xorlab Raises €5M to Build Europe's Sovereign Email Security Platform

xorlab, a Zurich based email security company, has raised 5 million euros in a Series A+ financing round to accelerate its expansion across Europe as enterprises increasingly look to reduce their dependence on US‑controlled security infrastructure.

The round was led by existing investor Spicehaus Partners, with continued participation from Grapha Holding, EquityPitcher Ventures, and ZKB Start‑up Finance, all returning backers rather than new entrants to the company's cap table. xorlab was founded in 2015 as a spin‑out from ETH Zurich's Laboratory of Software Technology and has grown into a team of security professionals and software engineers whose ActiveGuard Defense Platform now protects more than 50,000 mailboxes for financial service providers and high‑tech industrial companies, processing more than 1.5 million emails per day across its customer base.

The company's platform is built around what it describes as context‑intelligent detection, using AI to understand an organization's normal human communication behavior and relationships in order to automatically surface sophisticated cyberattacks before they reach an employee's inbox. That behavioral approach is specifically designed to catch what the industry calls zero‑hour attacks, phishing and business email compromise attempts using techniques and patterns that have never been seen before and therefore evade the signature‑based detection methods that much of the email security industry has historically relied on. According to xorlab, more than 80 percent of phishing emails fall into this zero‑hour category, a figure that underscores why detection systems built around known threat signatures alone increasingly struggle to keep pace with how quickly attackers can generate novel phishing content, particularly as AI tools make it easier for adversaries to craft convincing, tailored attacks at scale.

xorlab chief executive and co‑founder Antonio Barresi framed the company's ambition in terms that go beyond simply matching existing security vendors on features. "Europe needs its own champions in the field of enterprise cybersecurity," Barresi said. The goal, he explained, is not to build European copies of existing US providers, but to create companies capable of shaping the next generation of enterprise security in their own right, rather than following a roadmap set by incumbents based elsewhere.

That framing sits at the center of what xorlab and its investors describe as two reinforcing market trends converging at once. On one side, AI is making it progressively easier for attackers to generate convincing, personalized phishing and business email compromise campaigns at a scale that would have been impractical to produce manually. On the other, European organizations, regulators, and decision‑makers have grown increasingly concerned about relying fully on US‑controlled infrastructure and security providers for mission‑critical systems, a concern sharpened by geopolitical tensions and by regulatory frameworks such as the EU's Digital Operational Resilience Act, or DORA, and the NIS2 directive, both of which place direct compliance obligations on financial institutions and critical infrastructure operators regarding how they secure and govern their systems.

xorlab's platform is built to satisfy exactly that combination of technical and regulatory demands, meeting the requirements of DORA, NIS2, and the EU's General Data Protection Regulation. For on‑premises customers, data is processed and stored locally to meet internal governance requirements, while cloud customers have their data processed and stored exclusively within European data centers, managed by Europe‑based employees who undergo background checks intended to ensure a consistent standard of trust and compliance across the company's operations.

Spicehaus Partners founding partner Daniel Andres, whose firm has now backed xorlab across multiple funding rounds, described the investment thesis behind doubling down on the company. "xorlab has built something rare: differentiated technology solving a mission‑critical problem, validated by some of Europe's most demanding enterprise customers," Andres said. "We have very high conviction that the combination of AI‑driven threats, increasing regulatory pressure, and Europe's push for digital sovereignty is creating a generational opportunity in cybersecurity. xorlab has the technology, customer trust, and market position to build a European category leader, and we are doubling down on that ambition."

xorlab's existing customer base already spans financial services, critical infrastructure, healthcare, and the public sector, and the company has previously partnered with Swisscom, Switzerland's largest telecommunications provider, to extend context‑intelligent email security to enterprise customers across the Swiss market. Reported customer outcomes include a 60 percent drop in phishing incidents following deployment, alongside an average of roughly 7 million euros saved per customer annually in avoided breach‑related damages, according to figures the company has published on its own site.

With the new capital, xorlab plans to accelerate its expansion beyond its home market of Switzerland, with a particular focus on Germany, Austria, and the broader DACH region, alongside the Benelux countries and the Nordics. That geographic push places xorlab squarely inside a broader wave of European cybersecurity and infrastructure companies positioning digital sovereignty not merely as a compliance checkbox but as a genuine competitive differentiator against larger, better‑resourced American security vendors. Whether that sovereignty‑focused pitch proves durable as a standalone advantage, rather than simply a favorable regulatory tailwind, will likely depend on how consistently xorlab can match or exceed the detection performance of its larger US‑based competitors as it scales into new, more contested European markets.