The wire — 1 September 2026

One round on the first day of September, and a clear logic to it. xorlab (Zurich) closes a €5M Series A+ led by Spicehaus Partners — a behavioural AI email security platform, deployed on-premises or in European cloud, that detects phishing and BEC attacks by analysing anomalies in normal communication patterns rather than matching known threat signatures. Julius Bär, Swisscom, and CERN are among the named clients. The capital goes toward a sequenced European expansion: DACH first, then Benelux and the Nordics.

The sovereignty argument is central to the pitch and worth examining plainly. xorlab offers something US-based competitors structurally cannot: European data-centre processing, European-staff operations, and on-premises deployment that keeps data entirely within the customer's infrastructure. DORA and NIS2 are creating real compliance pressure on financial institutions and critical-infrastructure operators to demonstrate the resilience of their digital supply chains — and a non-European vendor carrying US data-residency terms has an audit problem that a contract clause cannot fully resolve. That is the opening xorlab is moving into.

France contributed nothing on 1 September. That is not unusual: the first day of the rentrée is one of the thinnest in the French venture calendar. PR teams are back at their desks, but the press-release machinery restarts properly from Wednesday. The first wave of French September deals will surface in Maddyness, FrenchWeb, and EU Startups feeds within 48 hours.