Spicehaus Doubles Down as xorlab Raises €5 Million

xorlab raised €5 million (about $5.4 million) in a Series A+ round led by Spicehaus Partners, the Swiss firm already on its cap table. Grapha Holding, EquityPitcher Ventures and ZKB Start-up Finance joined again, with no new lead named.

Spicehaus founding partner Daniel Andres said the firm is doubling down on a Zurich email security company whose paying logos are already among Switzerland’s hardest buyers, and whose next test is whether that cluster travels.

Spicehaus Is Doubling Down on Zurich

Andres did not describe a seed-stage hope. He described a specialist that has already been through Swiss banks, then said the next cheque is meant to turn that into a European category position.

We have very high conviction that the combination of AI-driven threats, increasing regulatory pressure, and Europe’s push for digital sovereignty is creating a generational opportunity in cybersecurity. xorlab has the technology, customer trust, and market position to build a European category leader, and we are doubling down on that ambition.

Daniel Andres, Founding Partner, Spicehaus Partners

Antonio Barresi, xorlab’s CEO and co-founder, put the same wager in plainer terms. “Europe needs its own cybersecurity champions,” he said, arguing that firms should set the next wave of enterprise security rather than copy US vendors, and that email is still one of the main doors attackers walk through.

The structure of the round is the tell. This is a Series A+, led by an existing investor, with the same Swiss names still writing cheques. Outside the Swiss startup circuit the news landed as a mid-size cyber follow-on, which is what a specialist wager looks like when nobody new is taking the wheel.

Insider Money Since the ETH Spinout

Barresi and co-founder Matthias Ganz, both ETH Zurich computer science graduates, built the company after years of watching paid filters miss low-volume, targeted mail. The 2021 release said they designed the software from an attacker’s point of view, after running email penetration tests that slipped past tools clients had already bought.

The firm was incorporated in Zurich in 2015, at Binzmühlestrasse 170d, as a spin-out tied to ETH’s software-technology lab. Spicehaus was already listed as an existing investor when EquityPitcher Ventures led the Series A. Zürcher Kantonalbank and the Hasler Foundation were on that round too.

THE MONEY THAT STAYED IN ZURICH

1. 2015: Barresi and Ganz found xorlab out of ETH Zurich to stop targeted email attacks that signature filters miss.
2. 29 July 2015: xorlab AG is incorporated in Zurich.
3. 25 October 2021: The company closes a CHF 6.1 million Series A in 2021 led by EquityPitcher Ventures, with Spicehaus, Zürcher Kantonalbank and the Hasler Foundation extending.
4. 1 September 2026: Spicehaus leads a €5 million Series A+ with Grapha Holding, EquityPitcher Ventures and ZKB Start-up Finance still in.

EquityPitcher’s Sascha Horrig said in 2021 that xorlab would “need to scale globally.” Five years later the new cheque is still a European expansion round, still led from Zurich, and still framed around DACH, Benelux and the Nordics rather than a US push.

Six of Switzerland’s Largest Banks Use xorlab

xorlab’s own site says 6 out of the 10 largest banks in Switzerland use it for email security. The 2026 customer list named Julius Bär, Swisscom, Vontobel, G+D and CERN, plus other major Swiss banks it did not list.

NAMED LOGOS ON THE 2026 ROUND

The 2021 Series A already put Julius Bär, Swisscom, Swiss Post, the Swiss Federal Railway (SBB) and Implenia on the logo slide. Implenia’s former CISO, Alexander Bösch, still appears on xorlab’s site praising a “relationship-based” engine and a low false-positive rate, which is a reference from a construction group rather than a new 2026 disclosure.

That concentration is useful collateral for a follow-on investor and a narrow base for a pan-European claim. A product that already clears Swiss private banks still has to win procurement in Amsterdam, Stockholm and Brussels, where Microsoft 365 and US email filters are the default.

The Julius Bär CISO on the Board

The cap table is not the only place the buyers sit. xorlab’s Julius Bär CISO on the board is Michael Meli, listed as group CISO at the private bank and as a director, with Barresi as chairman.

Daniel Haller, head of corporate development at Grapha, is a director too, so an investor from this round has a board seat. Mark Stäheli, co-CEO at AVANTEC, is the fourth director; AVANTEC is a Swiss security reseller that has run xorlab briefings for CISOs, including a 2024 roundtable where Vontobel staff talked about three years on the platform.

Meli’s customer quote on the same page is blunt about cost. “xorlab is one of the rare cybersecurity solutions that enhance security and reduce cost,” he said, adding that staff can feed the defence by automating abuse reports.

A bank CISO on the board, a reseller co-CEO on the board, and a holding-company director on the board is a tight Zurich loop. Spicehaus is betting that loop is a feature when regulated buyers want a vendor they can audit, not a bug that keeps the company trapped in one city.

Why DORA Pushes Banks Toward Local Email Filters

DORA now holds in-scope financial firms to account for the digital suppliers under their critical functions, including where email is processed and how incidents are reported. xorlab sells on-premises, hybrid and EU-hosted cloud setups so those firms can keep mail inspection inside Europe and still show a named supplier that is not a US cloud stack.

The company says the platform is built to support DORA, NIS2 and GDPR. Cloud processing, it says, runs in European data centres and is run by Europe-based staff, while on-premises customers keep processing and storage local. Staff, it adds, go through background checks, and access to subjects and bodies is role-based.

Supervisors have spent 2025 and 2026 spelling out what that means in contracts. Luxembourg’s CSSF page on ICT third-party risk under DORA sits on top of the same rulebook: firms must know who runs the service, where data lives, and how they get out. Email filtering that supports payments, client files and staff identity is an easy item to put on that register.

HOW XORLAB SAYS CUSTOMERS CAN RUN IT

• On-premises: Mail is processed and stored locally, which the company pitches for governance teams that will not send message bodies to a foreign cloud.
• Hybrid: Firms split the stack, keeping sensitive handling inside their own rooms while using xorlab’s cloud for the rest.
• EU cloud: Processing is in European data centres and operations are handled by Europe-based staff, which is the pitch against US-hosted filters.
• User quarantine: Blocked mail can be previewed in a sandbox, with every release written to an audit log, so the security team is not the bottleneck.

The product claim underneath those setups is behavioural AI, not a bigger signature list. xorlab says it scores sender-receiver patterns, reputation and anomalies, and looks for first-time payment instructions, odd senders and requests that do not match how a firm usually talks. It also lists image analysis, sandboxing and more than 800 pre-set policies for triage.

That is the technical half of Andres’s wager. AI-written phishing can look clean in isolation, with no malware and no known bad hash, so a filter that only knows yesterday’s junk will pass it. A filter that knows who the finance team usually pays has a second chance.

Vontobel Cut Reported Phishing by 60%

The strongest named result xorlab publishes is not a lab score. It is a bank cyber-defence lead talking about tickets.

The immediate return on investment is striking. After deploying xorlab, our reported phishing incidents dropped by 60%.

Dominic Alber, Head of Cyber Defense, Vontobel

Alber’s line is about mail that staff still felt the need to report. If the front-line filter catches more of the obvious lures, the queue shrinks. xorlab also claims analysts save 21 hours a month, that it saves each customer €7 million a year in damages, and that 97% of customers stay on the product year after year. Those three figures are the company’s own marketing maths, not a third-party audit.

Thomas Hankiewicz, IT director at ADA Möbel, is quoted saying phishing detection improved while analyst workload fell. Bösch, from his Implenia tenure, said the engine stopped unknown threats without flooding the team with false positives. Together the quotes argue for a tool that sits beside Microsoft 365 and older secure email gateways rather than a rip-and-replace of the whole mail stack, which is how a Swiss specialist sells into a bank that already paid for the US suite.

DACH, Benelux and the Nordics Come First

xorlab said the new money will fund European growth and further work on the platform, with a first focus on DACH, then Benelux and the Nordics. Healthcare, critical infrastructure, telecoms and the public sector sit on the target list beside banks.

That map is close to home on purpose. German, Dutch and Nordic financial firms live under the same DORA duties as the Swiss houses that already pay xorlab, and they still buy a lot of US email security. A Zurich vendor that can run on-premises, name European staff, and put a Julius Bär CISO on its board is selling a procurement story as much as a detection story.

The cheque is still €5 million. It pays for sales seats, localisation and the next product cycle, not for a global channel war. Barresi said European organisations need protection that keeps control of data and systems, and that there is no better place to build a European leader in email security than in the heart of Central Europe. The next logos will show whether Spicehaus bought a wider franchise or a deeper Swiss one.