Brava Security Raises $15 Million to Test Whether Security Tools Really Catch Attacks
Most security teams can tell you which tools they own. Far fewer can prove, on any given day, which attacks those tools would actually catch. That gap is the problem Brava Security set out to solve, and on November 4, 2026, the company stepped out of stealth with $15 million in seed funding to build its answer: a multi-agent AI platform that checks defenses by simulating what an attack would look like, without ever running the attack itself.
The round was led by F2 Venture Capital and Pitango, with angels including executives at Anthropic, Microsoft and Check Point, according to reports. Brava says the money will fund product development and North American growth, targeting financial services, government and energy, and it already reports working with Fortune 100 companies in retail, energy and hospitality.
The blind spot Brava wants to expose
Modern security operations centers, known as SOCs, rely heavily on automation. AI agents triage alerts and correlate events, but that automation only works when the detection layer is sound. If a log source goes silent or a rule breaks after a system change, the agent keeps working with an incomplete picture and may never notice what it missed.
Brava frames this as a visibility problem. A team can have skilled analysts and a well stocked toolset and still carry blind spots, because nobody has tested each detection against the evidence it should catch. Missing log collection, broken telemetry pipelines and flawed detection logic can each leave a hole that looks, from the dashboard, like quiet success: no alerts, because nothing was detected.
How the platform works
Brava describes a set of cooperating AI agents that model attacker behavior and generate the telemetry, the digital traces, that an attack would produce inside a specific customer environment. The key point is that no attack is actually executed. The platform builds a synthetic version of the evidence and then checks what the existing defenses do with it.
The process runs alongside the customer’s existing SIEM, the central system that collects security logs. A detection engineering function finds the rules that stay silent, writes missing detections in the SIEM’s own query language using only fields in the generated evidence, then replays that evidence to confirm a real alert fires. The platform does not just point at a gap. It drafts the fix and proves it works.
Scheduled test days, which Brava calls game days, repeat the validation after environments change. Evidence backed maps show which areas are validated, partly covered, blind, or lacking telemetry, and surfaced failures include broken detections, schema drift and dead log sources.
The cost angle: less data in the SIEM, not more
One striking claim concerns cost. SIEM pricing often scales with data volume, forcing a choice between full visibility and a manageable bill. Brava says its pipeline routes only the events detections need into the SIEM, moving the rest to searchable, lower cost storage instead of deleting it, and reports SIEM cost cuts of 65 to 85 percent across customers.
That range is a company reported figure, not an independently audited result, and savings will depend on how much redundant data a customer was sending to its SIEM. For large enterprises processing billions of events, even a modest reduction can translate into serious money.
Brava also reports, as company figures, more than 70 supported sources and destinations, including Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike NG-SIEM, Elastic Security and IBM QRadar, with initial insights 10 to 15 minutes after a SIEM is connected. Its rounded daily figures across customers, 2.4 trillion events read, 1,100 attack techniques replayed and 3,800 detections retested, have not been independently verified.
Who is behind Brava
The founders fit the product closely. Chief executive Idan Basre, based in New York, is a Talpiot alumnus who spent a decade researching attacker behavior in Unit 8200 before product leadership at Microsoft Defender, according to founder biographies. Chief technology officer Itay Gabbay, based in Tel Aviv, has led joint United States and Israeli DARPA AI research and enterprise AI security initiatives.
The company employs about 20 people, including AI and cybersecurity researchers, according to reports, with a research center in Israel and a commercial team expanding in the United States. The next test will be turning early Fortune 100 pilots into repeatable deployments.
A testimonial published by Brava quotes WELL Health chief information security officer Iain Paterson saying the platform helped his organization build a new SIEM in weeks. Vendor chosen testimonials show a product at its best, so buyers will want to see the same results in their own environments.
Why this funding round matters
Brava arrives as security teams are asked to trust AI agents with more responsibility, from triage to response. That trust has an overlooked precondition: the agent can only reason about what the defenses can see. An agent that confidently reports no threat when the real problem is a broken log pipeline discourages a second look.
Brava’s pitch is that evidence should come first: prove what defenses detect, fix what they miss, and keep retesting as the environment changes. The approach has limits, though. Simulated telemetry is only as good as the attack models behind it, and novel techniques may produce traces no model predicts, so Brava’s value will depend on how fast its models keep pace.
For now, the $15 million seed round gives Brava room to build out the platform and expand its North American team. Whether continuous detection validation becomes a standard SOC layer or stays a niche tool will be answered by customer renewals as deployments scale.
Post Comment