Exein Wants Every Machine to Defend Itself

Imagine hacking a coffee machine. It sounds ridiculous. There is no bank account inside it. No valuable PowerPoint deck. No private messages worth stealing. But that misses the point. The coffee machine does not have to be the target. It can simply be the door.

The same logic applies to a security camera inside a factory, a sensor on a railway carriage, the cooling equipment inside a data centre, a medical device, an industrial robot, an autonomous vehicle or one of the thousands of small computers hidden inside modern infrastructure. As physical objects become computers, every one of them becomes a potential cybersecurity problem. And unlike a laptop, many of these machines were never designed with an antivirus programme, security team or even regular software updates in mind.

This is the world Exein has been preparing for since 2018. The Rome-born company does something deceptively simple: it puts cybersecurity inside the device itself, monitoring what the machine is doing while it operates and attempting to stop malicious behaviour directly at the operating-system level. Founder Gianni Cuozzo has described the idea as giving connected objects the ability to defend themselves rather than assuming that a secure network will always protect them. Today, Exein says its technology reaches more than two billion devices, across industries including industrial automation, automotive, energy, healthcare, aerospace and robotics.

And suddenly investors are paying attention. On 15 September 2026, Exein announced a $270 million funding round at a $1.7 billion valuation. The round, led by Headline, included Sofina, Goldman Sachs, the EIB Group, KfW Capital and Deutsche Telekom’s T.Capital alongside existing investors including Balderton, Lakestar and others. The round was oversubscribed. Exein’s annual recurring revenue in the first half of 2026 was running at roughly four times the level of a year earlier, while the Financial Times reported that the company now wants to move from tens of millions in revenue into the hundreds of millions.

Less than two years earlier, Exein was protecting around 80 million devices. In 2025, it crossed one billion. Now it claims more than two billion. This is not the normal growth curve of a cybersecurity company selling licences one corporate customer at a time. Exein has discovered something potentially much more powerful: distribution through the machines themselves.

And that may be the most important part of the story.

The boy who wanted a computer badly enough to work for it

Exein’s origin story does not begin in Silicon Valley. It begins in Darmstadt, Germany. Gianni Cuozzo was born into an Italian immigrant family whose parents had moved from Irpinia to Germany after the 1980 earthquake. His father worked as a waiter and his mother in a canteen. When Cuozzo wanted his first computer at 15, he worked in a bar, an ice-cream shop and a restaurant to pay for it himself. At home there was no internet connection, so he would go to an internet café and pay by the hour to study how games such as StarCraft and Civilization worked underneath the surface.

That fascination gradually moved from software to something more unusual: firmware. Firmware is the low-level software buried inside electronic devices: the code sitting between hardware and the higher-level applications people normally interact with. Most users never see it. That invisibility is precisely why it can be interesting to hackers.

Cuozzo became involved with the European hacker scene and the Chaos Computer Club, where reverse-engineering devices was part of the culture. What fascinated him was the distinction between hacking conventional software and hacking a physical machine. Change code on a website and something changes on a screen. Change the right code inside a piece of machinery and something can happen in the physical world.

That expertise eventually took him somewhere few startup founders can claim on a CV. According to Cuozzo’s account to Wired Italia, he worked with NATO and governments associated with NATO on active cybersecurity, including work connected to conflict theatres in the Middle East, Africa and Eastern Europe. One task, he said, involved understanding how vulnerabilities inside weapon-system firmware could themselves be weaponised. Wired also reported his claim that he once gained access to the systems of a randomly selected oil tanker in around ten minutes.

In 2017 he left that world and created Aspisec, a cybersecurity consultancy where companies paid the team to attack their systems and expose weaknesses before malicious hackers could find them. His initial personal investment was almost comically small. €208. Or, as Cuozzo remembers it, €206 after spending €2 on the tax stamp.

He was the technical person inside a tiny company trying to look larger than it really was. Cuozzo told Wired that he even created multiple email addresses under different names so clients would think an entire team was handling their account when, in reality, he was answering the emails himself. The consultancy grew. But while attacking other companies’ products, Cuozzo saw a larger problem.

The security industry was spending enormous amounts of money protecting networks, laptops, servers and cloud infrastructure. Nobody had really solved how to give billions of small connected machines their own immune system. So in July 2018, Exein was born as a spin-off from Aspisec. United Ventures put €2 million into the company that November, at the time described as the largest cybersecurity investment in Italy’s startup sector.

Cuozzo had gone from being paid to break machines to building a company whose purpose was making them harder to break.

The computer has escaped the computer

For most of computing history, cybersecurity had reasonably clear boundaries. Your computer was a computer. Your phone was a computer. Servers lived in data centres. Security software could be installed on those devices, networks could be protected with firewalls, and corporate IT teams broadly knew which machines belonged to them. That distinction is disappearing. A modern car contains computers.

A factory is filled with computers. A hospital is filled with computers. A railway carriage is full of them. Televisions, cameras, energy systems, HVAC equipment, lifts, logistics infrastructure and household appliances increasingly contain processors, operating systems and internet connections.

There were about 21.1 billion connected IoT devices worldwide by the end of 2025, according to IoT Analytics, with enterprise connections representing roughly 45% of them. The enterprise IoT market itself reached approximately $324 billion in 2025 and was forecast to keep expanding in 2026. And every time computing moves into another object, the attack surface grows.

The problem becomes even more serious because many connected devices behave nothing like a MacBook. They can have limited memory and processing power. They may operate for ten or twenty years. Some spend their life offline or behind unreliable connections. Many cannot tolerate heavy security software consuming resources. Some are buried inside critical machinery where shutting the system down every week to install patches is not particularly realistic.

That creates a category of cybersecurity that looks very different from protecting office laptops. And Exein’s central strategic decision was to go inside.

An antivirus for things, except that description undersells it

The easiest way to explain Exein is to call it an antivirus for machines. But technically, the company is trying to go deeper.

Its flagship technology operates at runtime, meaning while the device is actually functioning. Rather than only scanning software before deployment and hoping nothing unexpected happens later, Exein can observe what processes are doing as they execute.

Its runtime technology operates close to the operating-system kernel, the core layer that controls things such as memory, processes and access to system resources. If software suddenly begins behaving in a way it should not (accessing a protected file, launching an unexpected process or deviating materially from its normal activity) Exein can detect and potentially block that action directly on the device.

And crucially, it can function at the edge. That means the device does not necessarily need to send everything back to a cloud security platform and wait for instructions. Protection can happen locally, including in environments without continuous internet connectivity. For a web browser, the difference may not sound revolutionary. For an autonomous robot in a factory, an aircraft component, an electricity-grid controller or a medical device, it matters considerably more.

A machine operating in the physical world cannot always afford to wait for a cloud server to decide whether something dangerous is happening.

Build security into the product, not around it

This leads to the most interesting part of Exein’s business model. Most cybersecurity companies sell to the organization that needs protecting. Exein increasingly wants to sell one layer earlier. It works with manufacturers, chip companies, embedded-computing businesses and original-equipment manufacturers, integrating security into the technology before the finished device reaches the ultimate customer. Think about the difference.

A conventional cybersecurity vendor might convince one factory to install its product across 5,000 machines. Exein can theoretically convince the company manufacturing those machines to embed its security technology before they leave the factory. One commercial relationship can therefore become thousands, millions or potentially hundreds of millions of protected devices. Instead of acquiring every end customer individually, Exein tries to acquire distribution.

This is why its partnerships matter so much. In January 2025, Exein announced a deal with MediaTek, one of the world’s largest chip designers, to integrate its technology natively into MediaTek’s Genio platform. MediaTek technology goes into enormous numbers of consumer, industrial and smart devices. Reuters reported that the agreement could eventually put Exein technology into more than three billion devices and that the contract, initially valued above €5 million, was expected to roughly double in value by 2028.

Then there is Yocto. The Yocto Project is widely used to build embedded Linux systems, effectively infrastructure underneath huge numbers of connected products. Exein has integrated a security meta-layer into that ecosystem, allowing manufacturers building Yocto-based products to incorporate its security capabilities far earlier in development. Exein says the broader Yocto ecosystem touches around 1.5 billion devices annually.

Partnerships with Supermicro, AAEON, SECO, Kontron and OnLogic push the strategy further into industrial computing and the edge. Kontron, for example, made Exein technology a standard security capability within parts of its operating-system and AI security portfolio serving thousands of industrial customers. AAEON has integrated Exein across connected industrial and edge systems. OnLogic announced a pre-validated combination that can place Exein protection directly onto its x86- and ARM-based industrial hardware.

This begins to create something much more interesting than a normal software sales pipeline. The deeper Exein enters the device supply chain, the closer cybersecurity becomes to an ingredient rather than an application. A manufacturer does not want to redesign its security architecture every time it builds a new machine. Once security becomes integrated into the chipset, operating system and manufacturing workflow, replacing the provider becomes significantly more complicated.

That is where a potential moat begins to appear.

The Intel Inside strategy of cybersecurity

There is an elegant business idea hiding here. Some technology companies win because consumers actively choose them. Others win because somebody else chooses them before the consumer even arrives. Qualcomm can make money from a phone buyer who has never consciously chosen Qualcomm. ARM architecture can sit inside a device without the person using that device knowing ARM is there.

Cloudflare may protect a website while the person browsing it never sees the Cloudflare product. Exein’s ideal future probably looks something like this: billions of people interact every day with machines protected by Exein without ever knowing they are Exein customers. That creates a very different growth equation from consumer software. The customer is not necessarily the user.

The distribution partner becomes enormously important. And the company’s brand may matter far less to the public than its position inside the technology stack. This is one reason the MediaTek relationship is strategically more important than its immediate contract value. The €5 million figure Reuters reported is almost irrelevant beside the distribution potential. The question is not simply: How much does MediaTek pay Exein?

It is: What happens if Exein becomes the default security architecture manufacturers already expect to find inside their technology stack? That is a much bigger company.

For five years, Exein deliberately made almost no money

One of the stranger things about the company’s history is that Cuozzo says Exein effectively avoided focusing on revenue for its first five years. That sounds almost irresponsible until you understand the product. This is not a scheduling app.

Security software embedded inside machinery has to be extremely lightweight, reliable and difficult to circumvent. A serious bug can create problems for millions of devices downstream. Integrating into operating systems, chipsets and industrial equipment takes time, testing and certification. Cuozzo told Wired that the company waited until it believed the technology was sufficiently mature before pushing aggressively into the market.

From a venture-capital perspective, that is a deeply unfashionable strategy. European startups have often been encouraged to prove revenue quickly, keep burn manageable and demonstrate repeatable commercial traction. Deep tech frequently behaves differently. You may spend years building something before commercial scale appears at all. That helps explain Exein’s strange funding curve.

It raised €2 million in 2018, followed by a €6 million Series A in 2021 and €15 million Series B in 2024. Then the acceleration became extraordinary. It raised a €70 million Series C in July 2025, followed by another €100 million later that year. Nine months into 2026 came the $270 million round at a $1.7 billion valuation.

The interesting lesson for founders is not simply “raise lots of money.” It is the sequencing. Exein spent years building technical leverage before suddenly applying financial leverage. Once integrations, partnerships and demand began to validate the product, capital arrived at dramatically greater scale.

80 million. One billion. Two billion.

Nothing illustrates that inflection better than device distribution. In July 2024, Exein said its technology protected more than 80 million IoT devices daily. By July 2025, investors backing the company said that number had passed one billion. By September 2026, Exein said it had passed two billion. Those figures should be treated as company-reported deployment numbers rather than an independently audited census of active devices, but the direction is extraordinary nonetheless.

And the pattern reveals something about the scalability of infrastructure companies. Exein did not suddenly hire enough salespeople to sell security individually to two billion device owners. Its partners became the distribution network. For business students, that might be the single most important strategic insight in the whole story. When evaluating a technology company, growth is not only about how good the product is.

Ask: Where does distribution come from? The best answer is often not “more salespeople.” It is finding somebody else’s platform that already reaches the customers you want.

Then AI changed the threat

Exein was founded to protect the Internet of Things. But the company increasingly avoids describing itself simply as an IoT cybersecurity business. Its new favourite category is Physical AI. The term refers broadly to AI systems that do not merely analyse information on a screen but perceive, decide and act in the physical world: robots, autonomous cars, drones, industrial machines and other intelligent systems.

This transition fundamentally changes cybersecurity. Imagine compromising someone’s Spotify account. Annoying. Now imagine compromising the AI controlling a warehouse robot carrying hundreds of kilograms of equipment. Or interfering with a vehicle. Or an industrial control system. Or automated medical equipment. When intelligence leaves the screen, cybersecurity stops being purely about information. It becomes partly about physics.

Cuozzo puts the distinction starkly: when an intelligent physical system is compromised, the consequence may no longer be data loss. It can be physical harm. That is why Exein’s rebranding toward Physical AI may be more than fashionable AI language. It broadens the company’s addressable problem from “secure connected devices” to secure autonomous machines. And autonomous machines are appearing everywhere.

AI also made hacking faster

There is another reason the timing suddenly looks favourable. AI does not only improve machines. It improves attackers. In Exein’s network, the company says it is now observing around 5,000 new non-repetitive attacks every week, approximately five times the level it was seeing the year before.

Meanwhile, Europe’s cybersecurity agency ENISA reported more than 48,000 new CVEs (publicly identified security vulnerabilities) during 2025, a 22% increase from the previous year. ENISA also warns that malicious groups are increasingly using AI to enhance operations and that AI itself is expanding the potential attack surface. Cuozzo argues that this changes the fundamental economics of hacking.

Years ago, deeply understanding and exploiting the firmware of one obscure device could take an expert months. AI can automate parts of vulnerability research, code generation and attack iteration. The cost falls. The speed rises. And attacks can happen repeatedly across enormous fleets of identical machines. Cybersecurity therefore starts becoming a machine-speed problem. Human defenders cannot manually analyse every attack happening across two billion devices.

Exein’s answer is AI defending against AI.

Meet Photon: security that wants to act before the attack finishes

In 2026, Exein pushed that philosophy further with Photon, its new generation of runtime security. Traditional cybersecurity often follows a familiar sequence. Something suspicious happens. A system detects it. An alert appears. Software or a security team investigates. Then somebody responds. Photon is built around a different objective: operate so deeply inside the system that malicious behaviour can be prevented as it begins rather than merely reported afterwards.

The company describes this as preemptive runtime security. Photon sits near the kernel and attempts to remove the small window between an attacker beginning to execute malicious behaviour and conventional security tooling reacting. Exein argues that this latency matters particularly for autonomous and critical systems where an attack can complete in milliseconds. The technical distinction has an interesting business consequence.

Security software historically creates huge numbers of alerts. Alerts require teams. Teams cost money. And customers eventually suffer what the industry calls alert fatigue. A system that can autonomously prevent more behaviour on-device is not simply faster cybersecurity. It potentially changes the labour economics of cybersecurity. That matters enormously when the customer is managing hundreds of thousands of machines rather than several thousand employee laptops.

Analyzer attacks the problem before the machine even ships

Exein is also moving earlier in the product lifecycle. Its Analyzer product examines firmware during development, combining binary analysis and software-bill-of-materials information with reachability analysis to determine which vulnerabilities are actually exploitable. Think of this as the difference between receiving a list of everything that might theoretically be wrong with a device and understanding which problems an attacker could realistically reach.

Then Runtime protects the environment once the product is operating. Analyzer before deployment. Runtime during operation. Strategically, this is important because Exein can expand from being a point solution into a wider security platform spanning the lifecycle of the device. And platform expansion usually improves economics. One customer relationship can produce multiple products. Data collected in one layer can potentially improve another.

Switching becomes harder. And competitors offering only one piece of the system become easier to displace.

Regulation has quietly become Exein’s salesman

Then something incredibly convenient happened. Governments began forcing manufacturers to take connected-device cybersecurity more seriously. The European Union’s Cyber Resilience Act introduces security obligations for products containing digital elements. The first major reporting provisions began applying on 11 September 2026.

Manufacturers must now report actively exploited vulnerabilities and certain severe security incidents. Initial warnings can be required within 24 hours, followed by fuller notifications within 72 hours. Broader CRA requirements will continue coming into effect toward full application in December 2027. Think about what this does to a hardware company’s incentives. Previously, cybersecurity could be treated as a feature somebody might purchase.

Now it increasingly becomes part of compliance. Manufacturers must understand what is inside their products. They must monitor vulnerabilities. They need evidence of incidents. They need update processes. And they must respond quickly when something goes wrong. Regulation is converting cybersecurity from an optional product feature into a cost of doing business. For Exein, that is powerful.

The company can sell protection and compliance simultaneously. Its Analyzer maps vulnerabilities against CRA requirements, while Runtime generates monitoring and forensic information that can help manufacturers understand what is happening across fleets. The smartest cybersecurity companies do not necessarily have to convince customers that security is important anymore. The law is beginning to do it for them.

This is why timing matters so much

Exein’s rise looks sudden. The underlying market took years to form. Three trends are now colliding. First, there are tens of billions of connected devices. Second, those devices are becoming increasingly autonomous through AI. Third, governments are imposing much stronger security obligations on the companies manufacturing them. Then add a fourth. AI is making attacks cheaper and faster.

The result is a beautiful strategic position: Exein sells a product that is becoming more technically necessary, more commercially valuable and more legally difficult to ignore at the same time. That is one of the reasons its valuation has moved so quickly. The company said its valuation increased more than thirtyfold in roughly two years before reaching $1.7 billion in September.

Investors are not paying $1.7 billion for today’s revenue. They are betting that embedded cybersecurity becomes a default layer of the next computing platform.

The next bet is a foundation model for machines

The newest funding round will not only finance sales expansion. Exein is developing a proprietary foundation model specifically for Physical AI cybersecurity. The ambition is to train a system around the behaviour, vulnerabilities and attack patterns of physical machines rather than simply repurposing a general-purpose language model. Italian newspaper la Repubblica reported that the company plans to invest around €100 million in developing the model.

This could become strategically significant because Exein sits on something that most AI startups do not possess: runtime security information from a vast device network. The interesting asset may therefore not only be Exein’s security software. It may be the data produced by operating it. Every new machine can generate new behavioural information. Every attack can create new threat intelligence.

New threat intelligence can improve the defensive system. A better defensive system can help Exein win more manufacturers. More manufacturers add more machines. More machines produce more data. And the flywheel begins again. That is potentially the transition from software product to data moat.

Two billion devices are not just customers. They are sensors.

This is where Exein becomes much more interesting strategically. Suppose an attacker develops a new technique against a certain class of connected device. A conventional security vendor learns about it. Researchers analyse it. The vendor produces a defence. Customers update their systems. That process can take time. Exein’s long-term vision is more biological. One machine encounters a threat.

The wider security system learns from it. Other machines become better prepared. That is why Exein repeatedly describes what it is building as a “digital immune system.” The metaphor is not accidental. A biological immune system learns from exposure. A distributed cybersecurity system could theoretically do something similar. At sufficient scale, Exein’s biggest competitive advantage may not be the code sitting inside one device. It may be what every device teaches the rest of the network.

That is difficult for a new competitor to reproduce overnight. You can copy features. It is much harder to copy history.

The competitive battlefield is crowded, but Exein is choosing a different layer

Cybersecurity is not an empty market. Companies such as Armis, Claroty, Nozomi Networks, Forescout, Cybellum, Finite State, Sternum and others operate across IoT, operational technology, connected-device security and firmware analysis. Many established OT-security platforms specialise heavily in discovering devices and analysing what happens across the network. Exein’s bet is different. It wants to sit inside the device.

That distinction is important. Network monitoring can see that a machine is communicating unusually. Runtime security can potentially see which process inside the machine is attempting the action and stop it at the source. Neither architecture automatically makes the other obsolete. Large industrial customers may ultimately use several layers simultaneously. But strategically, device-level integration has one compelling advantage.

Once Exein is embedded during manufacturing, competitors have to displace something already living inside the product rather than simply sell another dashboard to the customer’s IT department. That could make distribution the moat before technological superiority even enters the discussion.

Physical AI could make that moat enormous

Now imagine this strategy applied not to today’s connected cameras and industrial computers but to tomorrow’s robots. A humanoid robot contains cameras, microphones, motors, processors, machine-learning models, communications systems and an operating environment. Every one of those components can create vulnerabilities. More importantly, the robot can act. It can move. Pick something up. Open a door.

Operate equipment. Interact with people. Autonomous vehicles create the same issue. So do drones. So do increasingly autonomous factories. The cybersecurity industry traditionally protected information technology. Physical AI security protects agency. That is a much larger philosophical shift. And it explains why Exein is repositioning itself now. The term “IoT security” sounds like smart thermostats.

“Physical AI security” places the company alongside robotics, autonomy and intelligent infrastructure, categories investors expect to become enormous over the coming decade. The product may be evolving. The positioning definitely is.

The Haas F1 partnership is marketing, but clever marketing

In July 2026, Exein became the Official Physical AI Security Partner of TGR Haas F1 Team under a multi-year agreement. Its branding appears on the rear-wing actuator of the team’s VF-26 car. On one level, this is simply sponsorship. But it is unusually well matched sponsorship. Formula One cars are effectively high-speed networks of sensors, control systems, software and physical machinery. Their performance depends on data, reliability and engineering precision.

That allows Exein to position cybersecurity not as something gloomy that happens after hackers appear but as part of high-performance engineering itself. The brand message becomes: security should work the way an F1 component works: deeply integrated, lightweight and invisible until you need it. For a company moving from niche B2B cybersecurity toward a globally recognised technology brand, that is much more interesting than putting a logo on a random football shirt.

There is also an Italian story here

Europe produces remarkable technical research. It has historically been less successful at turning deep technology into enormous globally dominant technology companies. Italy’s record is even thinner. That is why Exein matters beyond cybersecurity.

It has deliberately kept Rome at the centre of the company while building offices and commercial operations abroad. Cuozzo has said that proving a globally significant technology company could be built from Italy was personally important to him. His reasoning is almost emotional. As the child of Italians who emigrated abroad for work, he told Wired that Italy became idealised in his mind and that building the company there felt like “the challenge” to his destiny.

And the funding structure now carries a wider European symbolism. The September investment included the European Investment Bank Group’s first direct co-investment through the European Tech Champions Initiative, a programme specifically designed to address Europe’s difficulty financing technology companies as they grow into later-stage global businesses. Europe is effectively confronting one of its oldest startup problems through Exein.

It can create promising startups. But can it finance them long enough to become global champions rather than watching them move to America or get acquired? Exein is becoming a test of whether European deep tech can scale without ceasing to be European.

But $1.7 billion creates expectations

The valuation also introduces risk. Exein reportedly remains at revenue in the tens of millions while investors are valuing it at $1.7 billion. That gap is not necessarily irrational for a rapidly growing infrastructure startup. But it means the future is already being priced in. Exein now needs to convert enormous distribution claims into enormous recurring commercial revenue.

It needs to prove that manufacturers will pay meaningful amounts for embedded security. It needs to keep technical performance extremely lightweight as it expands across heterogeneous operating systems and hardware. It must protect potentially safety-critical devices without becoming the vulnerability itself. It must compete with much larger cybersecurity companies. It must expand through the U.S. and Asia while protecting the engineering culture that got it here.

And if Physical AI develops more slowly than investors expect, part of the narrative behind today’s valuation could weaken. The hardest transition may therefore not be reaching two billion devices. It may be monetising two billion devices without destroying the distribution model that got Exein there. Scale and revenue are not the same thing. The next phase of Exein will be about proving it can turn one into the other.

Security software itself can become a systemic risk

There is another uncomfortable paradox. The deeper Exein integrates into machines, the more valuable it becomes. But also the more important its own security becomes. If one security platform is embedded across enormous numbers of industrial devices, a vulnerability in that platform could theoretically create an unusually attractive target. Cybersecurity has seen this problem before.

The tools designed to manage and protect thousands of systems often possess privileged access to those systems. Attackers therefore have enormous incentives to compromise the security vendor itself. The thing protecting two billion machines becomes one of the most interesting things to attack. For Exein, security therefore has to operate on two levels. Protect the customer.

And protect the mechanism doing the protecting. The stronger its network effect becomes, the more seriously this second responsibility matters.

The business model may be the real breakthrough

Strip away the AI terminology and technical jargon and Exein has constructed a beautifully simple strategic position. It enters the technology supply chain before the end customer. It integrates deeply enough that replacement becomes inconvenient. Its product operates continuously rather than being used occasionally. More devices potentially produce more threat intelligence. Regulation increases demand. AI increases the attack rate.

Physical AI increases the consequences of attacks. And semiconductor and OEM partnerships allow one commercial relationship to generate enormous distribution. This is not just cybersecurity SaaS. It resembles infrastructure. And infrastructure companies can become very powerful because their products disappear. Nobody thinks about the security architecture inside an industrial computer when everything works. That is precisely the goal.

The best cybersecurity product is one you never notice

There is something slightly ironic about Exein’s ambition. Most startups want customers to notice their product. Exein succeeds when nobody notices anything at all. The factory keeps running. The robot behaves normally. The train continues moving. The hospital equipment works. The data centre stays cool. The camera remains a camera. Nothing dramatic happens. In cybersecurity, boring is the product.

And Exein is trying to make that boring reliability native to the machine itself. That is a much harder technical problem than building another security dashboard. But it is also potentially a much larger business.

From €208 to $1.7 billion

The arc of Cuozzo’s story almost sounds manufactured for a startup documentary. A teenager works restaurant jobs to buy a computer. Learns programming through internet cafés. Enters Europe’s hacker scene. Reverse-engineers machines. Works around NATO cybersecurity. Starts a penetration-testing business with €208. Creates fake employee email addresses because the team is too small. Spins out an idea for protecting firmware.

Builds for years before focusing seriously on revenue. Raises €2 million. Then €6 million. Then €15 million. Then €70 million. Then another €100 million. Then $270 million at a $1.7 billion valuation. But the more interesting transformation is happening to the world around Exein. When the company started, “IoT security” was a relatively niche corner of cybersecurity.

Now AI is moving into cars, robots, factories and infrastructure. Cyberattacks are becoming faster. The European Union has begun forcing manufacturers to take responsibility for security throughout a product’s lifecycle. And machines that once merely collected data are beginning to make decisions themselves. The computer has escaped the screen. Security has to follow it. That is Exein’s bet.

Not that every company will buy another cybersecurity product. But that eventually, every intelligent machine will need its own immune system.

And if Exein can become the company building that immune system before the rest of the world fully realises it needs one, the $1.7 billion valuation may eventually look less like the end of an extraordinary startup story and more like the beginning of one.

Research updated 6 October 2026.