Por Daniel García Morán, Co-Founder & CEO 8Layers
Recently we shared that we have extended our pre-seed round with an additional €1 million, bringing the total we have raised by far to €2.5 million. The extension welcomes two new investors from the Spanish financial sector: Criteria Venture Tech, the venture capital arm of CriteriaCaixa, and Bankinter. They join the investors: JME Ventures, who led the round, together with Lanai Ventures, Draper B1 and Secways.
We want to use this post to explain something more interesting than the number itself: what the money is for, and why the people writing the checks are who they are.
What this round says about the problem
It is not a coincidence that two players from the financial sector chose to invest in 8Layers. At the end, they live, every day, with the reality that identity has become the primary way attackers get in. Credentials are stolen, sessions are hijacked, service accounts are abused, and the regulatory expectations around all of this keep rising. When institutions from that world decide to put their own capital into the problem, it tells us we are building the right thing, and that the people closest to the pain agree.
That is the part we are proudest of. This round becomes a validation from inside the sector we set out to serve.
Detection and response, built for the hardest environments
From the beginning, we designed 8Layers for organizations where identities can be under constant attack and every hour of exposure matters: financial institutions, large enterprises, public administration. In these environments the real question is not only how well you are configured, but how fast you can see an attack forming and act on it before it reaches its goal.
By correlating events scattered across cloud identities, sessions and resources, 8Layers surfaces threats as they unfold and helps teams respond earlier in the attack, cutting the dwell time that lets intruders operate unseen. Underneath it, a posture layer continuously strengthens the security of every identity, reducing the surface an attacker has to work with in the first place. Detection and response deal with the threat in motion; posture keeps that threat from having easy ways in.
Compliance follows from all of this. Because the platform already validates the technical state of your identities against real security baselines, demonstrating alignment with frameworks like Spain's ENS, the EU's NIS2 directive and ISO 27001 becomes a natural output of the model. A single technical check can map to the identity requirements of several frameworks at once, and readiness stays continuous instead of turning into a scramble in the weeks before an audit. For a regulated organization, that turns security and compliance from two spreadsheets that never agree into one live picture of reality.
What the capital is really for
Our platform has been commercially available since May 2026, and this investment is here to support that next phase: bringing it to more of the organizations that need it and continuing to build it out now that it is in the market. Reaching General Availability is a milestone, but for us it is not a finish line. The capital lets us support the customers adopting the platform today and keep investing in the foundation underneath it.
And that foundation is the part we care most about, because it is what makes the platform different. We did not build detection on top of a log pipeline the way much of the industry does. We built our own data layer, designed around an inventory model from the start. It is what powers Thor, our Identity Threat Detection and Response (ITDR) platform. The distinction sounds technical, but it is the whole point.
An inventory is not a pile of raw logs. It is a finite, structured, high-quality set of the identity data that actually matters, organized so that search and correlation are fast and complete. Think of the difference between storing fifty years of security-camera footage you would have to scrub frame by frame, and keeping a structured record that already knows who entered, when, and whether the person on camera matched the badge that was used. The second one is smaller, cleaner, and instantly answerable across any time range.
When your foundation is built that way, correlations that are impractical for log-based tools become natural. You can connect an event from this morning to a pattern from a year ago, because the whole history is structured and available, not buried in cold storage. That is what lets us detect the slow, patient attacks that others simply time out on. And it is what lets us go a step further, correlating detections that are themselves the result of prior correlations, so that a full attack campaign shows up as one story rather than a scatter of disconnected alerts.
Where we go from here
The platform has been commercially available since May 2026, and this capital goes entirely toward bringing it to more of the organizations that need it across Europe. We are grateful to the investors who backed the thesis early, and to the new partners from the financial sector who have now doubled down on it with us.
The identity problem is not going away. Human identities are multiplying, non-human identities are multiplying faster, and AI agents are adding an entirely new category of access that most organizations cannot yet see. We intend to meet that problem where it actually lives: at the core.
If you want to understand how 8Layers approaches identity security for your environment, the team is here to talk. Contact us.