The modern enterprise has become very good at guarding the lobby. Identity systems check badges. Endpoint agents watch processes. Cloud tools inspect workloads. Meanwhile, down in the basement, thousands of tiny computers quietly run the building: BIOS and UEFI code, network cards, storage controllers, baseboard management controllers, VPN appliances, GPU firmware. Each arrives through a supply chain crowded with manufacturers, subcontractors, signing keys, update servers, and old code. Eclypsium built its company around a blunt question: who is checking any of that?
The Portland company calls its category infrastructure assurance. In practical terms, its software discovers the components inside endpoints, servers, network appliances, and AI hardware; extracts and analyzes their low-level code; compares what it finds with known-good reference material; flags vulnerabilities, counterfeits, unexpected changes, and suspected implants; then helps security teams harden or update the device. It is an X-ray for machines that most corporate inventories record as one neat rectangle.
That narrow-sounding specialty has turned into a broad enterprise proposition. A laptop can carry compromised firmware. A firewall can be both the guard and the unlocked door. An AI cloud can rotate costly GPUs between customers without an easy way to prove that the underlying hardware returned to a clean state. Eclypsium sells one continuous workflow for all three. The service can run in the cloud or on premises, and it plugs its inventory and risk data into the systems security teams already use.
The machine beneath the machine
Eclypsium’s difference is easiest to see as a stack. Conventional endpoint detection and vulnerability tools are strongest in applications and operating systems. Eclypsium deliberately descends into the murkier layers below: boot code, firmware, device configuration, component identity, and hardware provenance. Its reputation database - described as more than 12 million known-good firmware hashes before growing into a 30-million-plus binary corpus - gives those inspections a reference point. A component is not trusted merely because it powers on or carries a familiar badge.
Where the inspection gets interesting
This is not simply a deeper vulnerability scan. The platform builds a component-level inventory and can generate software bills of materials for code inside devices. It watches for drift against a reference profile. It can detect insecure settings such as disabled Secure Boot, surface outdated firmware, and automate updates through its console or API. Version 4.2, released in December 2025, expanded coverage for Cisco, Fortinet, Palo Alto, and Arista network platforms while adding CycloneDX alongside SPDX and HTML output.
The first thing that failed, in Eclypsium’s early customer work, was not a cinematic backdoor. It was maintenance. When Platform 1.0 reached general availability in 2019, the company said more than 99 percent of tested devices were vulnerable to known attacks and 77 percent were running outdated firmware with vulnerable configurations. That finding sharpened the product: rare, brilliant attacks matter, but neglected versions and invisible components create the everyday opening.
“The roots of trust in your IT infrastructure are extremely important, yet are extremely difficult to inspect and not well understood.”Tim Lisko, Senior Director of Security Engineering, DigitalOcean
An eclipse, two Intel alumni, and one stubborn blind spot
Yuriy Bulygin and Alex Bazhaniuk founded Eclypsium in 2017, during the total solar eclipse that gave the company its name. Both had worked at Intel. Bulygin had spent almost a decade leading threat analysis and created CHIPSEC, an open-source framework for assessing hardware and firmware security. Bazhaniuk was a core CHIPSEC developer and had also worked at McAfee. Their commercial insight was less romantic than the celestial timing: enterprises could not operate without trusting hardware, yet had few independent tools to verify that trust.
CEO, CHIPSEC creator, basement inspector-in-chief.
CTO, firmware researcher, fellow Intel alumnus.
The business followed the threat surface outward. Platform 1.0 covered laptops, servers, and network devices. In 2021, Eclypsium made agentless network-appliance inspection a formal product, reflecting attackers’ growing interest in routers, switches, VPNs, and security boxes. In 2023 it wrapped component inventory, integrity checks, SBOMs, vulnerability management, and remediation into a Supply Chain Security Platform. By 2025, the company was applying the same logic to NVIDIA-based GPU servers and AI data centers.
What changed the company’s mind was not an abandonment of firmware. It was the realization that firmware is a route into a much larger buying problem: proving the integrity of an entire device lifecycle. Procurement wants to inspect equipment before acceptance. Security wants to detect tampering in production. Operations wants a safe update path. Compliance wants evidence. AI infrastructure operators want to verify expensive shared hardware between tenants and before resale. The research specialty stayed the same; the workflow became enterprise-wide.
The almost-$1 million receipt
The most legible customer story came from DigitalOcean. After an acquisition, the cloud provider inherited about 350 Windows, macOS, and Linux devices sourced outside its approved supply chain. The simple answer was replacement. It was also expensive and slow, with hardware prices, tariffs, import rules, and logistics standing between the new employees and a clean integration.
Inspect the fleet, keep the machines, avoid the shopping spree.
Eclypsium inventoried the hardware and firmware, checked authenticity and risk, and let DigitalOcean retain the equipment. The reported result: almost $1 million in avoided hardware cost and an integration completed earlier than projected.
That example explains both the customer and the budget. Eclypsium sells to large enterprises, cloud providers, banks, defense-industrial firms, telecoms, critical-infrastructure operators, and government agencies through a demo-led enterprise model and partners. Public list pricing is absent. The defensible return is therefore operational: replace fewer assets, find affected components faster, shrink exposure to known flaws, and produce evidence without sending a specialist to reverse-engineer every box.
Capital for the layer nobody used to watch
*Series C combined equity and debt. Round bars show disclosed amount, not valuation.
Investors have paid to widen the aperture. The $8.75 million Series A in 2018 was followed by $13 million in 2020 and a $25 million Series B in 2022. At that Series B, Eclypsium reported 35-fold annual recurring-revenue growth, 13-fold customer growth, and fivefold headcount growth since Series A. A $45 million equity-and-debt Series C arrived in January 2025, followed by $25 million in strategic financing led by PEAK6 Strategic Capital in March 2026. The company said the last deal pushed total funding above $100 million.
Research is the wedge; repetition is the product
Eclypsium sits between several categories that usually live in separate tabs: endpoint security, vulnerability management, asset inventory, supply-chain assurance, and hardware research. Specialists such as Binarly, NetRise, and Finite State occupy adjacent firmware and connected-device territory. OEM tools can update their own equipment. EDR vendors protect the operating system. Eclypsium’s pitch is breadth across vendors and device types, joined to a loop of verification, detection, and remediation.
Its public research makes that pitch easier to believe. The company has published detection material for BootHole, BIOSDisconnect, USBAnywhere, vulnerable drivers, and compromised routers. In July 2026 it turned the information problem into another product surface: InfraTrust, a free searchable knowledge base for enterprise-hardware advisories, plus InfraTrust Pulse, a monthly digest modeled on Patch Tuesday. It is a smart funnel. Give defenders the map; sell organizations the machinery that continuously checks their estate against it.
The part worth copying
Most companies cannot hire a laboratory of firmware researchers. They can copy the operating discipline. Treat a device as a collection of components, establish a known-good state before deployment, monitor changes after deployment, and preserve a searchable record for the day a vendor discloses a bad component. The model is useful well beyond security software.
The approach has boundaries. A scanner cannot inspect a component it does not support or cannot reach. A known-good hash proves sameness to a reference, not that the reference was perfectly designed. On-premises deployment adds infrastructure to operate. And a security team still needs authority to patch, quarantine, or replace what the platform finds. Eclypsium works best where organizations have diverse, valuable fleets and enough operational maturity to act on component-level evidence. For a small, uniform estate with strong OEM tooling and little regulated risk, the specialist layer may cost more attention than it returns.
Still, the company’s timing is hard to dismiss. Firmware packages can contain thousands of files. Network appliances have become favored entry points. AI infrastructure has made the integrity of GPUs and management controllers a national-security conversation. Eclypsium noticed early that “the computer” was an administrative fiction. Under the label sat a crowd of machines, each with code, history, and a way in. The company’s job is to make that crowd visible before an attacker introduces himself.