Empirical Security Raises $25M Series A for Next Generation Vulnerability Management
HPA is excited to announce its follow-on investment in Empirical Security‘s $25 million Series led by Brightmind Partners with participation from previous investors HPA, Costanoa Ventures and others. The round brings Empirical’s total funding to $37 million. HPA first backed Empirical in its $12 million Seed round in July 2025, and we’re proud to continue supporting the team as they reach this milestone.
As AI expands the scale and complexity of cyber threats, security teams face mounting pressure to predict and prioritize the exploits that matter most. Empirical builds foundational and predictive models for exposure management that help lean security teams distinguish genuine risk from background noise — rather than relying on static, generic risk scores. The new capital will accelerate the development and deployment of the company’s two flagship products: Foundation, a global model that monitors more than 18,000 exploited CVEs to help organizations predict threats, and Radiant, a custom predictive engine built and fine-tuned for each organization to identify the threats most relevant to its unique environment.
Empirical is led by a trio of executives who collectively invented the concept of risk-based vulnerability management. Co-founder and CEO Ed Bellis previously co-founded Kenna Security and served as its CTO through the company’s acquisition by Cisco. He is joined by co-founder and CTO Michael Roytman, formerly Chief Data Scientist at Kenna Security, and co-founder and Chief Data Scientist Jay Jacobs, co-creator of the Exploit Prediction Scoring System (EPSS). Empirical trains and maintains EPSS, whose scores are published daily and free for anyone to use, and which vendors such as Tenable, Qualys, CrowdStrike, Microsoft, and Wiz have embedded across their systems.
“I had unfinished business from my time building and selling Kenna Security,” said Ed Bellis, co-founder and CEO of Empirical Security. “We helped pioneer the category of risk-based vulnerability management, but it became clear that defending against AI-driven threats and the growing volume of potential exploits would require a fundamentally new approach. Today, we finally have the technology to give security teams predictive capabilities that weren’t possible before, and we came together to build that future.”
The need for that approach has never been greater. According to Verizon’s 2026 Data Breach Investigations Report (DBIR) — which incorporated analysis from Empirical Security — vulnerability exploitation became the leading initial access vector for data breaches, surpassing stolen credentials for the first time, and accounted for 31% of confirmed breaches, up from 20% the previous year.
HPA congratulates the Empirical team on reaching this milestone and looks forward to fueling the company’s next stage of growth through its People First model, combining hands-on operator experience with financial capital to help strong founders build companies that endure. HPA Deal Lead Alex Brown will continue contributing his expertise, leveraging his background in the cloud services ecosystem.
Alex Brown was the Founder & CEO of 10th Magnitude, which was acquired by Cognizant in 2020. 10th Magnitude (now Cognizant Microsoft Business Group) provides businesses with transformative technology services using the power of the Microsoft Azure cloud. Alex also serves on the boards of Courser, a managed service provider, and Protera, an SAP service partner.
HPA Partner Stephen Ross and HPA Senior Associate Michelle Rogoff will continue to support the Empirical team.
Read more about it here: Press Release