Empirical Security lands $25M Series A for AI exploit prediction

The exposure management pitch usually sounds the same: patch the criticals first, ignore the rest. Chicago-based Empirical Security just pulled in $25 million in Series A funding to argue there is a better way to sort the pile. Axios reported the round was led by Brightmind Partners, following earlier financing from Costanoa Ventures and Hyde Park Angels, taking the company's total funding to $37 million.

The founders come with pedigree. CEO Ed Bellis and CTO Michael Roytman previously built Kenna Security, where the founders created risk-based vulnerability management, and Jay Jacobs is a co-creator of the EPSS model. The team is selling two products in that lineage: Foundation, a global model that helps organizations predict threats by monitoring over 18,000 exploited CVEs, and Radiant, a custom predictive engine built and fine-tuned for each organization. Bellis framed the thesis in the launch announcement: 'Security teams shouldn't treat every vulnerability the same way. They needed a better way to understand which vulnerabilities were most likely to be exploited.'

Exposure management is a crowded corner of security, and the incumbents lean on generic scoring shared across every customer. A predictive model tuned to a specific software estate is a different claim, and one enterprise buyers will test hard before they rip out what they already own. The Kenna lineage helps that pitch land at the CISO level, because it is roughly the same team that shaped the first wave of vulnerability prioritization.

The honest caveat is that this is a funding announcement, not a customer scorecard. The reporting we retrieved does not disclose a valuation, does not name enterprise design partners, and does not offer an independent benchmark for how Foundation or Radiant perform against the incumbents already sitting in enterprise security stacks. What it does confirm is that a credentialed team has another $25 million to prove the custom-model thesis, and the exposure management category is turning into a fight between generic scoring vendors and startups betting on organization-specific AI.