Rome-based Exein has raised $270 million at a $1.7 billion valuation to expand cybersecurity technology intended to run inside connected machines rather than only around them at network level. The company targets robots, vehicles, drones, industrial equipment, medical devices, and other systems in which software can increasingly influence the physical world. The new capital will support further international expansion and product development across embedded security.

The financing was led by Headline and included institutional and strategic investors from Europe and elsewhere, taking Exein’s total funding above $600 million according to the company. The size of the round says little by itself about the effectiveness of the technology, but it reflects investor interest in a category where software vulnerabilities are increasingly attached to products that may remain in operation for years. Security therefore has to survive much longer hardware lifecycles than the typical enterprise endpoint.

Exein’s approach is to embed monitoring and policy enforcement into firmware and runtime environments so devices can observe processes and react to suspicious behaviour locally. The company has integrated with embedded ecosystems including Yocto Linux and MediaTek’s Genio platform, providing distribution routes through software and chip layers used by manufacturers. That model aims to put security into equipment before deployment rather than relying on customers to add monitoring after purchase.

The company says it sees around 5,000 new, non-repetitive attacks each week across a network of two billion devices. Those numbers are Exein’s own telemetry claims and have not been independently audited, although they illustrate the scale of the estate the business is trying to address. Connected products range from relatively conventional Linux systems to highly constrained devices that cannot run the endpoint-security tools used on laptops and servers.

Product security becomes a lifecycle obligation

Embedded systems create difficult security conditions because devices may have limited compute, fragmented hardware, specialist update mechanisms, and operational lives measured in years rather than months. Industrial or safety-critical equipment can also be difficult to patch because downtime has direct operational consequences. Manufacturers therefore need to understand which components are present, which vulnerabilities affect them, and how security support will continue once products leave the factory.

European regulation is moving more responsibility upstream. Incident-reporting duties under the Cyber Resilience Act began applying in September, requiring manufacturers to report certain actively exploited vulnerabilities and severe incidents affecting products with digital elements. Broader product-security obligations follow later, turning vulnerability management and software maintenance into a continuing part of product operations.

That creates a commercial opening for suppliers able to give manufacturers visibility into deployed equipment. Rapid reporting is difficult when a company cannot observe what a product is doing after it reaches a customer, while a device estate distributed across factories, vehicles, homes, and public infrastructure cannot be managed as though every endpoint sits inside one corporate network. Embedded telemetry can help close that gap, although deploying a security platform does not by itself satisfy regulatory obligations.

The regulation also expands the number of organisations that have to operate partly like software-security companies. Manufacturers of industrial controllers, appliances, vehicles, and specialist electronics increasingly ship operating systems, libraries, network connections, and update mechanisms inside physical products. Those components create supply-chain dependencies that can persist across several product generations.

Autonomous equipment raises the consequence of compromise

Exein uses the term physical AI for systems in which AI software interacts with machines able to move, sense, or control their environment. The category is broad, but the security distinction is useful: compromising an AI-enabled vehicle or robot can affect physical operations as well as information. Protection therefore has to account for malicious code and vulnerable components alongside attempts to manipulate sensors, permissions, or automated actions.

Factories and logistics systems also distribute the attack surface across equipment that may sit beyond the normal ownership boundary of corporate IT teams. Some devices have intermittent connectivity, some cannot tolerate reboots or long maintenance windows, and others depend on specialist vendors for software updates. Security architecture has to accommodate those constraints rather than simply transplant desktop tooling into machinery.

Integration into embedded operating systems and silicon ecosystems could give Exein an advantage if manufacturers decide that security should ship as a standard product layer. It also raises the execution bar because the software must work reliably across constrained hardware without interfering with safety, performance, or certification. The $270 million round gives the company more capital to pursue that market, but adoption will ultimately depend on manufacturers deciding that embedded runtime security is worth designing into products from the beginning.