Finite State

The core analysis is program analysis, and the AI sits on top of it. Finite State's platform unpacks firmware across more than 50 binary instruction set architectures, extracts components from firmware, binaries and source code, runs static analysis on decompiled code, and decides reachability from call graphs and entry points: sophisticated algorithms, but not models whose parameters are learned from data.

The company now calls the product an "AI-Native Product Security OS": Finite State Copilot "Answers security questions in plain language" from a product's analysis history, AgentOS "Continuously monitors product risk across firmware versions" and flags new exposures, and the company's timeline lists "Reachability and AI Noise Reduction" in 2025. Copilot's plain-language answers describe a language model at work; the SBOMs, vulnerability matching, reachability and VEX decisions stand without it.

Review is built into the described workflow; the point where a person must confirm a not-affected decision is not. Finite State describes "autonomous, review-gated workflows" that produce "Reviewable evidence packages" and "Reachability explanations", and says affected and not affected decisions come with "defensible rationale that stays consistent across reruns".

Much runs automatically: "evidence and risk decisions are updated automatically" as builds, vulnerabilities and suppliers change, AgentOS monitors firmware versions and flags new exposures, and the changelog records automatic resolution of findings patched in vendor-authored distributions and VEX decisions carried forward between versions.

A not-affected VEX decision is what a manufacturer puts before a regulator to justify leaving a known vulnerability unpatched, and nothing published says whether such a decision can be issued without a named person approving it, or what happens when one proves wrong.

The analysis methods are named and the product is versioned in public; the AI components are not identified. Finite State describes binary software composition analysis, static analysis of decompiled code, and reachability analysis over call graphs and entry points, supports more than 50 binary instruction set architectures, and exports SPDX, CycloneDX and VEX.

Its documentation carries a dated public changelog with frequent releases, such as standalone CycloneDX VEX export on 29 September 2026 and firmware unpacking and reachability coverage on 10 September 2026, so a buyer can see when the platform changed. The models behind Copilot's plain-language answers, AgentOS and the AI noise reduction are not named, and no training data or model change record is published.

The architecture is described and no model provider is named. Customers upload firmware, binaries, source code and supplier SBOMs, which the platform decomposes; the pricing page says "Standard hosting is in the US, with EU and other regional options available for Enterprise customers" and that data is encrypted at rest and in transit, without naming the host.

Copilot answers questions from a product's analysis history in plain language, which puts customer analysis data in front of a language model, but no model provider is named and no subprocessor list is published. The platform ingests more than 120 intelligence sources, which are feeds it reads rather than parties receiving customer data.

Large platform totals and percentages, with no method and no named customer. The home page reports 10.9 million findings analyzed for reachability since 2024, 4.4 million unreachable findings removed in two years ("Since 2024, 40.5% of findings analyzed for reachability were confirmed unreachable"), more than 10,000 scans a month, 248,000 SBOM downloads, 95 percent less vulnerability noise and triage cut to 10 minutes; the company timeline cites a 90 percent reduction in triage noise.

Nothing says how findings came to be "confirmed unreachable", against what reference, or for which products and industries, and the site names no medical device customer. No independent test of reachability accuracy, including how often an unreachable finding later proved reachable, is published.

General assurances and contract terms, without the answers AI raises. The product handles manufacturers' firmware, binaries and source code rather than patient data. The pricing page says data is encrypted at rest and in transit and hosted in the US by default.

The customer terms, effective 1 July 2026, have Finite State return or destroy a customer's confidential information, firmware included, on request at the end of an order, except records the law or the EU Cyber Resilience Act requires it to keep and routine backups, and keep records of CRA managed service deliverables for five years; they also give Finite State all rights in the "raw data" it produces from analyzing customer firmware.

Nothing says whether customer firmware or analysis history is used to train or tune models, whether Copilot's inputs are retained by a model provider, or how data is de-identified, and nothing covers guardrails on AI output or how a safety event is handled.

No status and no privacy document that reaches the product. Finite State's customers are device manufacturers and the platform analyzes firmware and code, so business associate status may well not arise, but the company does not say whether uploaded firmware or device configurations can carry patient data or how it would handle them.

Its privacy policy, effective 14 September 2018, applies to its websites; the customer terms protect uploaded firmware as confidential information but are not a privacy document. A plain statement that the product takes in no patient data, backed by a privacy document for the service itself, would give a buyer a position to rely on.

A recognized certification is named in the company's own material, without the report. A Finite State blog post of 24 July 2024 says "Finite State has achieved SOC2 Type 2 certification." No report period, auditor or trust services criteria is stated, nor any later renewal, though a SOC 2 Type 2 report conventionally covers about twelve months. There is no trust center, ISO/IEC 27001 certificate or penetration test summary for the platform. The platform holds decomposed firmware, the vulnerabilities found in it and which of them are reachable, across many manufacturers. Finite State sells penetration testing to customers.

No device claim; the product works the device regime for manufacturers without stating its own position. Finite State is security software for connected product makers, with no FDA clearance and none claimed. Its medical device page says it "supports FDA 510(k) and 524B submissions by producing and maintaining the cybersecurity artifacts FDA expects, including firmware-grounded SBOMs, vulnerability and risk documentation, VEX decisions, traceability, and a complete audit trail", and it maps work to FDA premarket and postmarket guidance, IEC 62304, EU MDR, UL 2900 and the EU Cyber Resilience Act.

The regulated position belongs to the customer's device, not the tool, and no page states an intended purpose for the platform itself. The customer terms say Finite State is not liable for regulatory fines or remediation costs arising from reliance on its outputs in CRA compliance.

Review and traceability are stated as design principles, with no evaluation behind them. Finite State describes its AI-native workflows as "review-gated" and "grounded in real product artifacts", with outputs tied to the firmware and code analyzed. No governance framework, model evaluation or outside review is published. The consequential error is a false negative: a vulnerability judged unreachable becomes a documented not-affected decision that justifies leaving it in a shipped device. No false negative rate for reachability, and no result by architecture, binary format or language, is published, although those are where static reachability analysis most often misses paths.

Mechanisms let a manufacturer check the output; the terms stand behind the work, not the findings. The platform gives reachability explanations, keeps an audit trail and produces reviewable evidence packages. The customer terms, effective 1 July 2026, warrant that Finite State will perform in a professional and workmanlike manner, disclaim any warranty on "the quality, performance, accuracy or functionality of the platform" or that it "will identify all vulnerabilities in a product", indemnify for intellectual property claims and for breach of the stated warranties, cap liability at twelve months of fees for CRA managed services, and exclude liability for regulatory fines or remediation costs arising from reliance on its outputs. No accuracy or false negative figure for reachability is published.

It has no clinical record surface; the systems it connects to are a manufacturer's build, development and ticketing tools. The platform page names GitHub Actions, GitLab CI and Jenkins for release pipelines, REST and GraphQL APIs, a CLI, IDE integrations and ticketing workflows, and the changelog records Jira ticket scope and a scan queue API. The platform imports supplier SBOMs and third party findings alongside its own analysis and draws on more than 120 intelligence sources. The integrations are named, but none is documented as writing results back in both directions, and no customer is shown running one in production.

Hosting options and residency are stated; isolation and the processing path are not. The pricing page says "Standard hosting is in the US, with EU and other regional options available for Enterprise customers. All data is encrypted at rest and in transit." The host is not named, nothing says whether customers share infrastructure, and nothing says where Copilot's language model processing runs or whether it leaves the chosen region. No on-premises option is described.

No price, and the pricing basis is described. The pricing page says pricing "is based on usage and the capabilities you require", whether scanning firmware binaries, ingesting SBOMs or monitoring over time, with volume and multi-project discounts, platform access and professional services such as penetration testing sold separately or together, a proof of concept or pilot on request, and invoicing in US dollars only. No figure, tier or unit rate is published and a quote starts with a discovery session.

Coverage is named clearly, with validation behind part of it. Finite State serves makers of connected products: medical devices, automotive, energy and utilities, government and industrial control systems, with medical device support covering FDA 510(k) and 524B submissions, postmarket obligations, IEC 62304, EU MDR and UL 2900. It covers design through post-market, from threat modeling to SBOMs, reachability, release evidence and monitoring. Platform scale is reported across all industries (10.9 million findings analyzed for reachability since 2024), but the site names no medical device manufacturer as a customer.