xorlab raises €5M for email security AI
Swiss email security firm xorlab raised €5 million to scale its AI platform in Europe, aiming to reduce reliance on US cybersecurity providers.
xorlab, a Swiss email security company, has raised €5 million in a Series A+ financing round. The funding will support its expansion across Europe and the further development of its AI-powered security platform. The round was led by existing investor Spicehaus Partners, with continued participation from Grapha Holding, EquityPitcher Ventures and ZKB Start-up Finance. The financing arrives as European organisations seek to lessen dependence on US-based cybersecurity providers while responding to more sophisticated email threats.
Email remains a primary entry point for cyberattacks. Artificial intelligence now enables attackers to create highly convincing phishing and business email compromise campaigns at scale. These attacks often contain no malware or known malicious signatures. They can closely mimic legitimate communications, evading conventional email filters.
Regulatory drivers for European security
New regulations are increasing requirements for digital supply chain resilience. The Digital Operational Resilience Act (DORA) and NIS2 directive impose specific rules, particularly for financial institutions and critical-infrastructure operators. xorlab's platform is designed to support these regulatory requirements, including GDPR. The company targets customers in sectors like finance, healthcare, and telecommunications, and you can find more on our stats page about sector-specific threats.
The behavioural AI approach
xorlab's email security platform uses behavioural AI to analyse messages. It examines them within the context of an organisation's normal communication patterns. Instead of relying on known threat signatures, the technology hunts for anomalies. It flags unusual senders, unexpected requests, or first-time payment instructions. These signals can indicate phishing or business email compromise attempts. The system learns what is typical for a business.
Deployment and data sovereignty
Customers have multiple deployment options for the platform. They can choose an on-premises installation with local processing and storage. A hybrid configuration is also available. For cloud deployment, processing occurs in European data centres, and operations are managed by staff based in Europe. This model addresses data sovereignty concerns for European organisations, aligning with trends we track in our fixtures for secure infrastructure.
The company's customer base includes Julius Bär, Swisscom, Vontobel, G+D, and CERN. Several major Swiss banks also use the service.
A call for European champions
xorlab's CEO, Antonio Barresi, framed the funding within a broader mission. "Europe needs its own cybersecurity champions," he said. "Not European copies of US incumbents, but companies capable of defining the next generation of enterprise security." Barresi noted that email remains a critical attack surface and that AI is fundamentally changing the threat landscape.
The company plans to use the new capital to expand across European markets. Initial focus will be on the DACH region, Benelux, and the Nordics. The goal is to scale its European-focused security offering.
