How a Swiss Startup Is Building Europe's Answer to Cybersecurity Sovereignty

Jan de Vries · 2026-09-01

Let's talk about something that's been keeping European CISOs up at night. It's a double-edged sword, really. On one side, AI is making phishing emails so convincing they could fool your own mother. On the other, there's this nagging worry about relying too much on tech infrastructure that's controlled from outside Europe. That's where xorlab comes in. This Zurich-based startup just raised about $5.4 million in a Series A+ round to tackle exactly that problem. They're not just another security vendor—they're building what they call 'sovereign email security' specifically for European organizations. ### The Funding and The Vision The funding round was led by existing investor Spicehaus Partners, with continued backing from Grapha Holding, EquityPitcher Ventures, and ZKB Start-up Finance. Daniel Andres from Spicehaus put it perfectly when he said: "We have very high conviction that the combination of AI-driven threats, increasing regulatory pressure, and Europe's push for digital sovereignty is creating a generational opportunity in cybersecurity." He's talking about something bigger than just another security product. This is about Europe building its own cybersecurity champions—companies that can stand toe-to-toe with the big US players while keeping data and control firmly on European soil. ### What Makes These Email Attacks Different Here's the scary part about modern phishing. We're not talking about the obvious 'Nigerian prince' emails anymore. Today's attacks: - Are crafted by AI to sound completely legitimate - Carry no malware that traditional filters can catch - Match no known threat signatures - Often slip right past Microsoft 365 and other mainstream filters They look normal in isolation. That's why xorlab's approach is different. Their behavioral AI looks at context—what normal communication looks like for your specific organization, then flags what doesn't fit. An unusual sender here, an out-of-pattern request there, a first-time payment request that just feels off. ### The Sovereign Security Promise This is where it gets really interesting for European businesses. xorlab gives organizations choices about how they run the platform: - Fully on-premises with local processing and storage - In a hybrid configuration - In the cloud But here's the kicker—all processing happens in European data centers, managed by Europe-based staff. For companies dealing with regulations like DORA, NIS2, and GDPR, that's not just convenient—it's essential. ### Who's Already Trusting Them The customer list tells you something about the trust they've built. We're talking about: - Julius Bär - Swisscom - Vontobel - G+D - Even CERN These aren't organizations that take security lightly. They're financial institutions, critical infrastructure operators, telecom providers—the kind of entities that can't afford to get this wrong. ### Why This Matters Beyond Just Security Antonio Barresi, xorlab's CEO and co-founder, sums up the bigger picture: "Europe needs its own cybersecurity champions. Not European copies of US incumbents, but companies capable of defining the next generation of enterprise security." He's right. Email remains one of the most critical attack surfaces, and AI is changing everything about how we need to defend it. European organizations don't just need world-class protection—they need control over their data and infrastructure too. As xorlab expands across Europe—starting with DACH, Benelux, and the Nordics—they're not just selling a product. They're offering a different approach to cybersecurity sovereignty. One where European organizations can defend against the most sophisticated threats without handing over the keys to their digital kingdom. It's a delicate balance, but one that more European businesses are realizing they need to strike. And with about $5.4 million in fresh funding and a clear vision, xorlab seems positioned to help them do just that.