Exein takes $270M at $1.7B two quarters before its first foundation model ships

A valuation of roughly $800 million in December became $1.7 billion in September ^[8], about 2.1 times in nine months ^[1]. Stretch the window and the company's own figure is a thirtyfold climb over two years ^[6], which puts it near $57 million in late 2024 ^[2]. The revenue disclosure alongside it is a ratio: first-half 2026 annual recurring revenue four times the year-earlier level ^[7]. Exein did not publish an absolute ARR.

Assume ARR also quadrupled in the twelve months before that. Revenue would then be up 16 times over the two years against a 30-fold valuation, leaving roughly 1.9 times of the price step as multiple expansion ^[6]. Exein did not disclose that; the 16 times is my assumption.

The equity arrived with debt. Exein said the round runs alongside an upsizing of its existing revolving credit facility led by J.P. Morgan, with KfW joining as an additional lender ^[5]. The three raises before this one were a EUR 15 million Series B in July 2024, EUR 70 million in July 2025 and EUR 100 million in December 2025, or EUR 185 million together ^[9][5]; techfundingnews.com wrote that the new $270 million dwarfs all of that combined ^[24].

Exein says it now sees around 5,000 new, non-repetitive attacks a week across its network, five times the level of a year ago, which places last year near 1,000 a week ^[14][3]. Founder and chief executive Gianni Cuozzo said: "Frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defence has to as well." ^[18] The foundation model behind that argument is trained on machine telemetry from Exein's own installed base rather than human-generated text ^[12], with the architecture due by the end of 2026 and the first models in the first quarter of 2027 ^[13]. techfundingnews.com called that an aggressive timeline for a category that barely exists yet outside Exein's own data ^[23].

The nearest priced comparable is Armis, which ServiceNow is acquiring for $7.75 billion in a deal expected to close in the second half of 2026 ^[20]. Exein at $1.7 billion is about 22 per cent of that ^[4]. Armis, Claroty and Nozomi Networks watch industrial networks from the outside for anomalies; Exein has been putting its code on the device since 2018, and Photon works at the kernel level to block malicious execution before it runs ^[20][21][11]. Clarey Zhu, the Headline partner who led the round, said: "As AI moves into robots, vehicles, and critical infrastructure, securing the physical world will become one of the defining cybersecurity challenges of the next decade." ^[19]

If ServiceNow folds Armis into platform procurement after the close, device security gets bought as a line item inside a suite and the standalone premium compresses ^[20]. If the end-2026 architecture or the Q1 2027 models slip, the $1.7 billion is priced on a roadmap ^[13]. In my view the defensible asset here is the embedded position across more than two billion devices ^[10], and the model built on top of it is what investors have paid for in advance.