Swiss cybersecurity company xorlab has raised €5 million in a Series A+ financing round to support the expansion of its email security platform across Europe. The round was led by existing investor Spicehaus Partners, with additional participation from Grapha Holding, EquityPitcher Ventures, and ZKB Start-up Finance. The Zurich-based company plans to prioritize growth in the DACH region, Benelux, and the Nordic markets as demand increases for European-controlled cybersecurity infrastructure.
Growing Demand for Sovereign Cybersecurity
xorlab said the financing comes as European organizations increasingly reassess their dependence on security technologies and infrastructure controlled by non-European providers. Rising geopolitical tensions, tougher regulatory requirements, and growing concerns around digital sovereignty are influencing how enterprises approach the protection of sensitive data and communications. The company is positioning its platform as an alternative for organizations seeking advanced email protection while retaining greater control over where and how their data is processed.
Email continues to represent a significant attack surface for enterprises, particularly as cybercriminals increasingly use artificial intelligence to make phishing and business email compromise campaigns more convincing. Many emerging attacks contain no malware or recognizable malicious signatures, allowing them to bypass conventional filters and appear similar to legitimate internal or external communications. xorlab aims to detect these threats by analyzing the behavioral context surrounding each email rather than relying primarily on known indicators of compromise.
Behavioral AI for Email Protection
The company’s platform uses behavioral artificial intelligence to establish patterns of legitimate communication within an organization and identify messages that deviate from expected activity. These anomalies can include unusual senders, unexpected requests, or first-time payment instructions that may indicate sophisticated phishing or impersonation attempts. According to xorlab, this approach helps security teams identify attacks that can evade Microsoft 365 protections and traditional email filtering systems.
Customers can deploy the technology through on-premises, hybrid, or cloud-based configurations depending on their security and compliance requirements. On-premises deployments allow organizations to keep processing and storage fully local, while cloud deployments operate through European data centers and are managed by personnel based in Europe. The platform is designed to support organizations subject to regulatory frameworks including the Digital Operational Resilience Act, NIS2, and the General Data Protection Regulation.
Expanding Across Regulated Industries
xorlab serves customers across financial services, healthcare, telecommunications, critical infrastructure, and the public sector, where email security and regulatory compliance are particularly important. Its customer base includes organizations with workforces ranging from around 500 employees to more than 37,000 employees, including Julius Bär, Swisscom, Vontobel, G+D Netcetera, and CERN. The company also said six of Switzerland’s ten largest banks currently use its technology.
The latest financing follows what xorlab described as its strongest year to date in 2025, while inbound demand from European enterprise customers has reportedly doubled again during 2026. CEO and co-founder Antonio Barresi said Europe has an opportunity to develop cybersecurity companies capable of competing globally while meeting regional requirements around control, resilience, and infrastructure. The new capital is expected to help xorlab increase its commercial presence across Europe while continuing to invest in its security technology.
Investor Support for European Expansion
Spicehaus Partners said its decision to increase its backing reflects confidence in xorlab’s technology, enterprise customer base, and position within the European cybersecurity market. Founding Partner Daniel Andres highlighted the convergence of AI-driven cyber threats, regulatory pressure, and the growing emphasis on digital sovereignty as factors creating opportunities for European security vendors. Spicehaus primarily invests in early-stage Swiss B2B technology companies that have established initial revenues and demonstrate potential for international expansion.
xorlab’s €5 million Series A+ round provides additional capital as the company seeks to establish a stronger position in Europe’s increasingly strategic cybersecurity market. By combining behavioral AI-based email threat detection with deployment options designed around European data and infrastructure requirements, the company is targeting enterprises operating in complex and highly regulated environments. Its next phase of expansion will focus on converting rising demand for sovereign cybersecurity solutions into broader adoption across key European markets.