Italian start-up Exein raises $270mn to fight AI hackers with AI

An Italian cyber security start-up that protects everything from robots and drones to air conditioners and lightbulbs has raised $270mn, as industry races to protect billions of internet-connected devices from the mounting risk of AI-powered hackers.

Exein’s founder and chief executive Gianni Cuozzo said AI tools had supercharged the ability of hackers to compromise all kinds of internet-connected machines, requiring a completely new approach to device security.

“Right now I think the hackers have the edge,” he told the FT. Exein’s solution is to use embedded AI technology to fight back, offering “machine-based protection in a world of machine-based attacks”, he added.

San Francisco-based venture capital firm Headline is leading the round, which values Exein at $1.7bn — more than double the $770mn valuation the company secured during its last fundraise just nine months ago.

Clarey Zhu, partner at Headline, said securing the physical world “will become one of the defining cyber security challenges of the next decade”.

The investment into eight-year-old Exein will make it Europe’s second most valuable private cyber security company after Lithuania’s $3bn Nord Security, according to data providers Dealroom.

Cuozzo started hacking games consoles and iPods as a 15-year-old when hacking was a “very complex task”. Now, with the latest AI models, it was straightforward to “reverse-engineer” or deconstruct such devices’ systems to find a way in, he said, noting that many hackers were using “open” models developed by Chinese tech companies, because they could be more easily modified for offensive cyber capabilities than those of their US rivals.

Meanwhile, the proliferation of devices connected to the internet worldwide meant that everything from an air-conditioning unit to a lightbulb could now be attacked, he explained.

Exein’s solution is to protect each individual machine during manufacturing by inserting its cyber security into the low-level software — known as firmware — that dictates how each device operates. Its technology is already in more than two billion devices worldwide.

The company is developing its own foundation model for “physical AI” security, which is due to launch next year. This has been designed to run on the firmware and independently respond to attacks in real time. “We are moving from having security software to having a secure model that is running constantly on the device and will automatically react to attacks,” Cuozzo said.

The hacking of industrial devices was already becoming more common, with criminal groups compromising factory machinery before demanding a ransom payment to relinquish control back to the operator, Cuozzo said. Meanwhile, governments were concerned with protecting critical infrastructure and defence equipment, he noted.

Suspected Iranian hackers staged a series of attacks on US water infrastructure in July by targeting industrial computers in facilities across a dozen states, which caused concern in the White House.

However, the activities of criminal and state-backed actors were increasingly indistinguishable. “There’s no military domain, there’s no civilian domain, everything is blended,” said Cuozzo, who worked in cyber intelligence for “various governments” before founding Exein in 2018.

The new investment was needed in part to help Exein compete with the leading AI labs for “scarce” cyber security and computing talent, Cuozzo said.

This year, Google, OpenAI and Anthropic have released models with advanced cyber security capabilities, either emerging from their general-purpose AI systems or deliberately tuned for the task.

The Rome-based company wanted to double its 100-strong workforce in the next 18 months and was targeting annual revenues in the hundreds of millions of dollars in the next few years, from “double-digit” millions today, he added.

Exein expected demand for cyber security products to increase as more things were automated. “The technological transition that we are now facing with humanoid robotics, drones, self-driving cars . . . will happen only if people feel safe around them,” Cuozzo said.