Zurich-based xorlab secures €5 million to scale sovereign email security across Europe

xorlab, a Zurich-based startup offering email security solutions for on-premises or cloud environments, has raised €5 million in a Series A+ financing round to accelerate its expansion across Europe, starting with DACH, Benelux, and the Nordics.

The round was led by existing investor Spicehaus Partners, with continued participation from Grapha Holding, EquityPitcher Ventures, and ZKB Start-up Finance. Daniel Andres, Founding Partner at Spicehaus Partners, said, “xorlab has built something rare: differentiated technology solving a mission-critical problem, validated by some of Europe’s most demanding enterprise customers.

“We have very high conviction that the combination of AI-driven threats, increasing regulatory pressure, and Europe’s push for digital sovereignty is creating a generational opportunity in cybersecurity. xorlab has the technology, customer trust, and market position to build a European category leader, and we are doubling down on that ambition.” Founded in 2015 by ETH Zurich computer science graduates Antonio Barresi and Matthias Ganz, xorlab is an email security platform that defends organisations against sophisticated phishing attacks by adding its AI-powered email security to your on-premises, hybrid, or cloud environment.

The company highlighted the dual challenge faced by European organisations. The first one is the increasing sophistication of cyberattacks as adversaries use AI to craft convincing phishing campaigns at scale. The second is a growing concern about relying too heavily on US-controlled infrastructure and security providers.

“Regulations such as DORA and NIS2 add further pressure, holding financial institutions and critical-infrastructure operators directly accountable for the resilience of their digital supply chains,” the company mentioned.

xorlab claims that it offers European organisations protection against the most advanced email attacks without sacrificing control over their data, infrastructure or digital sovereignty. It helps security teams stop the new generation of email attacks: AI-crafted phishing and business email compromise (BEC) campaigns that carry no malware, match no known signature, read like legitimate messages, and often slip past Microsoft 365 and traditional filters into employee inboxes.

Because these attacks look normal in isolation, xorlab states that it evaluates every message in context: its behavioural AI understands what legitimate communication looks like for each organisation and catches what doesn’t fit, such as an unusual sender, an out-of-pattern request, a first-time payment request, before anyone can click.

Barresi, CEO and co-founder of xorlab, said, “Europe needs its own cybersecurity champions. Not European copies of US incumbents, but companies capable of defining the next generation of enterprise security. Email remains one of the most critical attack surfaces, and AI is fundamentally changing the threat landscape. European organisations need security that combines world-class protection with control over their data and infrastructure. There is no better place to build the European leader in email security than in the heart of Central Europe.”

Since every organisation’s risk and regulatory posture is different, xorlab enables its customers to choose how it runs: fully on-premises, with local processing and storage; in a hybrid configuration; or in the cloud. The company highlights that the processing takes place in European data centres and operations are managed by Europe-based staff.

The platform supports customers’ DORA, NIS2, and GDPR compliance requirements and serves financial institutions, healthcare organisations, critical-infrastructure operators, telecommunications providers, and public-sector entities. Notable customers include Julius Bär, Swisscom, Vontobel, G+D, and CERN.