Finite State raised $27 million to find hidden security flaws in the software inside cars, medical devices and home gadgets, as AI speeds up attacks.
Finite State, a company that checks the software inside connected devices for security flaws, has raised $27 million. The Series C round was announced on November 10, 2026. It was led by The O.H.I.O. Fund, with CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners also joining.
Finite State sells a platform that looks at the software and firmware inside finished devices. Firmware is the built-in software that makes a device run. The company says its customers build vehicles, medical devices, industrial equipment, consumer electronics and utility equipment.
The platform looks for known flaws and for zero-day flaws, which are problems the maker did not know about. It then helps manufacturers fix the ones that attackers could actually use. The company says the new money will fund growth in international markets and more automated features.
The announcement points to October, when AI-powered research uncovered serious flaws in widely used software, including one in the PHP programming language that much of the web relies on. Security leaders have nicknamed the surge the "Vulnpocalypse."
The company says AI has cut the time from finding a flaw to attacking it from weeks to days, and sometimes hours. Devices are a special worry. One flaw in a shared open-source component, meaning free code that many companies reuse, can sit inside millions of shipped products. Those products are hard to track and slow to patch.
Regulators now expect connected products to be secure before they ship. The release names the EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE R155 and R156 for vehicles, and IEC 62443 for industrial systems. All of them put the burden of proof on the manufacturer. Falling short can mean blocked market access, recalls and liability.
Proving it is hard because modern devices are assembled from parts, not written from scratch. They can contain open-source libraries, third-party components and old code from many suppliers. What ships in the final firmware can differ from what the source code and parts list describe.
The gadgets in your home, car or business run code from many suppliers. When you buy or renew a device, it is fair to ask the maker two things:
The release does not say what the company is valued at. It also does not name specific products or brands that have been checked or found flawed. The claims about AI speeding up attacks and about the company's results come from the company's own announcement.
Before buying a connected device, ask the maker how fast it fixes flaws and how long it will keep the device updated.
Google Cloud is running workshops to help software companies connect their products to Gemini in days, so tools you already use may soon work inside it.
Read more: Google opens a fast track for software firms to plug into GeminiA leak says Samsung may launch a $5 monthly Galaxy AI Premium plan next year, but critics say Google's Gemini tools on Android already do similar things.
Read more: Samsung may charge $5 a month for AI features Google already gives youAnthropic is rolling out AI tools for everyday office work, putting it in more direct competition with Microsoft and Google, two of its own backers.
Read more: Anthropic launches AI office tools that compete with Microsoft and Google
