Finite State

• An application security platform that already owns the SCA budget, such as Black Duck or Snyk, could ship binary and firmware analysis and bundle it into existing contracts, collapsing the case for a standalone purchase.
• EU Cyber Resilience Act enforcement delays or softened FDA premarket expectations would remove the compliance deadlines that drive current demand, and deals would slip back into discretionary security budgets.
• The autonomous Product Security OS message could outrun the shipped product. Release notes from the launch quarter describe incremental triage and policy fixes, and a buyer who tests the agent claims in evaluation could discount the rest of the pitch.
• Public customer proof could keep aging. The newest named customer reference is Schneider Electric in 2021, and procurement teams comparing vendors with fresh named case studies would read that gap as churn risk.
• Another small round, or none, by 2027 would confirm the enterprise motion is not compounding, after a 2024 growth round that came in smaller than the 2021 Series B.
• Chipset and RTOS vendors or compliance bodies could standardize free SBOM generation, commoditizing the inventory layer and pushing the company's value entirely onto triage and evidence workflows.

Finite State targets product security teams at connected-device manufacturers in medical, automotive, industrial, and energy markets. These teams must prove to regulators that the software inside shipped devices is secure. The company names FDA Section 524B premarket requirements and the EU Cyber Resilience Act as the rules forcing manufacturers to produce audit-ready evidence for every release.

Independent coverage corroborates the problem at the buyer level. SecurityWeek describes the platform as addressing supply-chain risk and vulnerability visibility for connected devices and embedded systems, and Industrial Cyber attributes the company's growth to escalating regulatory pressure on software supply chains. The 2024 growth round was led by Energy Impact Partners, an investor focused on the energy and industrial markets Finite State sells into.

Finite State quantifies the operational pain as vulnerability noise. The company reports that 40.5% of findings analyzed for reachability since 2024 were confirmed unreachable, a vendor-supplied figure that frames the triage burden its buyers carry. [s3, s6, s13, s14, s1]

Finite State Platform turns shipped software into a system of record. It generates SBOMs from firmware, binaries, and source code, runs reachability analysis to separate exploitable findings from noise, and the June 2024 MergeBase acquisition added source-code software composition analysis to the binary side.

Independent records corroborate the engine's depth more than vendor pages alone could. BankInfoSecurity described the firmware analysis tool, Iotasphere, breaking firmware images into components for static, dynamic, and symbolic analysis, Help Net Security reported the platform ingests 120-plus external data sources, and a CISA medical-device advisory credits a Finite State researcher with vulnerabilities in Philips patient monitors.

The February 2026 release recast the platform as an autonomous Product Security OS powered by AgentOS, with Finite State Copilot and Assurance Studio as named components. The launch language is broad, and the visible release notes from the same period describe incremental triage and policy improvements rather than new autonomous behavior, so a buyer can verify the agent claims only through a demo. [s2, s7, s17, s16, s20, s6, s22]

Finite State competes in product security for connected devices against NetRise, ONEKEY, and Cybellum, which also sell firmware and device software analysis to manufacturers. Its stated differentiation is unifying source, binary, and compliance evidence in one system, a contrast the platform page draws against source-only application security tools and firmware-only scanners. Omdia covered the company in its firmware-security analyst research in 2024, placing it inside that named category.

Application security incumbents are the adjacent threat. Black Duck, Snyk, and other SCA vendors own the source-code side of the same budget and could extend toward binaries. Finite State's counter is depth, because firmware unpacking and reachability analysis across many architectures take longer to replicate than feature-list parity. [s2, s19]

The motion is enterprise sales into regulated industries. The pricing page publishes no prices and routes every path to a demo request or a self-serve product tour, the profile of negotiated deals.

Customer proof is logo-heavy and reference-light. The homepage displays Johnson Controls, Google, Aptiv, Hitachi Energy, Quectel, and Hubbell logos alongside anonymous role-titled testimonials. The most recent named customer reference is Schneider Electric, whose Global Chief Product Security Officer Klaus Jaeckle said in the 2021 Series B announcement that the platform was transforming the company's product security. Schneider also invested through Schneider Electric Ventures in the same round.

Services thicken the motion. A practitioner-led services arm sells compliance and security work alongside the platform, supporting connected-product teams on regulatory pressure, release risk, and exploitability questions. [s4, s1, s11, s5, s24]

Founder and CEO Matt Wyckhouse came from Battelle and has run Finite State since 2017. The team's firmware reverse-engineering skill set traces to its reported backgrounds in the U.S. Intelligence Community, the same expertise the product's binary analysis requires.

That standing is independently corroborated rather than self-asserted. A CISA medical-device advisory credits Finite State researcher Shawn Loveric with vulnerabilities in Philips patient monitors, the company's 2019 Huawei firmware assessment drew coverage from outlets including BankInfoSecurity, and Omdia profiled the firm in 2024. Finite State also hired a head of policy and compliance in early 2026, deepening the regulatory bench its thesis depends on. [s9, s10, s17, s20, s19]

Finite State earns buyer trust through regulatory fluency and the nature of its product. The company hired a head of policy and compliance in February 2026, publishes FDA Section 524B and EU Cyber Resilience Act guidance across its industry pages, and frames its core output as evidence a regulator can audit.

The company's public security materials explain the SOC 2 framework and how the platform helps customers reach SOC 2 and similar compliance, rather than foregrounding the company's own attestation. For a vendor whose product is audit evidence, buyers will weigh its published security posture alongside the regulatory expertise it sells. [s6, s3, s10, s5, s23]

Add analyzed competitors to compare them side by side with Finite State.

Finite State segments by regulation rather than by company size. The site carries industry pages for medical devices, industrial systems, automotive, and government, and each leads with the rule that binds that buyer, FDA Section 524B for medical devices and the EU Cyber Resilience Act for connected products. The persona is the product security engineer who owes regulators and downstream customers evidence about shipped software, not the enterprise CISO.

The newest public proof of demand is named logos rather than named references. The homepage shows Johnson Controls, Google, Aptiv, Hitachi Energy, Quectel, and Hubbell, but the testimonials are anonymous role titles and no customer case study appears among the public pages reviewed, where Schneider Electric figures as both a Series B investor and, through its product security officer, a 2021 customer reference. The company repositioned for the current AI generation in February 2026 and ships continuously, so the pitch is current even where the named-reference proof is thin.

Deal-size signals point at large negotiated contracts. The pricing page publishes no numbers and routes every path to a demo request or a self-serve product tour, the profile of global manufacturers rather than mid-market teams.

The durable capability is binary analysis at unusual breadth. Finite State Platform decomposes firmware and binaries across a wide range of instruction set architectures, merges source and binary SBOMs, and runs reachability analysis that the vendor says confirmed 40.5% of analyzed findings unreachable since 2024. Source-code analysis arrived with the June 2024 MergeBase acquisition.

Independent records support the engine's reach beyond vendor pages. A CISA medical-device advisory credits a Finite State researcher with firmware vulnerabilities in Philips patient monitors, BankInfoSecurity described the Iotasphere tool decomposing firmware images for static, dynamic, and symbolic analysis, and Help Net Security reported the platform ingests 120-plus external data sources.

The AI layer is newly announced, with no independent validation in the reviewed record. AgentOS, Finite State Copilot, and Assurance Studio were announced as named components of the February 2026 autonomous Product Security OS launch, described as in private preview with early-access participation open. Release notes from the same period describe VEX carry-forward fixes, policy accuracy, and API behavior rather than autonomous behavior, so the public materials support the analysis engine more strongly than the agent claims.

The motion is enterprise and sales-assisted, with demo requests gating every path and a practitioner-led services arm selling compliance work alongside the platform. The public pages reviewed show no marketplace listing or reseller program, so the vendor reaches buyers through its own pipeline.

Founder visibility is high for a company of this age. Matt Wyckhouse fronts conference panels on connected-device security, and announced executive hires built out security, engineering, and compliance leadership through early 2026, including a head of policy and compliance. At this stage the hired team is appropriate and the founder acting as technical evangelist is a strength. The missing piece is referenceable customers speaking alongside him.

A self-serve product tour lowers the evaluation barrier. The walkthrough on the homepage lets a prospect handle the product before sales contact, and the documentation site is public rather than gated.

Finite State publishes no prices, the standard posture for negotiated enterprise deals. The pricing page exists mainly to route prospects to a demo request or a self-serve product tour rather than to quote a number.

The charging unit is not disclosed publicly, but a per-product and per-scan structure would match how a device maker counts the problem, per product line shipped. The vendor publishes no comparative price framing, leaving the value defense implicit in the binary-analysis depth.

Delivery centers on programmatic integration. Release notes document command-line behavior, public API endpoints for scans and findings, and SBOM export fixes, so integration into customer pipelines is real rather than aspirational. Policy checks gate releases inside those pipelines, which embeds the product where the buyer's release decisions happen.

Operational maturity shows in the changelog cadence. Recent entries cover VEX triage reliability across rescans, license policy accuracy, scanner auto-update, and upload-experience fixes, the texture of a product running in production at customers rather than a demo platform.

Finite State earns buyer trust through regulatory fluency backed by its own attestation. A head of policy and compliance joined in February 2026, the industry pages walk through FDA Section 524B and EU Cyber Resilience Act obligations, and the product's core output is evidence built for regulator review.

The company's SOC 2 explainer states that Finite State has achieved SOC 2 Type 2 certification, though the public materials spend more space on how the platform helps customers reach SOC 2 than on the company's own posture. For a vendor whose product is audit evidence, buyers will weigh that attestation alongside the regulatory expertise it sells.

Finite State positions as a platform and now as an operating system, but the visible ecosystem leans on its own pipeline. The platform page emphasizes unified internal workflows, from design review to shipped binary to evidence pack, and notes out-of-the-box integrations, though no browsable third-party marketplace or partner directory appeared on the public pages.

Channel reach is the structural weakness. If an incumbent copied the feature list, Finite State would keep its binary-analysis depth and accumulated unpacking knowledge, but buyers encounter the product through the vendor's own marketing and a self-serve tour rather than through channels an incumbent could not buy.

The system-of-record strategy is the platform play that could work. SBOM history, carried-forward triage judgments, and compliance evidence accumulate inside the platform, and every release a customer ships deepens the archive a regulator may later audit. That accumulation raises switching costs more than integration breadth does.

The founder's background is the team's core asset. Matt Wyckhouse founded the company in 2017 after a cyber research career at Battelle, where he was founding CTO of its Cyber Innovations Unit, applied-research pedigree that supplies the program-analysis skills firmware reverse engineering requires.

The research record is externally documented rather than self-asserted. A CISA medical-device advisory credits Finite State researcher Shawn Loveric with reporting vulnerabilities in Philips patient monitors, the 2019 Huawei firmware assessment drew coverage from outlets including BankInfoSecurity, and Omdia profiled the firm in 2024. The hiring pattern through early 2026 added security, engineering, and compliance leadership, including a head of policy and compliance that matches the regulatory thesis.