Cybersecurity teams spend considerable resources building defenses, collecting logs, and developing detection rules. Yet a question often remains unanswered: Can those systems actually recognize the attacks they are supposed to catch?
The distinction matters as enterprises introduce more cloud services, AI applications, and AI-assisted development tools. Security environments are becoming more complicated, but the growing volume of telemetry does not guarantee that critical information is being collected or interpreted correctly. Logs can be missing, pipelines can fail silently, and detection rules can overlook malicious activity.
Brava Security wants to give organizations a way to test those assumptions. The company has emerged from stealth with $15 million in funding led by F2 Venture Capital and Pitango VC. Its multi-agent AI technology generates the exact telemetry an attack would produce without actually executing it, allowing enterprises to determine which attacks their existing defenses would miss. Axios was the first to report the news.
The platform also helps address the gaps it identifies, without requiring organizations to replace their current security infrastructure.
Replacing Assumptions With Evidence
The problem Brava addresses sits beneath the growing interest in AI-powered security operations. AI agents can investigate alerts and help security teams make decisions, but they depend on the evidence generated by an organization’s existing security systems.
If an attack never triggers an alert because the relevant telemetry was not collected, an AI agent has little to investigate. Brava’s argument is that organizations need to establish the reliability of their detection infrastructure before they can confidently automate more of their security operations.
“Everyone is racing to put AI in charge of the SOC. You can’t automate a decision based on evidence no one ever proved,” said Idan Basre, co-founder and CEO of Brava Security. “We’re solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it’s supposed to detect.”
Basre encountered the issue firsthand while leading product management for Microsoft Defender. His experience informs the company’s focus on identifying weaknesses in the security data and detection processes that enterprises already operate.
Understanding the Attack Before It Happens
Brava’s platform models attacker behavior and determines how different attack techniques would manifest across an organization’s environment. It then evaluates whether existing defenses would capture the resulting activity and identifies missing telemetry, ineffective detection rules, and other gaps.
The Security Operations platform can rewrite SIEM detections and data feeds that are blind to modeled attacks. It also investigates alongside security teams, bringing together evidence that helps them understand the weaknesses in their infrastructure.
The technology’s ability to generate telemetry without executing an attack is central to its approach. Rather than waiting for an actual incident to expose a detection failure, organizations can examine how their systems would respond to modeled attacker behavior.
“The hard part of security was never writing detections. It’s knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That’s the problem our models were built to solve,” said Itay Gabbay, co-founder and CTO of Brava Security.
Early Adoption Across Enterprise Markets
Brava is entering the market with customers that include Fortune 100 companies across retail, energy, and hospitality. Its customer list also includes Cushman & Wakefield and WELL Health, one of Canada’s largest healthcare companies.
The company has prioritized compatibility with existing enterprise security environments. Its platform integrates with Splunk, Google SecOps, CrowdStrike, and more than 70 other sources and destinations.
Deployment speed is another part of its offering. Brava says its first insights become available within 10–15 minutes of onboarding, allowing security teams to begin evaluating their findings without a lengthy implementation process.
Cushman & Wakefield CISO Erik Hart described the platform as part of the organization’s broader effort to apply AI to security operations.
“Our SecOps journey is about applying AI where it makes our people more effective, and Brava sits at the center of that. It investigates alongside our team, bringing evidence together so decisions rest on facts rather than on searching” said Hart.
Funding the Next Stage of Growth
Brava was founded by Basre and Gabbay, whose backgrounds combine security research and AI development. Basre is a Talpiot alumnus who spent ten years in Unit 8200 as a threat researcher before leading product management for Microsoft Defender. Gabbay spent seven years in the IDF building core AI systems, including work on a joint DARPA-Israeli research program.
The company has approximately 20 employees, including AI researchers and security researchers. Its R&D operations are based in Israel, while its commercial team is expanding across the United States.
The $15 million seed round also included angel investors, among them executives from Anthropic, Microsoft, and Check Point. Brava plans to use the capital to accelerate product development and expand commercially across North America, with financial services and government among its next target markets.
For Brava, the opportunity lies in making security performance something enterprises can demonstrate rather than simply assume. As AI takes on more responsibility in the SOC, that distinction could become increasingly important.