Empirical Security: Funding Rounds, Investors & CEO

About Empirical Security

Empirical Security sells models that predict which software vulnerabilities attackers are likely to exploit. Its buyers are enterprise security teams with more flaws than they can fix. Foundation, its global model, tracks exploitation activity on more than 19,000 known vulnerabilities (CVEs). Radiant, its custom model, trains on a customer's own assets, configurations and telemetry to rank the risks in that environment.

The company is based in Chicago. CEO Ed Bellis and CTO Michael Roytman built Kenna Security, which Cisco bought in 2021. Chief data scientist Jay Jacobs leads the data science behind EPSS, a free exploit prediction score that Empirical Security maintains. Empirical Security works mostly with technology, healthcare and financial services firms. It has raised $37 million, including a $25 million Series A led by Brightmind Partners in July 2026.

Funding Rounds (SEC Form D)

First sale	Filed with SEC	Amount sold	Investors	Avg. check	Terms	Filing
Jul 17, 2026	Aug 3, 2026	$20,818,947of $24.9M target	4	$5.2M	EquityRule 506(b)	Form D ↗
Aug 23, 2024	Jul 17, 2025	$11,935,326of $12.4M target	17	$702K	EquityRule 506(b)	Form D ↗
Total, two offerings		$32,754,273

First sale is the date the first investor in the offering committed to invest. Companies must file Form D within 15 days of that date, so filing dates run later.

Rounds announced by Empirical Security

What the company said publicly about its funding. Announced amounts can differ from Form D figures: an announcement can combine several closings, and some money is raised without a Form D.

Announced	Round	Amount	Investors	Source
Jul 20, 2026	Series A	$25M	Brightmind Partners (lead), Costanoa Ventures, Hyde Park Angels	empiricalsecurity.com ↗ Press release ↗ Brightmind Partners ↗ HPA ↗
Jul 17, 2025	Seed	$12M	Costanoa Ventures (lead), DNX Ventures, Sixty Degree Capital, HPA, Jonathan Cran, Wade Baker, Gerhard Eschelbeck	empiricalsecurity.com ↗ Press release ↗ Costanoa Ventures ↗

Why Investors Backed Empirical Security

Investors backed Empirical Security mainly because of who runs it. Ed Bellis and Michael Roytman built Kenna Security, which helped create risk-based vulnerability management and sold to Cisco in 2021. Co-founder Jay Jacobs leads the data science behind EPSS, a free exploit prediction score that over 120 security vendors use. The team now sells paid models that predict which flaws attackers will exploit, including one trained on each customer's own data.

The problem it targets

Security teams find far more flaws than they can fix. Severity scores such as CVSS show how bad a flaw could be, but not whether anyone will exploit it. The pile keeps growing, too. In October 2026, Microsoft disclosed 1,408 CVEs in one Patch Tuesday, more than in all of 2025. Exploited flaws were also the way in for 31% of confirmed breaches in Verizon's 2026 Data Breach Investigations Report, up from 20% a year earlier.

What the product does

Empirical Security sells two models. Foundation, the global one, tracks exploitation on more than 19,000 CVEs and estimates each CVE's chance of exploitation over the next 30 days. Radiant, the custom one, trains on one customer's scan results, assets, controls and patching speed, and only that customer can use it. Teams can use them through an API, AI agents or ServiceNow. The company also maintains EPSS, a free score published daily. Version 5 came out in May 2026 and covers all 318,000-plus published CVEs.

Progress so far

Empirical Security has not named customers or shared revenue. EPSS gives it wide reach: Microsoft, Amazon, Google, CrowdStrike, Tenable and Qualys build EPSS into their tools. The top 7% of Foundation scores caught 90% of flaws exploited within 30 days, from January to May 2026. In June 2026, World Wide Technology named Empirical Security one of four partners in a new joint security program. Brightmind adds that "every customer they said they would close, they closed."

Who backs it

Costanoa Ventures led the $12 million seed round in July 2025. "We backed Ed, Michael, and Jay at Kenna," Costanoa partner John Cowgill said at the time. DNX Ventures, Sixty Degree Capital and Hyde Park Angels (HPA) also invested. Brightmind Partners led the $25 million Series A in July 2026, and Costanoa and HPA invested again. Brightmind managing partner Stephen Ward was chief information security officer at The Home Depot and TIAA. Cowgill and Ward are directors, along with Bellis and Roytman.

How the market is moving

Two shifts help Empirical Security. First, Cisco said on December 10, 2025, that it would retire Cisco Vulnerability Management, formerly Kenna. Support ends on June 30, 2028, so Kenna customers need a new tool. Second, AI is speeding up the discovery of flaws. In April 2026, Anthropic advised security teams to patch CISA's list of known exploited flaws first. After that, it said, teams should fix everything above a chosen EPSS score, CSO Online reported. Meanwhile, Tenable bought exposure management startup Vulcan Cyber in February 2025, a deal BankInfoSecurity valued at $150 million.

We wrote this summary from public statements by Empirical Security and its investors. It is not investment advice.