Empirical Security raises $25M to tailor exploit predictions to each customer

Why it matters

Empirical Security is trying to become the prioritization layer above security scanners, using each customer's infrastructure and telemetry to decide which vulnerabilities require immediate work.

Ed Bellis, Michael Roytman and Jay Jacobs have raised a $25 million Series A for Empirical Security, their Chicago-based attempt to predict which software vulnerabilities attackers will exploit inside each customer's environment. Brightmind Partners led the round, according to an announcement published July 20th.

The financing brings Empirical Security's disclosed funding to $37 million. Empirical Security previously raised a $12 million seed round led by Costanoa Ventures, with DNX Ventures, Sixty Degree Capital, Hyde Park Angels and several security executives participating. Empirical Security did not disclose a valuation for the Series A.

The founders are returning to a problem they helped define. Bellis co-founded Kenna Security and served as its chief technology officer before Cisco completed its acquisition of Kenna on June 30th, 2021. Roytman was Kenna's chief data scientist and later a distinguished engineer at Cisco. Jacobs leads the Exploit Prediction Scoring System, or EPSS, which estimates the probability that a vulnerability will be exploited in the wild during the next 30 days.

EPSS scores are published daily and have been integrated into products from vendors including Microsoft, Qualys, Tenable and Wiz, according to FIRST's registry of EPSS users. Bellis said he had "unfinished business from my time building and selling Kenna Security." Empirical Security is his second attempt to turn vulnerability data into a manageable remediation queue.

From global scores to local predictions

Empirical Security sells two related models. Foundation combines internet exploitation telemetry with EPSS and covers more than 180,000 common vulnerabilities and exposures, including more than 18,000 that Empirical Security classifies as confirmed exploited. Empirical Security says its database updates hourly.

Radiant adds customer-specific information, including scanned assets, endpoints, cloud configurations, ticketing systems, attack alerts and past incidents. The model is continuously retrained as an organization's environment changes, according to Empirical Security.

The distinction addresses a limitation in global vulnerability scores. The same software flaw can present different risks on an isolated internal system and an unpatched, internet-facing server processing payments. Radiant is designed to account for those differences when deciding what a security team should repair first.

That design positions Empirical Security as a decision layer above vulnerability scanners, cloud-security platforms and asset inventories. Those systems identify weaknesses and infrastructure. Empirical Security wants to determine which findings deserve immediate remediation inside a particular network.

The timing reflects a widening gap between vulnerability volume and remediation capacity. Verizon's 2026 Data Breach Investigations Report found that exploitation of software vulnerabilities had become the most common initial-access route in its dataset, accounting for 31% of breaches, up from 20% in the previous report. The report used 2025 data and analyzed more than 22,000 confirmed breaches.

Verizon also found that organizations fully remediated 26% of critical vulnerabilities in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog during 2025. Median resolution time increased to 43 days from 32 days. Empirical Security contributed analysis to the report, according to Empirical Security's announcement.

The proof gap

Empirical Security has published internal benchmarks for Foundation covering January 1st through May 31st, 2026. Empirical Security says nine out of every 10 vulnerabilities in the model's top 2% showed exploitation activity after scoring, while that group covered 75% of observed exploited vulnerabilities. Those results were published by Empirical Security and do not establish Radiant's performance across customer environments.

Public materials provide no independent evaluation of Radiant's false-negative rate, calibration across industries or performance against simpler prioritization methods. Empirical Security also has not disclosed revenue, customer count, contract values, retention or named customers.

Radiant's product page says customer models receive full data isolation and remain accessible only to the customer. Empirical Security provides little public detail on data residency, whether customer telemetry can be reused for broader model training, or how customers can audit the factors behind a prediction. Those controls will matter if Empirical Security is to ingest the asset, configuration and incident data required to make its local models useful.

The Series A gives Bellis, Roytman and Jacobs capital to deploy their model inside more customer environments and collect the outcomes needed to test their thesis. Their previous work helped move vulnerability management away from patching every severe flaw. Empirical Security is betting that the next useful score will be specific to the organization reading it.