Empirical raises $25M for predictive cybersecurity
Empirical Security is trying to forecast which vulnerabilities attackers are most likely to exploit in a specific organisation.
Security teams often know about thousands of vulnerabilities but cannot fix all of them at once. Empirical Security is betting that prediction can replace broad, generic prioritisation.
What happened
Empirical Security raised a $25M Series A led by Brightmind Partners, with Costanoa Ventures and Hyde Park Angels participating. The round brings total funding to $37M.
The company's products include a model trained on information about more than 18,000 exploited vulnerabilities. It combines that broader evidence with information about an individual organisation's environment to estimate which weaknesses are most likely to become relevant threats.
The goal is to help security teams focus limited engineering time on exposures with the highest practical risk.
Why it matters
Traditional vulnerability scores often describe technical severity without accounting for whether attackers are actively using a flaw, whether the affected system is exposed or how valuable that system is to a specific organisation.
Predictive prioritisation could reduce wasted remediation work and shorten the time required to address the vulnerabilities that matter most.
The bigger picture
Cybersecurity is moving from static lists toward probabilistic decision systems. The same shift is happening in fraud, threat intelligence and security operations as teams try to allocate attention under uncertainty.
Empirical's credibility will depend on measurable forecasting accuracy. A sophisticated model is only useful if it consistently outperforms simpler rules and helps customers avoid incidents without ignoring rare but severe risks.