How This Swiss Startup's Funding Could Reshape European Cybersecurity

Jan de Vries · 2026-09-01

You know that feeling when your inbox gets flooded with suspicious emails? Well, imagine that on a massive scale for European banks, hospitals, and telecom companies. That's the daily reality xorlab is tackling from its Zurich headquarters, and they just secured a major vote of confidence to scale their solution. They've raised about $5.4 million in a Series A+ round. This isn't just another funding announcement—it's a strategic move to accelerate expansion across key European markets. They're starting with the DACH region, Benelux, and the Nordics. The round was led by existing investor Spicehaus Partners, with continued backing from Grapha Holding, EquityPitcher Ventures, and ZKB Start-up Finance. This follow-on investment from existing backers tells you something—they're seeing real traction. ### Why Investors Are Doubling Down Daniel Andres, Founding Partner at Spicehaus Partners, put it bluntly. He said xorlab has built something rare: technology that solves a mission-critical problem, already validated by Europe's most demanding enterprise customers. "We have very high conviction," Andres explained, "that the combination of AI-driven threats, increasing regulatory pressure, and Europe's push for digital sovereignty is creating a generational opportunity in cybersecurity." He believes xorlab has the technology, customer trust, and market position to build a European category leader. "We are doubling down on that ambition," he added. ### The Sovereign Security Pitch Founded in 2015 by ETH Zurich computer science graduates Antonio Barresi and Matthias Ganz, xorlab defends organizations against sophisticated phishing attacks. Their AI-powered email security works in on-premises, hybrid, or cloud environments. Here's the dual challenge they're addressing for European organizations: - AI-powered cyberattacks are getting scarily sophisticated. Adversaries now use artificial intelligence to craft convincing phishing campaigns at massive scale. - There's growing unease about relying too heavily on US-controlled infrastructure and security providers. It's a sovereignty thing. Regulations like DORA and NIS2 add fuel to this fire. They hold financial institutions and critical-infrastructure operators directly accountable for their digital supply chains' resilience. ### How Their Technology Actually Works xorlab claims to offer protection against advanced email attacks without sacrificing data control or digital sovereignty. They're targeting what they call the "new generation" of email attacks. Think about AI-crafted phishing and business email compromise campaigns. The scary part? These often carry no malware, match no known signature, read like legitimate messages, and slip right past Microsoft 365 and traditional filters. Because these attacks look normal in isolation, xorlab evaluates every message in context. Their behavioral AI understands what legitimate communication looks like for each specific organization. It catches what doesn't fit—an unusual sender, an out-of-pattern request, a first-time payment request—before anyone can click. ### A European Champion's Vision Barresi, CEO and co-founder, framed it as a matter of regional pride and practical necessity. "Europe needs its own cybersecurity champions," he stated. "Not European copies of US incumbents, but companies capable of defining the next generation of enterprise security." He emphasized that email remains one of the most critical attack surfaces, and AI is fundamentally changing the threat landscape. "European organizations need security that combines world-class protection with control over their data and infrastructure," Barresi argued. "There's no better place to build the European leader in email security," he concluded, "than in the heart of Central Europe." ### Flexibility and Compliance Built In Since every organization's risk and regulatory posture differs, xorlab lets customers choose how it runs: - Fully on-premises with local processing and storage - In a hybrid configuration - Or in the cloud The company emphasizes that processing happens in European data centers, with operations managed by Europe-based staff. This addresses both performance concerns and sovereignty requirements. The platform supports DORA, NIS2, and GDPR compliance requirements. Their customer list reads like a who's who of European institutions: financial organizations, healthcare providers, critical-infrastructure operators, telecom companies, and public-sector entities. Notable names include Julius Bär, Swisscom, Vontobel, G+D, and even CERN. When you're protecting the organization that runs the Large Hadron Collider, you know you're dealing with serious security needs. What's interesting here isn't just the funding amount—it's what it represents. This investment signals growing momentum behind European digital sovereignty in cybersecurity. As AI-powered threats evolve and regulatory pressures mount, solutions like xorlab's aren't just nice-to-have; they're becoming strategic necessities for organizations across the continent.