xorlab
Zurich behavioural-AI email security that learns sender relationships to catch BEC and spearphishing
Quick Overview
| Company | xorlab AG |
|---|---|
| Category | Email Security & Anti-Phishing Software |
| Headquarters | Zurich, Switzerland |
| EU Presence | Switzerland (adequacy decision, outside the EEA) |
| Data Location | Cloud customer data processed and stored in European data centres by Europe-based staff; on-premises and hybrid also offered |
| Open Source | No |
| Pricing | No public price list; demo and attack simulation on request |
| Free Option | Demo and attack simulation on request |
| Replaces | Proofpoint, Abnormal Security, Microsoft Defender for Office 365 |
Detailed Review
xorlab AG in Zurich builds behavioural email security. Rather than relying on signatures alone, its system learns the relationships and communication patterns between senders and recipients, which is how it aims to catch business email compromise, credential phishing, spearphishing and QR-code phishing. It can run on-premises, hybrid or in the cloud, and it can complement or replace a gateway or the protection built into Microsoft 365, which makes it unusually flexible to pilot next to whatever a company already runs.
This is a different job from a classic filter. A behavioural layer is built to catch the message that is syntactically clean, comes from a plausible address and asks someone to change a bank account number.
That is where signature-based gateways are weakest, and it is why xorlab is best read as an addition to a Microsoft 365 estate, or as the detection layer in front of a gateway, rather than as a drop-in replacement for archiving, continuity or encryption features that the suite vendors provide.
Cloud customer data is stated to be processed and stored in European data centres by Europe-based staff, which is a clearer statement than many in this list make.
It is a Swiss company, so it is outside the EU and the EEA but covered by an adequacy decision. There is no public price list, only a demo and an attack simulation on request, and no named certificate on the pages reviewed. The attack simulation is worth taking up, because it shows what the product catches in your own mail.
What xorlab does well
- Behavioural detection aimed at business email compromise and spearphishing
- Covers QR-code phishing and credential phishing
- Flexible deployment: on-premises, hybrid or cloud
- Cloud data stated to be processed in Europe by Europe-based staff
- Attack simulation available to test it on your own mail
Where xorlab falls short
- Swiss entity, outside the EU and the EEA
- No public price list
- No published security certificate on the pages reviewed
- Narrower than a full gateway with archiving and continuity
Standout feature. A behavioural model of who normally writes to whom, which catches fraud that a signature engine sees as perfectly clean.
Pros and Cons
Pros
- Behavioural detection aimed at business email compromise and spearphishing
- Covers QR-code phishing and credential phishing
- Flexible deployment: on-premises, hybrid or cloud
- Cloud data stated to be processed in Europe by Europe-based staff
- Attack simulation available to test it on your own mail
Cons
- Swiss entity, outside the EU and the EEA
- No public price list
- No published security certificate on the pages reviewed
- Narrower than a full gateway with archiving and continuity
Alternatives to xorlab
Frequently Asked Questions
What is xorlab?
xorlab AG in Zurich builds behavioural email security. Rather than relying on signatures alone, its system learns the relationships and communication patterns between senders and recipients, which is how it aims to catch business email compromise, credential phishing, spearphishing and QR-code phishing. It can run on-premises, hybrid or in the cloud, and it can complement or replace a gateway or the protection built into Microsoft 365, which makes it unusually flexible to pilot next to whatever a company already runs.
Where is xorlab based?
xorlab operates from Zurich, Switzerland, which places it under Switzerland (adequacy decision, outside the EEA).
What does xorlab cost?
No public price list; demo and attack simulation on request. Demo and attack simulation on request.
Who is xorlab best for?
Microsoft 365 estates worried about targeted phishing and fraud. A behavioural model of who normally writes to whom, which catches fraud that a signature engine sees as perfectly clean.
What are the drawbacks of xorlab?
Swiss entity, outside the EU and the EEA. No public price list. No published security certificate on the pages reviewed. Narrower than a full gateway with archiving and continuity.
Is xorlab a good alternative to Proofpoint?
xorlab is built as a European alternative to Proofpoint: Zurich behavioural-AI email security that learns sender relationships to catch BEC and spearphishing. It will not be a like-for-like feature match in every respect, so check the review above for where the two genuinely differ before switching.
How does xorlab compare to other Email Security & Anti-Phishing Software?
xorlab is one of several European Email Security & Anti-Phishing Software we cover. It is most often compared with Proofpoint, Abnormal Security, Microsoft Defender for Office 365.