xorlab Receives 5 Million Euros for European Email Security

The Swiss cybersecurity startup xorlab has raised 5 million euros in a Series A+ funding round. The round is led by existing investor Spicehaus Partners. Other participants include Grapha Holding, EquityPitcher Ventures, and ZKB Start-up Finance. The Zurich-based company plans to use the fresh capital to accelerate its expansion in Europe, with a particular focus on growth in the DACH region, the Benelux countries, and the Nordic countries.

Digital Sovereignty as a Growth Driver

xorlab positions itself as a European alternative to U.S. providers of email security solutions. According to the company, demand for such solutions is rising significantly. In 2025, xorlab reported its most successful fiscal year to date. In the current year, demand from European companies has doubled once again.

In addition to rising cyber risks, the company sees the desire for greater digital sovereignty as a key growth driver. European companies and government agencies are increasingly grappling with the question of how dependent their critical IT infrastructure should be on non-European providers.

At the same time, regulatory requirements such as DORA and NIS2 are raising the bar for the resilience of digital supply chains, particularly for financial institutions and operators of critical infrastructure.

AI Is Changing Phishing Attacks

Technologically, xorlab focuses on securing one of the most important entry points for cyberattacks: email. By using generative AI, attackers can create phishing messages and so-called business email compromise attacks that are increasingly credible and on a large scale.

Attacks that contain neither malware nor known signatures pose a particular challenge. Such messages can appear to be regular business communications and thus bypass traditional security filters.

xorlab therefore relies on behavior-based AI. Instead of analyzing an email in isolation, the platform examines the message within the context of an organization’s previous communications.

For example, the system is designed to detect and block unusual senders, atypical requests, or payment requests appearing for the first time before employees interact with the message.

From 500 to more than 37,000 employees

The startup is aimed particularly at companies and institutions with high security and regulatory requirements. Its customers include organizations in the financial services, healthcare, critical infrastructure, and public sectors.

According to xorlab, organizations with 500 to more than 37,000 employees use the technology. Notable clients include Julius Bär, Swisscom, G+D Netcetera, Vontobel, and CERN.

Customers can decide for themselves how the platform is operated. In addition to a cloud solution, xorlab also offers hybrid installations and fully local on-premises operation. With the cloud option, European data centers and European employees are responsible for operations.

The company states that its platform meets the requirements of DORA, NIS2, and the GDPR.

5 Million Euros for Expansion

The new funding is intended in particular to accelerate European expansion. In addition to its home market of Switzerland, the focus is on Germany, Austria, and the rest of the DACH region, as well as the Benelux countries and the Nordic countries.

“Europe needs its own champions in the field of enterprise cybersecurity,” says Antonio Barresi, CEO and co-founder of xorlab. The goal, he explains, is not to create European copies of existing U.S. providers, but to build companies that can shape the next generation of enterprise security themselves.

Lead investor Spicehaus Partners sees a long-term market opportunity in the combination of AI-based cyber threats, increasing regulatory requirements, and Europe’s pursuit of digital sovereignty.

“xorlab has created something rare: a differentiated technology that solves a business-critical problem and has been validated by some of Europe’s most demanding enterprise customers,” explains Daniel Andres, founding partner of Spicehaus Partners.

Aiming to Be a European Cybersecurity Champion

xorlab plans to use the funding to establish itself in the long term as a leading European provider of email security. In addition to detecting phishing and BEC attacks, the platform offers features for security operations centers, including detailed analysis of email flows and AI-powered automation.

This funding round comes at a time when two market trends are reinforcing each other: AI is making it easier for attackers to create increasingly convincing attacks, while at the same time, companies are placing higher demands on data protection, compliance, and control over their digital infrastructure.

For xorlab, the combination of cybersecurity and digital sovereignty could thus become a decisive factor for its further expansion in Europe.