# EU device makers have 24 hours to report an exploited flaw. Finite State raises $27M to trace it in firmware - Published: 2026-11-10 (updated 2026-11-10) - Author: [Tech Magazine](https://techmagazine.io/author/techmagazine-io.md) - Topics: [News](https://techmagazine.io/news.md) - About: [Finite State](https://finitestate.io/), [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng) - Based on: [Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security](https://www.globenewswire.com/news-release/2026/11/10/3399273/0/en/finite-state-raises-27-million-to-help-device-makers-fight-vulnpocalypse-with-ai-powered-product-security.html), GlobeNewswire, 2026-11-10 - Based on: [Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng), EUR-Lex, Publications Office of the European Union - Based on: [Our Series C, and What Comes Next](https://finitestate.io/blog/finite-state-series-c), Finite State - Based on: [IoT Security Market Report](https://www.marketsandmarkets.com/Market-Reports/iot-security-market-67064836.html), MarketsandMarkets - Source: https://techmagazine.io/news/cra-vulnerability-reporting-deadline-finite-state-raises-27m/ - Publication: Tech Magazine - Publisher: Connectively (Terkel, Inc.) - Editorial policy: https://techmagazine.io/editorial-policy/ - AI use: Connectively's automated system wrote this article with AI from a press release issued by Finite State on November 10, 2026, linked under Sources. Statements about the company and its products are the company's. The illustration was generated with AI. The article was assembled and published automatically, without an editor's review. Report errors to corrections@connectively.us. Under the [CRA vulnerability reporting deadline](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng), an EU device maker must now flag an actively exploited flaw within a day, so it first has to know which shipped products contain it. Finite State, a Columbus, Ohio firm that inspects device firmware, announced a $27 million Series C on November 10, 2026, to grow that work. ## Key points - Since 11 September 2026, the [EU Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng) has required manufacturers to send an early warning within 24 hours of learning that a vulnerability in their product is being actively exploited. - Finite State's $27 million Series C was led by private funds managed by The O.H.I.O. Fund, with National Grid Partners, Energize Capital, Energy Impact Partners and CIBC Innovation Banking joining. - The company says its platform reads the compiled software and firmware inside finished devices, finding known and zero-day vulnerabilities and showing which ones can be exploited. - Finite State says the money will widen its international operations and speed work on the platform's autonomous features. - The release cites a MarketsandMarkets forecast of an $80.3 billion IoT security market by 2031. ## What does the CRA vulnerability reporting deadline require? It requires a manufacturer to warn EU authorities within 24 hours of becoming aware that a flaw in its product is being actively exploited. Under [Article 14 of Regulation (EU) 2024/2847](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng), that early warning goes to the coordinating national CSIRT and to ENISA, followed by a fuller vulnerability notification within 72 hours and a final report no later than 14 days after a fix or mitigation is available. | Step | Deadline | |---|---| | Early warning of an actively exploited vulnerability | Within 24 hours of the manufacturer becoming aware ([CRA Art. 14](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng)) | | Vulnerability notification with general details and mitigations | Within 72 hours ([CRA Art. 14](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng)) | | Final report on severity, impact and the fix | No later than 14 days after a corrective measure is available ([CRA Art. 14](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng)) | | Reporting duty in force | From 11 September 2026; the rest of the law applies from 11 December 2027 ([CRA Art. 71](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng)) | The clock starts when the maker becomes aware of the exploited flaw. Finite State argues that the hard question for manufacturers is no longer whether a vulnerability exists, but which of their products contain it. ## Why is it hard to know what is inside a shipped device? Because connected products are assembled from open-source libraries, third-party components and older code from many suppliers, and Finite State says the firmware that actually ships often differs from what the source code and bill of materials list. A single flaw in a shared component can then sit in many product lines at once. Finite State says its answer is binary analysis: inspecting the compiled firmware of the finished device rather than the build manifest. It says the platform keeps generating software bills of materials (SBOMs), VEX statements and signed compliance packages mapped to rules including the CRA, the IEC 62443 industrial standard, the UNECE vehicle regulations R155 and R156, and the FDA's premarket cybersecurity rules for medical devices. > AI-equipped attackers can now find a flaw faster than most manufacturers can figure out which of their products contain it. > > — Matt Wyckhouse, founder and CEO, Finite State Bruce Lin, Senior Manager of the software department at JET Optoelectronics, a Tier 1 supplier of automotive electronics and smart cockpits, is quoted in the release on what the customer gets from that approach: > The depth of Finite State's binary and firmware analysis, the insight it yields into what's in a shipped device and not just the build manifest, the direct and transitive dependency visibility, and audit-ready compliance mapped to the regulations we actually face, are all invaluable. > > — Bruce Lin, Senior Manager, Software Department, JET Optoelectronics ## What will Finite State do with the Series C? Finite State says the round will deepen its presence in international markets and accelerate the platform's autonomous capabilities. The company names customers across power grids, a U.S. national security research laboratory, global automakers, medical device makers and consumer hardware, and was named to the 2026 Inc. 5000 list. The release puts the opportunity in market terms, citing a [MarketsandMarkets forecast](https://www.marketsandmarkets.com/Market-Reports/iot-security-market-67064836.html) that the IoT security market will reach $80.3 billion by 2031. The company also wrote about the round in its own [post on the Series C](https://finitestate.io/blog/finite-state-series-c). ## What does this mean for teams that ship connected hardware? Our analysis: the EU's reporting clock turns firmware inventory from a compliance file into an incident-response tool. Teams that sell devices into Europe need to be able to answer, within hours, which shipped models contain a newly exploited component, and the release positions Finite State's funding squarely on that question. Readers following how security teams work day to day can see the practitioner's view in our [interview with application security analyst Udaya Bhaskar Vemuri](https://techmagazine.io/insight/interview-with-udaya-bhaskar-vemuri-senior-application-security-analyst/), and the growth in connected homes behind the demand in our report on the [smart homes market forecast](https://techmagazine.io/news/smart-homes-market-to-surpass-311-billion-by-2031-driven-by-rising-demand-for-connected-de/). ## Frequently asked questions ### Who led Finite State's Series C? Private funds managed by The O.H.I.O. Fund led the $27 million round, with National Grid Partners, Energize Capital, Energy Impact Partners and CIBC Innovation Banking taking part. ### Which products does the Cyber Resilience Act cover? Under [Article 2 of the regulation](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng), it covers hardware and software products sold in the EU whose intended or foreseeable use includes a data connection to a device or network. Products governed by the EU's medical device, in vitro diagnostic and vehicle type-approval regulations fall outside it. ### What counts as an actively exploited vulnerability under the CRA? [Article 3 of the regulation](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng) defines it as a vulnerability with reliable evidence that a malicious actor has exploited it in a system without the system owner's permission. A flaw that is known but has not been used in an attack does not start the 24-hour clock. ### When does the rest of the Cyber Resilience Act apply? Most of the [Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng) applies from 11 December 2027; the Article 14 reporting duty has applied since 11 September 2026. ### Which regulations does Finite State map its reports to? The company names the EU Cyber Resilience Act, IEC 62443 for industrial systems, UNECE R155 and R156 for vehicles, and the FDA's premarket cybersecurity rules. ## Sources - [Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security](https://www.globenewswire.com/news-release/2026/11/10/3399273/0/en/finite-state-raises-27-million-to-help-device-makers-fight-vulnpocalypse-with-ai-powered-product-security.html): press release from Finite State via GlobeNewswire, 10 November 2026. - [Regulation (EU) 2024/2847, the Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng): the law's text on EUR-Lex, including Article 2 (scope), Article 3 (definitions), Article 14 (reporting obligations) and Article 71 (application dates). - [Our Series C, and What Comes Next](https://finitestate.io/blog/finite-state-series-c): Finite State's own post on the round. - [IoT Security Market Report](https://www.marketsandmarkets.com/Market-Reports/iot-security-market-67064836.html): MarketsandMarkets, the forecast cited in the release.