Wyckhouse is trying to give manufacturers a clearer view of the software risks inside the devices they ship.
Matt Wyckhouse is founder and CEO of Finite State, a product-security company focused on connected devices and their software supply chains. His background in embedded-system security and cyber operations shaped the company’s emphasis on analyzing the software delivered inside a device.
Embedded-System Security at Battelle
He earned a bachelor’s degree in computer science and engineering from Ohio State University. His Cipher Brief biography describes extensive work at Battelle, where he was the technical founder of its Cyber Innovations Business Unit and served as chief technology officer for five years.
The role involved intelligence and security programs, internal research, business development, and hardware and software products. His work included programs focused on embedded-system security, the field that would become central to Finite State.
Founding Finite State in 2017
Wyckhouse founded Finite State after seeing how vulnerable connected devices and embedded systems could be. In a company essay about its development, he described building firmware analysis around different chipset architectures, operating systems, and file formats so manufacturers could examine third-party software within their products.
The same essay explains the goal beyond finding a problem: making vulnerability information useful enough for product-security teams to address issues before releasing a device or an update. Sharing that information with customers is another part of his approach to making software supply chains more transparent.
Extending the Work to Medical Devices
Finite State’s current platform combines binary analysis with inventories, vulnerability prioritization, and evidence workflows. Its medical-device offer connects those capabilities with the continuing work of tracking builds, assessing new vulnerabilities, and preparing regulatory evidence.
Wyckhouse’s founding perspective remains relevant to that work: a manufacturer needs to understand what its suppliers have placed inside the shipped product. A source-code inventory alone may not describe every third-party component present in the device’s firmware.