Italian IoT Security Startup Exein Raises $270 Million and Hits $1.7 Billion Valuation

Key points

• Exein, an Italian startup founded in 2018, raised $270 million in a new funding round, bringing its total funding to over $600 million.
• The round values Exein at $1.7 billion and was led by venture firm Headline, with Goldman Sachs, the European Investment Bank Group, Sofina, KfW Capital, Balderton and Lakestar among the participants.
• Exein builds security software for IoT devices, the internet-connected gadgets and machines found in factories, hospitals and homes.
• The company is now training a proprietary AI foundation model on real-world machine behaviour to help detect attacks on physical systems automatically.

What does Exein actually do?

Exein protects IoT devices, physical objects ranging from smart thermostats to industrial robots that connect to the internet and can therefore be hacked. Its software sits inside these devices and watches for signs of attack at the kernel level, meaning it operates in the deepest layer of a device's operating system where it can block threats before malicious code gets a chance to run.

That's a genuinely hard problem. Most traditional security tools were built for laptops and servers, not for the tiny, stripped-down computers embedded in a factory floor sensor or a medical pump. Exein's pitch is that it was designed for that constrained environment from the start. We've tracked IoT security actively this year, and the funding rounds are getting larger, not smaller.

What is the company building next?

Exein says it's developing a foundation model, the same class of large AI system that underpins tools like ChatGPT, but trained on data about how physical machines behave rather than human language. The goal is to spot anomalies and respond without waiting for a human to notice.

CEO Gianni Cuozzo told SecurityWeek: "Frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defense has to as well."

The patch window is the time between a vulnerability being discovered and a fix being deployed. If that window is shrinking toward zero, organisations have almost no time to react manually. The framing is a little breathless, and benchmarks for "machine-speed defence" don't exist yet. But the underlying concern is real. When AI moves into physical infrastructure, a compromised device can mean malfunctioning equipment, not just lost data. Compare HiddenLayer, which raised $100 million on 3 September to guard AI agents in software environments: Exein is betting the harder, more neglected problem is in the hardware underneath.

Should anyone outside the security industry care?

For now this is mostly a story about venture capital flowing into a genuinely important corner of security. Exein's customers are businesses running connected devices, not individual consumers.

The devices Exein protects are the same ones patients and factory workers depend on. A hospital infusion pump or a power-grid controller that gets hacked is not an abstract risk. If you work somewhere that relies on internet-connected equipment, asking your IT team whether embedded security is part of vendor contracts is a reasonable move.

The $270 million will go partly toward Exein's push into the US market, where competition for IoT security contracts is fierce. Whether a foundation model trained on machine behaviour delivers on the autonomous-defence promise is the question worth watching.