Exein Prices Physical AI Security at $1.7 Billion

Exein raised $270 million at a $1.7 billion valuation to train Physical AI security on more than two billion devices. Headline led the oversubscribed round, with Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital and Deutsche Telekom’s T.Capital joining.

The Rome company said the price makes it Europe’s most valuable privately held cybersecurity startup. The product that slogan is built on, a proprietary foundation model for machine-time defence, is still scheduled for the first quarter of 2027.

A $1.7 Billion Price on Two Billion Kernels

Exein sells runtime security that sits inside firmware and operating-system kernels, then watches how connected machines actually behave. The new capital sits on top of an upsized revolving credit line led by J.P. Morgan, with KfW joining as a lender. Prior backers Balderton, HV, Intrepid Growth Partners, 33N Ventures, Lakestar, Supernova Invest, Blue Cloud Ventures and Geodesic Capital also came back in.

THE CHEQUE IN FOUR FIGURES

• The round: $270 million of new equity at a $1.7 billion post-money valuation, which Exein said was significantly oversubscribed.
• The estate: software already running on more than two billion connected devices across industry, cars, energy, healthcare, chips, aerospace and robotics.
• The growth: H1 2026 annual recurring revenue up 4x year on year, after a 2025 in which Exein said revenue rose five times on the year before.
• The mix: about 50 per cent of revenue already comes from Asia-Pacific, with operations in Europe, APAC and the United States.

That last split is the tell. A cybersecurity firm founded in Rome in 2018 now books half its sales in Asia, after opening an APAC headquarters in Taiwan following its December 2025 raise. The $270 million is meant to push the same motion into the United States, including a planned San Francisco Bay Area office and more US hiring over the next two years, plus further M&A.

Valuation has risen thirty-fold in two years, the company said. Nine months earlier, the December 2025 extension was priced at just over $800 million. This round more than doubles that mark.

Photon Stops Code Before It Runs

Earlier in 2026 Exein launched Photon, a kernel-level runtime that blocks execution before a payload can run. The product page is blunt about the lag it is trying to kill: most runtime tools detect, alert, then wait for a human, while the useful window for an autonomous machine is already closed.

Photon is already in the field. Company engineers have published runtime rules that reproduce the effect of upstream Linux fixes without a package update or a reboot, including a high-severity snap-confine bug disclosed in July 2026. The same kernel hook is what the new money is supposed to extend into Physical AI: robots, vehicles and industrial systems that perceive, decide and act without waiting for a security operations centre.

Frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defence has to as well. Physical AI is the natural next step for Exein: we’re building machine-time security for machine-time attacks.

Gianni Cuozzo, founder and CEO of Exein

The devices already carrying the code are still the unglamorous ones. Cars, home routers, industrial boards and chipsets made by firms such as MediaTek, Arm and Nvidia. Physical AI is the next workload on the same hook. Kernel enforcement also sits below the user-space agents that fill most security dashboards. If an attacker already owns the kernel, those tools are looking the wrong way.

Giovanni Alberto Falcione, co-founder and chief technology officer, put the timing in military terms. “This comes exactly at the right time. AI is leaving the data centre and coming to the physical world, to cameras and drones,” he said. “The opportunity is for us to be the standard in this emerging market. We’re securing a good part of our life as these systems go to war.”

EIB Money Follows Exein Into Physical AI

Headline, a US growth firm, wrote the lead cheque. Clarey Zhu, a partner there, said the firm found Exein while mapping robotics and the Physical AI value chain, and that most of those systems still have no real protection. Beside Headline sit two European public financiers whose job is late-stage scale-up capital, not seed-stage software.

The European Investment Bank Group is in the round through the European Tech Champions Initiative, the EIB Group fund-of-funds launched in 2023 with France, Germany, Spain, Italy, Belgium and the Netherlands. As of 31 August 2026, ETCI 1 had put €3.5 billion into funds, backed 47 EU companies and counted 12 unicorns. Its point, stated by the EIF, is to close a late-stage gap versus the United States so European firms can raise large rounds at home.

KfW Capital, the venture arm of Germany’s state development bank, joined both the equity round and the J.P. Morgan credit line. T.Capital, Deutsche Telekom’s venture unit, added a strategic telecoms name. On 10 July 2026 the EIB Group and all 27 EU governments launched ETCI 2.0, an €80 billion scale-up investment alliance aimed at keeping late-stage tech in Europe.

None of that makes Exein a state project. It does mean a US-led round now carries European public-bank risk on a company whose software already sits in chips, vehicles and factories. Falcione has said the work is especially relevant to defence and critical industries, and that Exein now integrates with firmware teams and OEMs rather than selling only a dashboard.

Fourteen Months From Series C to Unicorn

The $1.7 billion mark is the first time Exein has crossed $1 billion. The climb is compressed into a little more than a year of disclosed rounds.

THE DISCLOSED FUNDING LADDER

The December 2025 package was a mix of equity and debt, roughly half and half, and brought 2025 fundraising to €170 million after the €70 million Series C in July 2025. That Series C named MediaTek, Supermicro, Kontron, SECO and AAEON as chipset and manufacturer partners, and said the platform then protected over one billion devices at runtime. By late 2025 Exein said it was on track to pass two billion in the first quarter of 2026. The new round treats that target as done.

Belgium’s Aikido Security reached a $1 billion valuation in January 2026, which is the nearest private European cybersecurity mark on the public record. Darktrace, the Cambridge firm often used as a comparison, is already listed. Exein’s “most valuable” claim is a private-company claim, and it is the company’s own.

Chip Partners Face a New Reporting Clock

The raise lands in the same month EU manufacturers must start reporting vulnerabilities under the Cyber Resilience Act, ahead of full application in December 2027. Radio Equipment Directive 3.3 rules have been in force since August 2025. Exein has sold into that calendar for two years, pitching on-device runtime as a way to stay current when a fleet cannot wait for a firmware recall.

NAMED HARDWARE RELATIONSHIPS

• Series C partners: MediaTek, Supermicro, Kontron, SECO and AAEON were listed in July 2025 as manufacturers trusting the platform on more than one billion devices.
• Kontron: Exein runtime became a standard feature of KontronOS and KontronAIShield, covering Kontron’s 3,000-plus customers in manufacturing, energy, healthcare, automotive, infrastructure and aerospace.
• This round: Exein said its technology is now embedded in some two billion chips, with customers including Nvidia, Leonardo, AWS, MediaTek and Arm.
• The compliance pitch: the same kernel agent is sold against the EU Cyber Resilience Act and the US Cyber Trust Mark, which matters to anyone shipping a connected product into both markets.

Long contracts sit behind those logos. Cuozzo has said Exein’s deals often run five, seven or ten years, unlike two-to-three-year enterprise software terms. That duration is how a firm with a still-modest revenue base (H1 ARR growing fast off a 2025 that itself grew five times) can talk about a digital immune system without sounding like a slide. It is also how two billion devices become training data rather than a support burden.

What the Foundation Model Is Being Trained On

Exein now records about 5,000 new, non-repetitive attacks across its network each week, five times the level of a year earlier. The company wants a foundation model trained on years of machine telemetry from that estate, not on human-written text, then autonomous agents that act at processor speed. Architecture is due by the end of 2026. First models are due in Q1 2027.

That lag is the risk inside the $1.7 billion price. Photon is shipping. The Physical AI model is not. Clarey Zhu was explicit that the category is still early.

The whole space is quite new, and most physical AI systems are not secured at all. But AI attacks are happening more and becoming more sophisticated. Most don’t have the visibility, let alone protection.

Clarey Zhu, partner at Headline

WHAT WE KNOW

• Photon: Kernel-level preemptive runtime launched earlier in 2026 and shown at RSAC in San Francisco from 23 to 26 March.
• Telemetry: Training corpus is the company’s own machine data from more than two billion devices, plus the 5,000 new weekly attack variants.
• Money use: US and APAC expansion, a Bay Area office, more hiring, continued M&A, and the model itself.

WHAT IS UNCONFIRMED

• Model quality: No public benchmark, customer design-win or parameter count has been released for the Q1 2027 models.
• Facility size: The J.P. Morgan revolving line was upsized, but Exein did not state the new limit.
• Deal list: M&A is company policy, not a named pipeline, and the San Francisco office has no opening date.

Homepage figures still on the marketing site sit below the new device count: more than one million high-severity vulnerabilities uncovered, and more than 100,000 attacks blocked in a fraction of a second. Those are installed-base metrics. The raise is a bet that the same sensors can teach software to police robots and agents without a human in the loop.

Frequently Asked Questions

Who Founded Exein and When?

Gianni Cuozzo (CEO), Gerardo Gagliardo (CFO) and Giovanni Alberto Falcione (CTO) founded Exein in Rome in 2018. Gagliardo has said he joined when the company had five people and that the three spent the Covid year grinding through a Series A. As of December 2025 the firm had about 100 staff, with 45 per cent in Europe (half of those in Italy), 30 per cent in Asia and 25 per cent in the United States.

What Is Exein Photon and Where Does It Run?

Photon is Exein’s kernel-level preemptive runtime, shown at RSAC 2026, that adjudicates at the Linux Security Module layer and can deny a syscall before the process runs. Separate agents cover legacy ARM32 boards with tiny RAM (Runtime Lite), modern embedded Linux with eBPF (Runtime/Pulsar), and servers or cloud hosts (Photon). The stack is written in Rust.

How Much Had Exein Raised Before This Round?

Disclosed equity before September 2026 included a €15 million Series B in July 2024, a €70 million Series C in July 2025, and a €100 million extension in December 2025 that mixed equity and a structured credit line with J.P. Morgan. The 2025 total was €170 million. Trackers that had not yet booked the new round still showed cumulative funding in the low $200 millions.

What Is the European Tech Champions Initiative?

ETCI is an EIB Group fund-of-funds, managed with the European Investment Fund, that invests in large European venture and growth funds so scale-ups can raise at home. ETCI 1 launched in 2023 with up to €3.9 billion. By 31 August 2026 it had invested €3.5 billion in funds, reached 47 EU companies and counted 12 unicorns. Exein’s new round lists the EIB Group as a participant through ETCI, not as the lead investor.

The $1.7 billion sticker is real money against a real installed base. The Physical AI slogan still has to survive contact with a model that does not ship until next year, on machines that already get 5,000 new attack shapes a week.