Cybersecurity threats are evolving faster than ever, with attackers constantly changing domains, accounts, phishing campaigns, and malicious tactics to avoid detection. Yet behind many of these attacks lies a deeper layer of internet infrastructure that often remains overlooked. Servers, hosting networks, domain patterns, and operational behaviours can reveal connections between cybercriminal activities long before attacks fully scale. London based cybersecurity startup Infrawatch is building technology designed to map and monitor that hidden infrastructure layer, and investors are backing the company with fresh funding.
Infrawatch has raised $3 million in a pre seed funding round co led by Outward VC and Triple Point Ventures, with participation from Portfolio Ventures and a group of fintech and cybersecurity angel investors.
Building an Internet Infrastructure Intelligence Layer
Founded by Lloyd Davies, the company was built by a team that previously worked at cybersecurity and intelligence firms including CrowdStrike, Recorded Future, and Intel 471.
Infrawatch describes its platform as an Internet Infrastructure Intelligence Layer designed to support cybersecurity operations, fraud prevention, and online investigations.
The startup focuses on identifying and monitoring the internet infrastructure that underpins cyberattacks, phishing campaigns, scams, and other forms of online abuse.
According to the company, attackers frequently change visible elements such as user accounts, malware payloads, and phishing content. However, the underlying infrastructure they depend on often leaves patterns that can be analysed and tracked across large datasets.
Processing Billions of Internet Events
Infrawatch says its platform processes tens of billions of internet events every day in order to generate real time infrastructure intelligence.
The system analyses internet scale data to provide organisations with visibility into infrastructure behaviour, trustworthiness indicators, and possible operator relationships associated with suspicious activity.
The platform also allows security teams to build custom detection rules while accessing pre built monitoring capabilities designed to identify infrastructure linked to cyber threats and online fraud.
By focusing on infrastructure intelligence rather than only surface level threat indicators, the company believes organisations can detect malicious activity earlier and respond before attacks impact customers or systems.
Addressing Fragmented Threat Intelligence
According to Lloyd Davies, one of the major problems in cybersecurity today is that infrastructure intelligence remains highly fragmented across disconnected data sources and workflows.
Davies said many organisations still rely on noisy intelligence feeds and fragmented systems that fail to deliver genuinely real time threat visibility as internet infrastructure evolves rapidly beneath them.
He explained that Infrawatch was created to transform one of the most underutilised areas of cybersecurity into a practical operational defence layer capable of helping security teams act earlier against emerging threats.
The company believes infrastructure intelligence can become increasingly important as cyberattacks grow more automated, distributed, and difficult to track using traditional security approaches alone.
Expanding Ahead of Public Launch
The newly secured funding will support Infrawatch’s next stage of growth, including expansion of its engineering and research teams.
The company also plans to continue developing its platform ahead of a planned public launch later this year while supporting early enterprise deployments and expansion into the United States market.
Growing Demand for Cyber Intelligence Infrastructure
As businesses face increasing threats from phishing, fraud, ransomware, and large scale online abuse campaigns, demand for more proactive cybersecurity intelligence systems continues growing.
Traditional cybersecurity tools often focus on responding to attacks after they become visible. Infrawatch is positioning itself within a newer category of cybersecurity companies focused on analysing the infrastructure patterns behind attacks in order to identify threats earlier.
By combining internet scale visibility with real time intelligence analysis, the company aims to provide organisations with deeper operational insight into the infrastructure powering modern cyber threats before they escalate further.
