Cyber security firm Infrawatch raises £2.2m from Outward VC and Triple Point Ventures
This article covers Infrawatch, a cybersecurity startup that has raised £2.2m in a pre-seed funding round co‑led by Outward VC and Triple Point Ventures to build an Internet Infrastructure Intelligence Layer. The funding will support product development, early enterprise deployments and expansion into the United States, and the platform aims to give security, fraud and investigations teams real-time visibility into the infrastructure behind cyberattacks, phishing and online abuse.
Infrawatch, a cybersecurity startup, has raised £2.2m in a pre-seed funding round co-led by Outward VC and Triple Point Ventures to build what it calls an Internet Infrastructure Intelligence Layer — a platform designed to give security, fraud and investigations teams real-time visibility into the infrastructure behind cyberattacks, phishing and online abuse. The funding will support product development, early enterprise deployments and expansion into the United States.
Why it matters
Security teams increasingly face high-volume, automated attacks and dispersed threat feeds that are hard to correlate. Infrawatch’s premise is that while attackers change accounts and payloads, the infrastructure they rely on — servers, domains, SIM farms and other plumbing — leaves persistent traces that can be mapped and acted on earlier. If that claim holds in practice, it could help organisations move from reactive detection to earlier mitigation of campaigns before they scale.
The raise also signals continued investor interest in UK cybersecurity tools that focus on operational visibility rather than point-in-time indicators, and it comes at a time when both enterprise demand and geopolitical tensions are driving higher spend on threat intelligence.
Inside the product
Infrawatch says its platform processes tens of billions of events per day, applies real-time classification and ships more than 1,000 out-of-the-box detection rules. Teams can create custom detections, which the company positions as a way to reduce reliance on fragmented feeds and to surface behaviour patterns, attribution signals and trust assessments about internet infrastructure.
The founding team includes alumni from CrowdStrike, Recorded Future and Intel 471, bringing threat research and incident response experience. Infrawatch also publishes original investigations; in April it published research that traced a Belarus-based “SIM-Farm-as-a-Service” provider allegedly linked to operators across 17 countries, an example of the kind of infrastructure activity the product aims to expose.
Who are the investors?
The round was co-led by Outward VC and Triple Point Ventures, with participation from Portfolio Ventures and a group described as leading fintech and cyber angel investors. Total disclosed funding is £2.2m.
Investors cited the persistent reliance attackers have on infrastructure as the rationale for backing Infrawatch and emphasised the team’s domain expertise and technical capability.
In the announcement, Sam Stone, an investor at Triple Point Ventures, said:
While AI lowers the bar to carrying out cyber crime and drives up attack volumes, attackers at scale still depend on infrastructure to operate. We think Infrawatch offers the very best solution for society's critical organisations to identify, understand, and disrupt that infrastructure. Lloyd and team have the depth of knowledge, experience, and technical ability to shake up the industry with a solution defenders desperately need to keep companies and people protected. We're proud to back that vision.
In the announcement, Andi Kazeroonian, principal at Outward VC, said:
Hostile actors can spin up anonymised attack infrastructure in minutes, yet defenders often take months to discover a breach. That imbalance is impacting virtually every industry, and Infrawatch's real-time detection of adversarial infrastructure at source tackles it head-on. The inbound enterprise interest generated, with zero outbound sales or marketing, is both remarkable and indicative of the compounding scale of this problem. Lloyd and his team bring the rare combination of technical excellence, operational grit and domain obsession that this challenge demands and we are excited to support them as they build a category defining company.
If you're researching potential backers in this space:
- Explore our list of cyber security venture capital firms in the UK
- Browse our directory of cyber security angel investors in the UK
Founder perspective
Lloyd Davies founded Infrawatch after roles in PwC’s security intelligence team and CrowdStrike’s specialist team focused on nation-state threats. The product vision stems from those operational experiences and a view that current infrastructure intelligence is fragmented and slow.
In the announcement, Lloyd Davies, Founder and CEO of Infrawatch, said:
I know from first-hand experience how broken infrastructure intelligence is today: fragmented data, noisy feeds, and taped-together workflows, where ‘real-time’ detection often means static daily updates in practice. Enterprises cannot keep up by patching together narrow intelligence feeds while the internet changes beneath them. That is why we built Infrawatch from the ground up: to turn one of the most underutilised aspects of cybersecurity into a practical defence layer that empowers defenders to act earlier and stop threats before they reach their customers, users or systems.
The bigger picture
The funding sits within a broader trend of UK cybersecurity startups seeking to commercialise specialist threat research and operational tooling. Investors are showing appetite for businesses that can scale telemetry collection and deliver signal amid noisy data, particularly as AI tools both enable new attack techniques and increase attack volumes.
Infrawatch’s plan to expand to the US reflects a common trajectory for UK security companies pursuing larger enterprise customers and incident-response teams. If the platform delivers reliable, low‑latency infrastructure signals, it may complement rather than replace existing intelligence feeds used by large organisations and managed security providers.
The deal is another data point in the strengthening cycle for early-stage cybersecurity investment in the UK and Europe, where technical depth and research-led products remain key differentiators for founders seeking growth capital.
They've invested in Infrawatch
Get to know these cyber security investors
Click here for a full list of 7,589+ startup investors in the UK