Spanish Startup 8Layers Has Raised $2.9 Million to Track Every Digital Identity Inside a Business
The Madrid company says its platform watches human accounts, software service accounts, and AI agents across cloud tools, then flags suspicious behaviour before it becomes a breach.
Key points
- 8Layers, a Madrid-based security startup, closed a $1.1 million pre-seed extension round in 2025, bringing its total early-stage funding to $2.9 million.
- New investors Criteria Venture Tech and Bankinter joined existing backers JME Ventures, Lanai Ventures, Draper B1, and Secways.
- The platform connects to identity providers such as Okta, Microsoft Entra ID, Google Workspace, and AWS IAM to build a full inventory of every account inside an organisation.
- 8Layers assigns each account a live risk score and can automatically contain accounts that show suspicious activity.
- The company plans to use the new money to expand its commercial presence across Europe.
Most companies have a rough idea of how many employees they have. They have almost no idea how many active digital accounts, automated software processes, and AI agents are running across their systems at any given moment. That gap is what 8Layers is selling against.
The Madrid startup announced this week that it has raised a $1.1 million extension to its pre-seed round, as first reported by SecurityWeek. Combined with earlier funding, the company has now taken in $2.9 million in total. Criteria Venture Tech and Bankinter provided the new capital. Both are from the financial sector, which the company's CEO Daniel Garcia Moran called pointed confirmation that digital identity security has moved up the priority list for serious institutions.
What does the platform actually do?
It builds a live map of every account that touches a company's systems. That includes the usual employee logins, but also service accounts (automated accounts that software uses to talk to other software), API keys (digital passcodes that let one application access another), and AI agents running in the background.
8Layers pulls that information by connecting through standard integration points to platforms like Okta, a popular login management service, and Microsoft Entra ID, Microsoft's tool for managing who can access what. It then watches how each account behaves over time.
If an account goes quiet for months and then suddenly starts pulling data at 2 a.m., that is the kind of signal the platform is designed to catch. The company calls the pattern an identity kill chain, meaning a sequence of small, individually unremarkable actions that together indicate an account has been taken over or misused. The platform assigns each account a risk score and can trigger containment steps automatically, for example revoking access, without waiting for a human to notice.
The platform also checks whether those account controls meet European compliance frameworks, the rules businesses must follow under regulations such as NIS2, the EU's network security directive.
If you work in IT or run a business, this is worth noting. Stolen or forgotten accounts are one of the most common ways criminals get inside a network. A service account created for a project three years ago, never deleted, with broad permissions, is a quiet gift to anyone who finds it.
The fresh investment will fund hiring and commercial expansion across Europe. 8Layers says it only recently launched its platform commercially, so this is early days.
What affected organisations should do: Audit your active accounts now. Disable anything dormant. Require every service account to have an owner. If you cannot name who is responsible for an account, treat it as a risk.
