What Happened

Exein SpA, a Rome-based cybersecurity company founded in 2018, announced a $270 million funding round at a $1.7 billion valuation on September 15, 2026. The round was described as significantly oversubscribed and led by Headline Management GmbH, with partner Clarey Zhu stating that securing the physical world "will become one of the defining cybersecurity challenges of the next decade."

The valuation marks a sharp acceleration: Exein was valued at $700 million in December 2025, meaning the company's worth has roughly 2.4x'd in nine months. The investor list spans 13 names, including new backers Sofina, Goldman Sachs, the European Investment Bank (through its European Tech Champions Initiative), KfW Capital, and T.Capital, alongside existing investors Balderton Capital, HV Capital, Intrepid Growth Partners, 33N Ventures, Lakestar, Supernova Invest, Blue Cloud Ventures, and Geodesic Capital. Total funding into Exein now exceeds $600 million, according to SecurityWeek.

Exein's core technology embeds security software directly into device firmware, enabling IoT devices, robots, and vehicles to defend themselves without relying on network-level protection. The company says more than 2 billion devices now carry its code across automotive, energy, and robotics sectors. Its Photon product, released earlier in 2026, operates at the operating system kernel level to block malicious code before execution.

Why It Matters

The funding round lands at a moment when AI is rapidly moving from cloud-based applications into physical machines — and the attack surface is scaling accordingly. Exein reports approximately 5,000 new, nonrepetitive attacks per week across its installed base, a fivefold increase from a year ago. Founder and CEO Gianni Cuozzo frames the challenge bluntly: frontier AI models are "pushing the patch window to zero," meaning defense must operate at machine speed, not human speed.

This is a structural shift. Traditional cybersecurity assumes a network perimeter and human-in-the-loop patching cycles. Physical AI — autonomous robots, self-driving vehicles, industrial control systems — requires security that runs at the firmware and kernel level, in real time, on the device itself. Exein's plan to ship an agentic security architecture by end of 2026 and a proprietary foundation model for physical AI security in Q1 2027 signals the category is moving toward AI-native threat response, not just static embedded defenses.

The valuation trajectory also tells a story. A 2.4x increase in nine months, with ARR reportedly up 4x year-over-year, suggests enterprise demand for physical AI security is hitting an inflection point. Asia-Pacific accounts for roughly half of Exein's revenue, which aligns with the concentration of robotics manufacturing and autonomous vehicle development in Taiwan, Japan, and South Korea — all markets where Exein is expanding.

Who Is Affected

Robotics and autonomous vehicle companies deploying AI in physical systems face a growing attack surface that traditional network security doesn't address. As these companies scale deployments, security at the firmware and kernel level becomes a procurement and compliance requirement, not a differentiator.

Enterprise IT and security buyers evaluating IoT and edge AI deployments need to assess whether their security stack covers device-level threats — particularly if those devices operate autonomously or in safety-critical environments.

Cybersecurity startups now have a clear valuation benchmark: Exein's $1.7B valuation and 4x ARR growth demonstrate that investors will fund physical AI security at premium multiples, especially when the company can point to a large installed base and quantified attack telemetry.

Strategic Implications

For AI startup founders

If you're building robotics, autonomous systems, or edge AI, security is about to become a due diligence question from both investors and enterprise customers. Exein's trajectory shows that physical AI security is a venture-fundable category with a clear path to unicorn status. Consider whether your roadmap needs a security partner or an in-house strategy before customers — or regulators — ask.

For developers and operators building with AI APIs

If your AI systems interact with physical devices — robots, vehicles, industrial controllers — evaluate whether your security stack covers firmware-level and kernel-level threats. Exein's Photon product and the broader trend suggest that network perimeter security is insufficient for AI-powered machines that operate autonomously. The patch window is shrinking toward zero, and defense needs to run at machine speed.

For non-technical business owners evaluating AI tools

As AI moves into physical operations — warehouse robots, delivery vehicles, factory automation — the security risks differ fundamentally from cloud-based AI. If you're deploying AI in physical environments, ask vendors how they secure the device itself, not just the network connection. This is becoming a procurement requirement, not a nice-to-have.

What to Watch Next

Monitor Exein's agentic security architecture release, expected by end of 2026, and the first foundation model for physical AI security in Q1 2027. Also watch whether competitors emerge in the physical AI security space — particularly from U.S.-based cybersecurity firms — as Exein uses this round to establish a Bay Area presence and pursue acquisitions in Europe and the U.S.

Frequently Asked Questions

Q: What does Exein do?

Exein builds cybersecurity software that is embedded directly into the firmware of IoT devices, robots, vehicles, and other machines running AI. Rather than relying on network-level protection, Exein's technology enables each device to defend itself at the operating system kernel level. The company claims over 2 billion devices currently run its code.

Q: Why is physical AI security different from traditional cybersecurity?

Physical AI systems — autonomous robots, self-driving vehicles, industrial controllers — operate in the real world where attacks can cause physical harm, not just data breaches. These systems require security that runs on the device itself, at machine speed, because the patch window is shrinking to zero as AI-powered attacks accelerate. Traditional network perimeter security doesn't cover threats at the firmware or kernel level where these devices operate.