Empirical Security raises $25M to expand predictive exposure management

Empirical Security raised $25 million in Series A funding led by Brightmind Partners to scale its AI-driven exposure management tools. The Chicago cybersecurity startup says its models help organizations predict which vulnerabilities are most likely to be exploited as attacks grow more complex.

Why it matters: - AI is expanding the speed and scale of cyber threats, making it harder for security teams to sort real risk from noise. - Empirical Security is pitching predictive models that help organizations prioritize the exploits most likely to matter in their own environments. - The company says lean security teams can use the software to make faster remediation decisions without adding headcount.

What happened: - Empirical Security announced a $25 million Series A round led by Brightmind Partners. - The round brings the company’s total funding to $37 million, including earlier backing from Costanoa Ventures, Hyde Park Angels and others. - The company is based in Chicago. - Empirical Security said the new capital will speed development and deployment of Foundation and Radiant.

The details: - Foundation is a global model that monitors more than 18,000 exploited CVEs to help organizations predict threats. - Radiant is a custom predictive engine that is fine-tuned for each organization to identify the threats most relevant to its environment. - The company says its models replace legacy exposure management tools that rely on generic risk models and unvalidated assumptions. - Empirical Security works with enterprises in technology, healthcare and financial services. - Co-founder and CEO Ed Bellis previously co-founded Kenna Security and served as CTO through its acquisition by Cisco. - Co-founder and CTO Michael Roytman was previously chief data scientist at Kenna Security. - Co-founder and chief data scientist Jay Jacobs co-created the Exploit Prediction Scoring System, or EPSS. - EPSS is trained and maintained by Empirical Security, published daily and free to use. - Hundreds of companies and vendors, including Tenable, Qualys, CrowdStrike, Microsoft and Wiz, have embedded EPSS into their systems. - Verizon’s 2026 Data Breach Investigations Report cited analysis from Empirical Security. - The report found that vulnerability exploitation became the leading initial access vector for data breaches, surpassing stolen credentials for the first time. - The report also said exploited software vulnerabilities accounted for 31% of confirmed breaches, up from 20% the year before. - Empirical Security says its models help threat and vulnerability teams measure and manage cyber risk with transparent, data-driven insights. - The company says its customer-specific models are enhanced by AI and tailored to each organization’s environment. - Empirical Security says the approach supports evidence-based risk analysis and helps teams justify remediation decisions to stakeholders. - The company’s website is More information.

Between the lines: - The funding fits a broader market shift toward exposure management tools that claim to use real-world exploit data instead of static scoring. - Empirical Security is trying to differentiate by building custom models for each customer rather than applying the same threat data across all clients. - The company’s pitch centers on a simple promise: better prediction can reduce wasted effort in crowded security operations.

What’s next: - Empirical Security plans to use the new funding to accelerate product development and market deployment. - Brightmind Partners said it wants to back founders taking a “generationally new approach” to an old problem. - The company is positioning itself for customers facing what Brightmind called the biggest crisis in exposure management history.