The cybersecurity industry is moving toward a future where AI agents handle more of the work traditionally performed by security operations teams. But while organizations are investing in automated investigations and faster incident response, an important part of the equation remains unresolved: whether their security infrastructure is actually detecting the threats in the first place.
Missing logs, broken telemetry pipelines, and ineffective detection rules can leave organizations with blind spots that AI agents cannot overcome. An agent may investigate an alert in seconds, but it cannot investigate an attack that never generated one.
Brava Security is building technology around that problem. The company has emerged from stealth with $15 million in funding led by F2 Venture Capital and Pitango VC. Its platform uses multi-agent AI technology to generate the exact telemetry an attack would produce without executing the attack itself. The news was first reported by Axios.
The objective is to help enterprises establish which threats their existing defenses would miss, identify the reasons behind those failures, and correct detection gaps without replacing their current security infrastructure.
Making Detection Measurable
Brava’s approach starts with modeling attacker behavior and understanding how specific attack techniques would appear across an organization’s environment.
Its Security Operations platform determines what an attack should look like across different log sources, evaluates whether existing defenses would detect it, and identifies the gaps that prevent the necessary evidence from reaching security teams. It can then rewrite SIEM detections and data feeds that are blind to the modeled activity.
This is particularly relevant as enterprises introduce more cloud services, AI applications, and AI-assisted development tools. More infrastructure creates more telemetry to manage, but collecting additional data does not automatically translate into better detection.
“Everyone is racing to put AI in charge of the SOC. You can’t automate a decision based on evidence no one ever proved,” said Idan Basre, co-founder and CEO of Brava Security. “We’re solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it’s supposed to detect.”
Basre encountered these challenges while leading product management for Microsoft Defender. His experience helped shape Brava’s focus on proving whether security infrastructure works as expected rather than assuming that deployed detection rules provide adequate coverage.
From Attack Simulation to Security Operations
The platform’s ability to generate attack-related telemetry without actually executing attacks is central to its differentiation. Instead of relying on assumptions about how a particular attack might appear, Brava models the behavior and examines the evidence it would generate in a customer’s environment.
Co-founder and CTO Itay Gabbay believes the difficulty lies in understanding how attacks translate into data across different enterprise systems.
“The hard part of security was never writing detections. It’s knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That’s the problem our models were built to solve,” said Gabbay.
Beyond evaluating detection capabilities, Brava’s platform investigates alongside security teams. Its goal is to bring evidence together, identify weaknesses, and help improve the systems responsible for recognizing threats.
Enterprise Customers and Existing Integrations
Brava has already signed Fortune 100 companies across retail, energy, and hospitality. Its customers also include Cushman & Wakefield and WELL Health, one of Canada’s largest healthcare companies.
The platform integrates with Splunk, Google SecOps, CrowdStrike, and more than 70 other sources and destinations. Brava says customers receive their first insights within 10–15 minutes of onboarding, allowing security teams to begin evaluating findings without a lengthy deployment process.
At Cushman & Wakefield, CISO Erik Hart described how the platform supports the organization’s broader approach to AI in security operations.
“Our SecOps journey is about applying AI where it makes our people more effective, and Brava sits at the center of that. It investigates alongside our team, bringing evidence together so decisions rest on facts rather than on searching” said Hart.
Funding the Next Stage
Brava was founded by Basre and Gabbay, whose backgrounds span military security research, enterprise cybersecurity, and AI development. Basre spent ten years in Unit 8200 as a threat researcher before leading product management for Microsoft Defender. Gabbay spent seven years in the IDF building core AI systems, including work on a joint DARPA-Israeli research program.
The company has approximately 20 employees, combining AI researchers and security researchers. Its R&D operations are based in Israel, while its commercial team is expanding across the United States.
The $15 million seed round also included angel investors, among them executives from Anthropic, Microsoft, and Check Point. Brava plans to use the capital to accelerate product development and commercial expansion across North America, with financial services and government among its next target markets.
As AI becomes more involved in cybersecurity, Brava is betting that organizations will need to establish a stronger foundation for automated decision-making: security evidence they can actually trust.
