The security money just moved inside the machine.
Your asset inventory ends at the operating system, and every device that moves sits below it.
On September 15, Exein announced $270m in new funding at a $1.7bn valuation, describing the round as capital for what it calls the security layer for physical AI.
The company, which is based in Rome, says the round was led by Headline, with participation from Sofina, Goldman Sachs, the EIB Group through the European Tech Champions Initiative, KfW Capital and T.Capital, and that it closed oversubscribed.
Exein also reports roughly 5,000 new attacks a week across a network of two billion devices, about five times last year's volume, and says it is training a foundation model on two years of machine telemetry to drive autonomous security agents.
That is a funding story about physical AI security, which is worth naming out loud because it points at the layer most security teams have never had to own.
The money is the signal, and it says the buying decision is not at the model endpoint. It is inside the firmware of the machines that act in the real world, and that layer is one most security teams cannot inventory, cannot scan and cannot patch.
Read the round as a market statement rather than a product claim and it gets more useful. Machines that move are bought by operations, engineering and procurement teams, and the money now follows a security problem those teams have been living with on the floor.
That surface already has a track record. AI is writing exploit code for the machines that run your water and power, and that work keeps getting cheaper.
Physical AI is the industry shorthand for models that drive hardware instead of chat windows. For a security team the interesting part is not the model at all; it is the surface underneath, which is an image built on Linux, a bootloader, a radio and a maintenance channel.
<small>Photo: Valokuvaamo Varjus, public domain, via Wikimedia Commons. A welding robot on a vehicle assembly line, the kind of machine whose firmware a security team rarely owns.</small>
NIST published its revised foundational cybersecurity guidance for IoT product manufacturers earlier this year. It recommends activities manufacturers should carry out before a product is sold, on the stated grounds that customers cannot retrofit the capabilities they need after delivery.
Before rewriting a specification, it helps to know which fundamentals your team already has covered, and a cybersecurity fundamentals skills check is a fast way to find the gap.
Who feels this first: the manufacturers building robots, drones, vehicles, medical equipment and grid hardware, along with the operators who buy those machines and run them for a decade. Who does not: teams whose risk sits in cloud workloads, SaaS and identity, where the tooling market is mature and the patch path already belongs to you.
So on machines you did not build, security arrives as a specification rather than an installation. That changes what a security team is for.
Physical AI security moves the decision into procurement
- Put firmware in the asset inventory, not in a diagram. Most configuration management databases stop where agents can be installed, which means servers, laptops and cloud accounts. Walk the floor, the yard and the clinic, list every device that runs code and moves, and mark the records with no named owner, because an unowned device is an untracked vulnerability.
- Ask the manufacturer what the device can do, not what the slide says. Because the capability ships inside the product, your leverage is a contract requirement, so ask about the update mechanism, the supported lifetime, where telemetry is sent and whether a firmware bill of materials exists; a Linux fundamentals course will shorten that conversation, because you are asking kernel, boot and update questions at heart.
- Treat vendor consolidation as a contract risk while the money is cheap. Alongside the equity round, Exein says it upsized a revolving credit facility led by J.P. Morgan, with KfW joining as a lender, to pursue acquisitions across Europe and the US. The vendor on your critical path can be bought before your next renewal date, so check change of control terms, support commitments and whether the device security product you already depend on has a plausible exit plan.
Two details in the announcement are worth holding on to. The company says its preemptive runtime architecture, launched earlier this year, runs at the kernel level to stop malicious execution before it happens, and that its agentic security architecture ships by the end of 2026, with first foundation models expected in the first quarter of 2027.
<small>Photo: BLM Oregon and Washington, public domain, via Wikimedia Commons. Drones are among the machine classes the round is aimed at, and they are usually secured by the manufacturer, not the buyer.</small>
It also says it has established an APAC headquarters in Taiwan, opened a legal entity in Japan, plans an office in South Korea by 2027 and will grow its US team with a new office in the Bay Area. None of that is security architecture, and all of it shapes who you will be negotiating with next year.
The common mistake is to read a round like this as a bet on AI doing the defending. The duller reading is probably right: buyers are paying because the devices are numerous, unmanaged and physically consequential, and because nobody in the security organization currently owns them.
There is a commercial asymmetry here too. Software vendors get scanned, benchmarked and replaced between quarters, while a machine on a factory floor is amortized over ten years, so the security capability that ships with it is the one you live with.
The old assumption was that the model endpoint is the risk surface, and that a security team closes the gap by buying another tool to watch it.
The new reality is that the machine is the risk surface, so the gap closes through specifications, contracts and an inventory nobody was ever asked to keep.
When your team last tried to list every device running firmware it does not own, which device family was hardest to name, and what finally got it onto the list?