Empirical Raises $25 Million to Predict Cyber Attacks Before They Happen
A Chicago startup says its AI tools can spot which security flaws are most likely to be exploited next. Investors just bet $25 million that it's right.
Key points
- Empirical, a Chicago-based cybersecurity startup founded in 2024, raised $25 million in a Series A round led by Brightmind Partners.
- The round brings Empirical's total funding to $37 million.
- Empirical's flagship product, Foundation, monitors more than 18,000 known exploited software flaws for signs of imminent attack.
- Radiant, its second product, tailors threat predictions to each organisation's specific environment.
- The founding team previously built Kenna Security and co-created EPSS, a scoring model that estimates how likely a given software flaw is to be attacked.
Most security teams know they have more problems than time. Which flaws will criminals actually exploit this week? Empirical, launched in 2024, says it can answer that.
Brightmind Partners led the $25 million Series A round, joined by Costanoa Ventures, Hyde Park Angels, and other investors. Total funding now sits at $37 million.
What does Empirical's software actually do?
It watches known software vulnerabilities, flaws in programs that attackers can weaponise, and predicts which are likeliest to be hit next. Foundation monitors more than 18,000 CVEs (Common Vulnerabilities and Exposures, the standard catalogue of publicly known software flaws) at any given time. Radiant then narrows that picture down to the risks that matter for a particular company's setup.
The pitch is prediction over reaction: patch the right things before criminals arrive, not after.
The team isn't new to this. CEO Ed Bellis co-founded Kenna Security, which pioneered risk-based vulnerability management, meaning ranking security flaws by likely real-world impact rather than treating each one as equally urgent. CTO Michael Roytman served as Kenna's Chief Data Scientist. Chief Data Scientist Jay Jacobs co-created the Exploit Prediction Scoring System (EPSS), a freely available model that estimates the probability of a given flaw being exploited within 30 days.
Bellis told SecurityWeek that defending against the current volume of threats "would require a fundamentally new approach," and that AI now makes predictive capabilities possible that weren't viable before. Our story from 16 July on AI finding flaws faster than teams can fix them set exactly the context Empirical is building into.
Empirical is targeting security teams in healthcare, financial services, and technology. The healthcare angle isn't decorative: a hospital hit by ransomware (software that locks files until a ransom is paid) can't afford the downtime that a slow patch cycle creates.
Should you worry?
For ordinary people, this tool sits in the background. You won't see it. But if it works, the companies holding your medical records or bank details patch the right holes before criminals find them. That's the part worth watching: whether EPSS-style probability scoring, applied at this scale, actually moves patch queues in practice or just adds another dashboard nobody trusts.
Your own habits stay the same: keep software updated, use strong unique passwords, and turn on two-step verification (a second login check beyond your password) wherever it's offered.
