Spanish Startup 8Layers Has Raised $2.9 Million to Track Every Digital Identity Inside a Business
The Madrid company says its platform watches human accounts, software service accounts, and AI agents across cloud tools, then flags suspicious behaviour before it becomes a breach.
Key points
- 8Layers, a Madrid-based security startup, closed a $1.1 million pre-seed extension round in 2025, bringing its total early-stage funding to $2.9 million.
- New investors Criteria Venture Tech and Bankinter joined existing backers JME Ventures, Lanai Ventures, Draper B1 and Secways.
- The platform connects to identity providers such as Okta, Microsoft Entra ID, Google Workspace and AWS IAM to build a full inventory of every account inside an organisation.
- 8Layers assigns each account a live risk score and can automatically contain accounts that show suspicious activity.
- The company plans to use the new money to expand its commercial presence across Europe.
Most companies have a rough idea of how many employees they have. They've almost no idea how many active accounts, automated software processes or AI agents are running across their systems at any given moment. That gap is what 8Layers is selling against.
The Madrid startup announced this week that it has raised a $1.1 million extension to its pre-seed round, as first reported by SecurityWeek. Combined with earlier funding, the company has now taken in $2.9 million in total. Criteria Venture Tech and Bankinter provided the new capital. Both come from the financial sector, which CEO Daniel Garcia Moran called confirmation that digital identity security has moved up the priority list for serious institutions.
What does the platform actually do?
It builds a live map of every account that touches a company's systems: employee logins, service accounts (automated accounts that software uses to talk to other software), API keys (digital passcodes that let one application access another), and AI agents running in the background.
8Layers connects through standard API integrations to platforms like Okta, a popular login management service, and Microsoft Entra ID, Microsoft's tool for managing who can access what. It then watches how each account behaves over time.
If an account goes quiet for months and then suddenly starts pulling data at 2 a.m., that's the kind of signal the platform is built to catch. 8Layers calls the pattern an identity kill chain: a sequence of small, individually unremarkable actions that together indicate an account has been taken over or misused. Each account gets a risk score, and the platform can trigger containment steps automatically, revoking access without waiting for a human to notice.
It also checks whether account controls meet European compliance frameworks, including NIS2, the EU's network security directive.
Should you worry about forgotten accounts?
Yes, and it's not a theoretical problem. Stolen or forgotten accounts are one of the most common entry points for criminals. As we found reporting on account takeover trends on 25 June 2026, compromised credentials remain among the cheapest assets on criminal marketplaces. A service account created for a project three years ago, never deleted, with broad permissions, is a quiet gift to anyone who finds it.
Audit your active accounts. Disable anything dormant. Require every service account to have a named owner. If you can't identify who's responsible for an account, treat it as a risk.
The fresh investment will fund hiring and commercial expansion across Europe. 8Layers says it only recently launched its platform commercially, so this is early days.
