xorlab

xorlab builds an AI-driven email security platform that models an organization’s normal communication patterns and flags deviations, such as unusual senders, unexpected requests, or first-time payment instructions that suggest phishing or business email compromise. Rather than relying primarily on signature or reputation-based filtering, the platform’s behavioral approach is meant to catch novel, targeted attacks that don’t match known indicators of compromise.

Founded in 2015 as a spin-off from ETH Zurich and based in Zurich, Switzerland, xorlab has built a customer base that includes Julius Bär, Swisscom, Vontobel, G+D, and CERN, organizations ranging from 500 to more than 37,000 employees. The company offers flexible deployment, including fully on-premises or hybrid configurations, an explicit response to European enterprise and government demand for data-sovereign security tooling that doesn’t route email content through US-based cloud infrastructure.

In September 2026, xorlab raised EUR 5 million to expand across Europe, following an earlier CHF 6.1 million Series A, positioning the company as a European alternative in an email security category dominated by US vendors. The “sovereign email security” framing is a genuine differentiator for European buyers under increasing regulatory and geopolitical pressure to keep sensitive data processing within domestic or EU infrastructure, though the underlying detection technology competes in a crowded field against larger, better-funded BEC-detection vendors.