital twins to keep simulated attacks away from live systems.

For investors, the round is a bet that continuous validation becomes a distinct layer in the OT security stack. Monitoring tells teams what exists and detection tools flag activity, but neither automatically proves which path an adversary can complete. If Frenos can keep turning noisy vulnerability inventories into defensible priorities, the company will be selling something industrial buyers understand immediately: fewer guesses, safer tests, and clearer decisions.