Finite State review

Finite State is a product-security platform for connected-device software and firmware. It is not presented as a developer library or command-line tool: the vendor describes a platform with security and compliance workflows, a multi-tenant environment, and a demo-led sales process. The homepage does not state whether customers use a hosted service, an on-premises deployment, or both, so confirm the deployment model before architecture review.

The system analyzes product artifacts, including firmware and mobile app binaries, to find vulnerabilities and security issues. It generates enriched SBOMs, maps vulnerabilities to reachability, supports threat analysis, and monitors products for new vulnerabilities. Compliance workflows connect findings to regulatory requirements and vulnerability-management documentation. In a product stack, it sits alongside artifact production and product-security operations, rather than serving as a general-purpose code library. The vendor cites CI/CD integration in a customer testimonial, but does not describe the integration mechanics on its homepage.

Finite State’s homepage names CI/CD pipeline integration as a customer use case. It does not describe the integration protocol or offer details about an API, SDKs, supported programming languages, CLI, webhooks, or plugins. That makes it hard to assess implementation effort from the public product material alone. Ask the vendor for its integration documentation and confirm API and SDK support in the vendor’s docs before planning a build.

The listed workflow centers on submitting or analyzing product artifacts: the platform covers firmware and mobile app binaries, including when source code is unavailable, and produces SBOMs and vulnerability findings. The homepage does not explain whether artifact ingestion is handled through a UI, API, CI/CD action, or another mechanism. A customer testimonial says Finite State integrated with a CI/CD pipeline, but it does not name the pipeline, languages, or setup. Request a technical walkthrough covering artifact formats, authentication, automation, result retrieval, and how findings reach existing ticketing or security systems.

Finite State lists a Custom plan for organizations needing product security. The price is by custom quote; the pricing information gives no starting price, monthly or annual amount, or published billing terms. It lists no free plan or free trial. Teams should budget for a sales-led evaluation rather than a self-serve test.

The vendor does not publish a pricing unit, so there is no public basis for estimating how costs change with artifact volume, products, seats, scans, requests, or compute. The available pricing information also does not list overage rates or add-ons. Ask for a quote tied to your expected firmware and mobile-app inventory, release cadence, user count, monitoring needs, and compliance scope. Request clarification on what counts toward the contract, how added products or suppliers affect cost, and whether renewal pricing or minimum commitments apply. Until the vendor provides those terms, value is difficult to compare with tools that publish usage pricing.

Finite State’s homepage does not identify an open-source license or a source-code repository. Treat it as a commercial platform unless the vendor confirms otherwise. The vendor does not publish self-hosting or deployment options on the homepage, so ask whether analysis and stored product data can run in your environment or only in a vendor-managed service.

The homepage also does not describe data-export formats or migration support. That matters because product inventories, enriched SBOMs, reachability results, vulnerability histories, and compliance evidence can become part of ongoing engineering and audit workflows. Before signing, ask which outputs can be exported in machine-readable formats, whether historical findings remain available after cancellation, and how tenant data is deleted. Without those answers, portability and migration effort are unknown; plan for potential dependence on the platform’s analysis and reporting model.

Finite State’s stated production use is continuous analysis and monitoring of connected-device artifacts, with vulnerability reachability and compliance reporting for product-security teams. Its homepage gives example customer outcomes, including one firmware result showing 29,447 CVEs narrowed to 51 that were exploitable and reachable. Treat that as a vendor-published example, not a guaranteed result for another product.

Before relying on the platform, get its supported artifact formats, scan and monitoring limits, rate limits, service availability commitments, and incident-response terms in writing. The vendor’s homepage does not publish those operational figures. Also review access controls, tenant isolation, data retention, encryption, and the handling of proprietary firmware with the vendor. Confirm how findings are delivered to CI/CD and other systems, how failed or delayed scans are surfaced, and whether exports preserve the data needed for audits or a future migration. The custom-quote model makes these contract details part of production planning.