Infrawatch Lands $3M to Accelerate Platform Development

The big picture: London-based Infrawatch has secured $3 million in a pre-seed funding round, co-led by Outward VC and Triple Point Ventures, with additional backing from Portfolio Ventures and angel investors. The capital will support team growth, accelerate platform development ahead of a general launch in 2026, and enable early enterprise deployments in the US for its unified cyber intelligence platform. The company, founded by Lloyd Davies, processes tens of billions of events daily, classifying internet infrastructure linked to cyberattacks and fraud. Infrawatch aims to provide a single view of attacker infrastructure, addressing a common problem Davies observed during his time at CrowdStrike and PwC.

Why it matters:

• Fragmented Security Landscape: Security and fraud teams currently rely on multiple, separate intelligence feeds for DNS intelligence, IP reputation, VPN detection, and phishing monitoring, leading to a fragmented and inefficient approach to threat detection.
• Real-time Intelligence Gap: Existing solutions often lack real-time updates and a unified view of attacker infrastructure, limiting their effectiveness against rapidly evolving cyber threats.
• Evolving Threat Vectors: The rise of AI agents acting on behalf of users and increased state censorship driving alternative routing and VPN usage are creating new challenges in internet infrastructure monitoring, demanding more sophisticated and integrated intelligence.

How it works:

• Unified Intelligence Layer: Infrawatch’s platform replaces multiple disparate tools by offering a single, comprehensive intelligence layer that provides a unified view of internet infrastructure connected to malicious activity.
• Multi-Source Data Collection: The engine combines several data-collection methods, including passive DNS, active scanning, honeypot networks, and proprietary infrastructure, all designed to reinforce each other for robust threat detection.
• Extensive Detection Capabilities: The platform processes tens of billions of events daily, classifying IP addresses, domains, proxies, VPNs, and command-and-control servers, utilizing over 1,000 detection rules and allowing for custom threat tracking.

The catch: While Infrawatch aims to unify a fragmented market, it enters a competitive landscape with established players like Recorded Future and GreyNoise, which, despite their limitations, hold significant market share. The planned US launch in late 2026 or 2027 suggests a prolonged period before full market penetration and widespread adoption. Additionally, the company acknowledges a lack of diversity within its current team, a common industry challenge that could impact broader perspectives in product development and market understanding.