xorlab raises €5M to scale AI email security from Zurich into DACH, Benelux, and the Nordics

xorlab (Zurich) has closed a €5 million Series A+ led by existing investor Spicehaus Partners, with continued participation from Grapha Holding, EquityPitcher Ventures, and ZKB Start-up Finance. The capital is earmarked for a single commercial objective: expanding beyond Switzerland into the DACH region, Benelux, and the Nordics.

The round follows xorlab's original Series A in 2021 and arrives as two pressures converge in European enterprise security. AI is making phishing and business email compromise (BEC) attacks meaningfully harder to detect — automated campaigns can generate highly convincing, signature-free messages indistinguishable from legitimate business communication. At the same time, DORA and NIS2 are tightening what financial institutions and critical-infrastructure operators must demonstrate about the resilience of their digital supply chains.

The behavioural difference

xorlab's platform does not rely primarily on libraries of known threats. Instead, it analyses each incoming message within the context of an organisation's established communication patterns — flagging anomalies such as unexpected senders, unusual payment requests, or first-time wire instructions that could indicate a compromise even when the message contains no technical indicators of attack.

The platform is available in three deployment configurations: fully on-premises (processing and storage remain within the customer's infrastructure), hybrid, or cloud — with the cloud variant hosted in European data centres and operated exclusively by European-based staff. The on-premises option is a genuine differentiator for regulated industries where data-sovereignty requirements rule out external processing.

Current customers span financial services, healthcare, critical infrastructure, and the public sector. Named accounts include Julius Bär, Swisscom, Vontobel, G+D Netcetera, and CERN — organisations with between 500 and 37,000 employees and real security procurement discipline. The company reported that demand from European organisations doubled again in 2026, which it attributes to a combination of AI-enhanced threats and growing preference for non-US-based providers.

The expansion thesis

The DACH extension is xorlab's natural first step: Germany and Austria are the linguistic and regulatory neighbours of Switzerland, where the sovereignty argument lands without translation and the reference customers are visible. Benelux and the Nordics are the second wave — English-language markets where DORA and NIS2 are equally in force and where the European-vendor credential carries weight in public-sector and financial procurement.

Daniel Andres, founding partner at Spicehaus Partners, described xorlab as having created "a differentiated technology that solves a business-critical problem and has been validated by some of Europe's most demanding enterprise customers" — phrasing that positions this Series A+ as a commercialisation bet, not a technology wager.

"Europe needs its own cybersecurity champions," said Antonio Barresi, CEO and co-founder. "Not European copies of US incumbents, but companies capable of defining the next generation of enterprise security. Email remains one of the most critical attack surfaces, and AI is fundamentally changing the threat landscape."

Founded at ETH Zurich in 2015 by Barresi and Matthias Ganz, xorlab has spent a decade building towards this expansion thesis. The Swiss proof of concept is in place. DACH, Benelux, and the Nordics are the proof of scale.