Infrawatch, a cybersecurity startup building an internet infrastructure intelligence platform, has raised a £2.2 million pre-seed round led by Outward VC and Triple Point Ventures, with participation from Portfolio Ventures and fintech and cyber angel investors. Founded by Lloyd Davies and built by a team of CrowdStrike, Recorded Future, and Intel 471 alumni, Infrawatch gives security, fraud, and investigations teams real-time visibility into the infrastructure powering cyberattacks, fraud and scams, phishing, and online abuse.
Built around the idea that malicious infrastructure leaves persistent traces even as attackers change tactics and payloads, the platform combines large-scale intelligence collection with real-time classification to help organisations move from reactive monitoring to pre-emptive defence. Processing tens of billions of events per day, Infrawatch helps organisations understand internet infrastructure behaviour, identify operators, and determine whether infrastructure should be trusted. Alongside more than 1,000 out-of-the-box detection rules, the platform also enables customers to create custom detections to track threats relevant to their organisations.
The funding will support expansion of Infrawatch’s engineering and research teams, accelerated platform development ahead of a general launch later this year, early enterprise customer deployments, and expansion into the United States following inbound interest from security, fraud, and intelligence teams.
Davies founded Infrawatch after working in PwC’s security intelligence team and CrowdStrike’s specialist team focused on nation-state threats. The business said it will continue publishing security intelligence research using its own intelligence capabilities, following an April investigation into a Belarus-based SIM-Farm-as-a-Service provider linked to operators across 17 countries.
I know from first-hand experience how broken infrastructure intelligence is today: fragmented data, noisy feeds, and taped-together workflows, where ‘real-time’ detection often means static daily updates in practice. Enterprises cannot keep up by patching together narrow intelligence feeds while the internet changes beneath them. That is why we built Infrawatch from the ground up: to turn one of the most underutilised aspects of cybersecurity into a practical defence layer that empowers defenders to act earlier and stop threats before they reach their customers, users or systems.
While AI lowers the bar to carrying out cyber crime and drives up attack volumes, attackers at scale still depend on infrastructure to operate. We think Infrawatch offers the very best solution for society's critical organisations to identify, understand, and disrupt that infrastructure. Lloyd and team have the depth of knowledge, experience, and technical ability to shake up the industry with a solution defenders desperately need to keep companies and people protected. We're proud to back that vision.
Hostile actors can spin up anonymised attack infrastructure in minutes, yet defenders often take months to discover a breach. That imbalance is impacting virtually every industry, and Infrawatch's real-time detection of adversarial infrastructure at source tackles it head-on. The inbound enterprise interest generated, with zero outbound sales or marketing, is both remarkable and indicative of the compounding scale of this problem. Lloyd and his team bring the rare combination of technical excellence, operational grit and domain obsession that this challenge demands and we are excited to support them as they build a category defining company.
