Empirical Security is a cybersecurity company developing custom security models specific to each enterprise, designed to give security teams predictive capabilities that help them identify and prioritize vulnerabilities based on their likelihood of exploitation. Its platform combines global threat intelligence with infrastructure, assets, and telemetry unique to each organization to help security teams understand where attackers are likely to target. The company’s flagship products, Foundation and Radiant, are designed to move cybersecurity teams beyond traditional vulnerability scoring toward predictive risk modeling. Empirical Security was co-founded by Ed Bellis, Michael Roytman, and Jay Jacobs, who bring experience in vulnerability management, data science, and exploit prediction. Pulse 2.0 interviewed Empirical Security Co-Founder and CEO Ed Bellis to learn more about the company’s origins, predictive security technology, recent funding, enterprise adoption, and its vision for transforming exposure management.
Ed Bellis’ Background
When asked about his background, Bellis shared:
I was the CISO at Orbitz when I first recognized the challenge teams have understanding the noise that comes from scanners and the difficulty of identifying which vulnerabilities represent real threats and why. A static, rigid scoring system like CVSS is definitely not the answer.
I co-founded Kenna Security, where we helped popularize risk-based vulnerability management, the idea that you stop treating every vulnerability the same way and focus on the ones actually likely to be exploited.
I stayed on through Kenna’s acquisition by Cisco and ran the data science team for the threat detection and response product portfolio.
But I quickly recognized that the rules of the game had changed: the prioritization problem we’d worked on for a decade was getting harder, not easier, as attack surfaces exploded. That’s what led to Empirical.
How The Idea For Empirical Security Came Together
When asked how the idea for Empirical Security originated, Bellis explained:
Our customers at Kenna used to ask us: “Great, you’re showing the threats affecting everyone, but I really want to know if the threats potentially affecting ME using my company’s own unique characteristics, controls, and adversaries.”
But back then, the technology didn’t exist to do that. With advances in MLOps as well as the ability to leverage data lakes and AI models, this is now actually possible. And with the acceleration of vulnerabilities due to AI, it’s absolutely necessary to change the way exposure management is being done.
So my old friends, Michael Roytman, who was Chief Data Scientist at Kenna, and Jay Jacobs, who co-created EPSS, decided to start a new company.
The three of us had lived this problem from different angles, and we thought we could finally build the predictive layer that wasn’t possible a decade ago.
Favorite Memory Working At Empirical Security
When asked about his favorite memory working at the company, Bellis shared:
Bringing together many of my friends and co-workers from the Kenna days while expanding our team with other viewpoints we didn’t have at Kenna.
It was a special culture and a special team, but I believe our team and culture at Empirical has helped us take a more modern approach. We really are building a great team here.
Core Products And Features
When asked about Empirical Security’s core products and features, Bellis explained:
We have two flagship products. Foundation is our global model. It monitors more than 18,000 exploited CVEs, tracking what attackers are actually using across the internet in real time.
Radiant is the local model. It trains on a single organization’s own assets, telemetry, cloud environments, threat intel, and controls to predict which threats are most relevant to that specific environment.
Think of it like this: Foundation tells you what’s happening globally, while Radiant tells you what’s likely to matter to you specifically.
Challenges In The Cybersecurity Sector
When asked about recent challenges in the cybersecurity sector and how Empirical Security has addressed them, Bellis explained:
The biggest shifts are scale and speed. Security teams are under mounting pressure to predict and prioritize the exploits that matter most, as AI rapidly expands both the scale and complexity of cyber threats.
The old process, scan your environment, get a list, triage manually using CVSS or another static risk score, just doesn’t hold up when the volume of potential exploits is growing so fast.
It’s no longer a human-scale problem. Our answer has been to lean fully into predictive modeling rather than static scoring, which is really the whole thesis behind Foundation and Radiant.
How Empirical Security’s Technology Has Evolved
When asked how the company’s technology has evolved since launching, Bellis explained:
We began with the Foundation model, which is similar to the risk-based vulnerability approach that Kenna pioneered, although using a much wider range of threat intelligence and data points than Kenna ever did (or, to be honest, the current crop of vendors involved with traditional VM).
But now we’ve fully made GA our Radiant model, which is completely differentiated in its ability to create a custom predictive engine for an individual company.
Significant Company Milestones
When asked about Empirical Security’s most significant milestones, Bellis highlighted its financing and early enterprise customer adoption:
We raised a $12 million seed round in July 2025, then closed a $25 million Series A, bringing our total funding to $37 million.
But I’m most proud of having closed a Fortune 500 company in seed stage and many more in our pipeline now that Radiant is ready for them.
Customer Success Stories
When asked about specific customer success stories, Bellis described how security teams are incorporating Empirical Security’s predictive technology into their daily operations:
I can’t name names due to confidentiality reasons, but one of our customers told me that his security engineers were “addicted to looking at Empirical every day.”
Like many security teams, they have tons of tech and tools, but the predictive look at threats every day has become their north star. And then be able to measure and report on the impact they’re making.
Funding And Revenue Metrics
When asked about Empirical Security’s funding and revenue metrics, Bellis shared:
On funding: we’ve raised $25 million in this Series A, led by Brightmind Partners, with participation from Costanoa Ventures, Hyde Park Angels, and other investors, bringing our total raised to $37 million.
On revenue, that’s not something I can share publicly at this stage.
Total Addressable Market
When asked about the total addressable market Empirical Security is pursuing, Bellis explained:
The broader exposure management category is at roughly $4-5 billion today, likely growing over the next decade.
We see exposure management as the first of many use cases at Empirical.
What Differentiates Empirical Security From Its Competition
When asked what distinguishes Empirical Security from other vulnerability and exposure management providers, Bellis explained:
Most vendors in this space are still scoring vulnerabilities against static, generic risk models (if you want to call them that). We built Empirical around prediction, not just prioritization.
Our other two co-founders, Jay Jacobs and Michael Roytman, co-created EPSS, so exploit prediction is table stakes for us rather than being a bolt-on.
And of course the Radiant local model is fine-tuned for each organization to identify the threats most relevant to its unique environment, rather than forcing every customer into the same generic model.
Future Company Goals
When asked about Empirical Security’s future goals, Bellis outlined plans to expand the company’s commercial operations and predictive security capabilities:
The immediate goal is putting this new capital to work by expanding the go-to-market team, as well as accelerating development of our products.
Longer term, I want Empirical to do for predictive exposure management what Kenna did for risk-based vulnerability management, define the category.
From there, we believe there are many security use cases to be unlocked with the power of custom-trained models.
The Future Of Predictive Exposure Management
When asked whether there were any additional topics he wanted to discuss, Bellis emphasized the need for security teams to adopt new approaches to vulnerability management:
I’m proud of what we accomplished at Kenna Security. But coming back and building Empirical Security feels like taking care of unfinished business.
The threats have changed and the challenges have changed, and security teams need a new approach, a predictive one, to succeed in a world where Patch Tuesday set records while KEV lags behind.
If your readers are interested in helping, we’re definitely hiring.
