€5m · Series A · Cybersecurity · Zurich, Switzerland
Zurich-based xorlab, which develops behavioral email security for regulated enterprises, has raised €5m in a Series A+ financing round led by existing investor Spicehaus Partners, with continued participation from Grapha Holding, EquityPitcher Ventures and ZKB Start-up Finance. The company said the capital will support expansion across Europe, beginning with DACH, Benelux and the Nordics.
xorlab describes the financing as Series A+; Tech.eu Funding Explorer records it under the canonical Series A stage.
Deployment choice is part of the security product
xorlab is built for email attacks that can look legitimate in isolation, including AI-crafted phishing and business email compromise without malicious attachments or known signatures. Its platform evaluates messages against an organisation's normal communication patterns, looking for anomalies such as unusual senders, out-of-pattern requests or first-time payment instructions. The company positions this contextual layer as a complement to Microsoft 365 and traditional secure email gateways rather than another signature database.
The deployment model is central to the commercial proposition. Customers can run xorlab fully on-premises with local processing and storage, use a hybrid setup, or choose a cloud service processed in European data centres and operated by Europe-based staff. That range lets security teams match the product to their own infrastructure and data-control requirements. For regulated buyers, detection performance and operational control are therefore sold together: a customer does not have to accept one hosting model in order to add behavioral filtering.
Expansion has to reproduce Swiss enterprise trust
The company says its customers range from 500 to more than 37,000 employees and include Julius Bär, Swisscom, Vontobel, G+D Netcetera and CERN. It also says six of Switzerland's ten largest banks use the platform, that 2025 was its strongest year to date and that inbound demand from European enterprises doubled again in 2026. Those are company-reported claims, but they explain why the new capital is aimed at geographic expansion rather than a wholesale product change.
The execution question is whether xorlab can turn reference customers in its home market into a repeatable sales motion across several European regions. On-premises and hybrid options can strengthen the pitch where jurisdiction and infrastructure control matter, while also requiring the company to support different customer environments. The returning investor group is backing that next stage without changing the core thesis: differentiated email detection, paired with deployment control, should give a European provider a route into security-conscious enterprises. Spicehaus described its investment as support for xorlab's continued growth and international expansion.
