Finite State's $27M Series C Targets Firmware Security Gap in Shipped Devices

Finite State raises $27 million for product firmware security

Finite State closed a $27 million Series C on November 10, led by The O.H.I.O. Fund, with participation from CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners. The platform analyzes compiled firmware and binaries in shipped products—vehicles, medical devices, industrial equipment, consumer electronics, and utility infrastructure—without requiring access to source code.

The company generates software bills of materials (SBOMs), VEX documents, and signed compliance packages designed to meet requirements in the EU Cyber Resilience Act. The financing signal matters because it targets a concrete procurement gap: verifying what software actually runs inside finished hardware, not what developers intended to ship.

Buyers evaluating product security platforms should ask four questions. First, does the tool analyze the firmware that ships in production devices, or only source repositories? Second, are zero-day findings independently verified before being used as regulatory evidence? Third, do SBOM and VEX outputs interoperate with existing vulnerability-management workflows? Fourth, does the platform support remediation tracking for embedded systems where patching requires coordinated supplier updates?

Finite State competes with Black Duck, Synopsys, ReversingLabs, and Forescout. Its positioning between application security and broader IoT visibility platforms creates a budget question: should device manufacturers fund product-security analysis separately from enterprise vulnerability scanners, or consolidate both under a single platform? The answer depends on whether your organization manufactures regulated products or only procures them.

Allot moves IoT protection into carrier networks for 4G and 5G devices

Allot announced network-level protection for SIM-enabled business IoT devices on November 5. Allot NetworkSecure applies firewall and access policies inside the carrier network, blocking malicious traffic before it reaches the device. The approach eliminates the need for endpoint security software on IoT hardware that cannot run modern agents—meters, payment terminals, remote sensors, connected vehicles.

The platform provides centralized provisioning, policy control, reporting, and analytics for telcos delivering security-as-a-service to business customers. The architectural trade-off is clear: reduced dependence on device-side agents in exchange for increased dependence on the carrier's network controls, APIs, coverage, and incident-response processes.

Buyers should compare the per-device economics of carrier-provided protection with deploying secure gateways, private 5G controls, or SASE policies. Network enforcement contains threats, but it does not replace firmware integrity, device identity, patch management, or physical tamper controls. Enterprises with large fleets of cellular-connected devices should evaluate how carrier-based policies integrate with existing segmentation, SIEM, and NAC infrastructure.

Allot competes with Cisco, Palo Alto Networks, Fortinet, Zscaler, and Ericsson, while also overlapping with mobile-network security services from telecom operators.

Critical infrastructure operators rank IoT their top cyber target at 46%

The 2026 Thales Data Threat Report, based on research by S&P Global Market Intelligence's 451 Research, found that 46% of critical-infrastructure respondents identified IoT technology as a cyberattack target. That exceeded cloud storage at 44% and cloud infrastructure at 40%.

The figure is survey-based and commissioned by Thales, so treat it as a directional risk indicator rather than an independently measured global attack rate. The finding strengthens the case for platforms that combine asset discovery, device identity, vulnerability management, and segmentation. Relevant vendors include Palo Alto Networks, Microsoft Defender for IoT, Forescout, Claroty, Armis, and Nozomi Networks.

Enterprises should treat unmanaged IoT as an infrastructure-security and compliance issue, not merely an endpoint inventory problem. Procurement evaluations should require measurable discovery coverage, device classification accuracy, passive monitoring, vulnerability prioritization, segmentation enforcement, and integrations with CMDB, SIEM, NAC, and ticketing systems.

NIST publishes IoT cybersecurity workshop summary

NIST published Internal Report 8618 on November 9, summarizing its "Cybersecurity for IoT Workshop: Future Directions." The publication is not a product release or binding regulation, but it signals future federal guidance, procurement language, and IoT security standardization.

Organizations with public-sector customers or regulated infrastructure should monitor how NIST's future IoT work affects baseline controls, device identity, software updateability, vulnerability disclosure, and supply-chain documentation. NIST guidance is vendor-neutral and therefore influences requirements against which commercial offerings from Microsoft, Palo Alto Networks, Cisco, Forescout, and Claroty are evaluated.

What to watch

The clearest budget signal is Finite State's $27 million financing, because it addresses a concrete gap: verifying firmware and software embedded in products and producing compliance artifacts. Allot's 4G/5G approach points to a second architectural trend—moving IoT protection into carrier networks where endpoint agents are impractical. Together with the 46% critical-infrastructure IoT targeting figure, these developments favor buying programs that combine pre-shipment firmware assurance, continuous device inventory, network segmentation, and lifecycle patch management, rather than treating IoT security as a single endpoint product.

Buyers should evaluate whether their IoT risk stems from unverified product firmware, unmanaged device sprawl, or both. The answer determines whether to prioritize product-security analysis, network-based containment, or asset-discovery platforms—and whether those capabilities require separate budgets or belong under existing security infrastructure.