🚗 The Fast and the Firmware

Since 11 September, under the EU's Cyber Resilience Act, any manufacturer selling connected machines into the bloc has 24 hours to notify ENISA of a vulnerability under active exploitation, and 72 hours to file in full. The obligation covers equipment already installed, not only what ships next. A British or Danish manufacturer is bound by it exactly as a German one is. Four days later Exein, an Italian firm, closed €234m at a €1.4bn valuation.

Its software sits at kernel level and stops malicious code before it runs. That placement is negotiated with chipmakers and equipment makers two years before a machine reaches a customer. Claroty, Armis and Dragos watch the network and identify what moves across it. Exein is inside the device, on more than 2 billion of them, logging roughly 5,000 unique attacks a week, five times what it counted a year ago.

The foundation model trained on that telemetry does not exist yet. Launch is promised for late 2026, first models early 2027. The case rests on one claim, that two years of logged machine behaviour amounts to an asset no rival can buy or rebuild at speed. Nobody outside the company can test it. And a valuation up thirtyfold in two years is a bill that comes due the moment ARR stops quadrupling.

Half of revenue comes from Asia-Pacific, the regional headquarters has been in Taiwan since December, and the new money pays for American hires and a San Francisco office. Anyone who measures sovereignty by where the customers sit will call that a loss. Embedded security is sold where machines are designed, and much of that design happens in Asia. A Taiwanese equipment maker shipping into Europe needs a supplier that can meet the ENISA deadline.

Headline Growth 🇩🇪, a vehicle anchored in part by public money, led the round. The European Investment Bank 🇪🇺 wrote a direct cheque through ETCI, its tech fund-of-funds, the first since 2023. Sofina 🇧🇪 and KfW Capital 🇩🇪 came in, Balderton 🇬🇧 and Lakestar 🇨🇭 followed on. An oversubscribed round did not need that cheque to close. ETCI has put about €3.5bn into 15 megafunds, and that is what has begun to give European managers the size to lead deals like this rather than watch a US fund do it. The bank is taking credit for the wrong line on its own balance sheet.

Application layers are won on distribution. A component compiled into the kernel is negotiated before launch, with the silicon vendor, and stays put until the next generation. Positions like that are not taken in a price war. Nozomi Networks, founded by two Italians, held a comparable one and has belonged to Mitsubishi Electric 🇯🇵 since January. Europe holds another. This time the funds exist so it need not be sold.