Enterprise cybersecurity has a visibility problem that becomes harder to ignore as organizations introduce more automation. Security teams deploy monitoring tools, build detection rules, and collect enormous amounts of telemetry. Yet they often have no reliable way to establish whether their systems would recognize the attacks they are designed to stop.
That uncertainty becomes particularly consequential as companies move toward AI-powered security operations. An AI agent can investigate suspicious activity, correlate evidence, and support incident response, but its effectiveness depends on whether the underlying infrastructure captures the relevant information.
Brava Security wants to change how enterprises approach that problem. The company has emerged from stealth with $15 million in funding led by F2 Venture Capital and Pitango VC, introducing a multi-agent AI platform designed to generate the exact telemetry an attack would produce without actually executing it. Axios first reported the funding news.
Rather than asking organizations to trust that their security infrastructure is working, Brava aims to demonstrate where it succeeds, where it fails, and what needs to change.
Finding the Weaknesses Before Attackers Do
The challenge is not necessarily a shortage of security products. As enterprises expand their use of cloud services, AI applications, and AI-assisted development tools, their security environments generate increasingly large amounts of data. However, critical logs may never be collected, telemetry pipelines can silently break, and detection rules may overlook the very attacks they were designed to identify.
These gaps can leave security teams operating with an incomplete understanding of their exposure. The problem also creates limitations for organizations looking to automate investigations, since an AI agent cannot analyze evidence that was never generated.
Brava co-founder and CEO Idan Basre encountered this challenge firsthand while leading product management for Microsoft Defender. He believes the industry needs to address the reliability of security evidence before handing more responsibilities to AI.
“Everyone is racing to put AI in charge of the SOC. You can’t automate a decision based on evidence no one ever proved,” said Basre. “We’re solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it’s supposed to detect.”
Turning Attacker Behavior Into Measurable Evidence
Brava’s technology takes a different approach to evaluating security defenses. Its platform models attacker behavior and determines how specific attack techniques would manifest across an organization’s environment and available log sources.
The company’s Security Operations platform identifies what an attack should look like, evaluates whether existing defenses would detect it, and addresses the weaknesses it uncovers. This includes rewriting SIEM detections and data feeds that fail to capture the modeled activity.
An important distinction is that Brava generates the telemetry associated with an attack without actually executing it. This allows organizations to examine detection capabilities without having to carry out the underlying attack.
For co-founder and CTO Itay Gabbay, the challenge is understanding the relationship between an attack and the evidence it leaves behind.
“The hard part of security was never writing detections. It’s knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That’s the problem our models were built to solve,” said Gabbay.
The platform also investigates alongside security teams, bringing together information that can help them understand what their infrastructure is detecting and where its visibility falls short.
Enterprise Adoption Without Replacing Existing Tools
Brava is entering the market with an existing customer base that includes Fortune 100 companies across retail, energy, and hospitality. The company has also signed Cushman & Wakefield and WELL Health, one of Canada’s largest healthcare companies.
Its integration strategy is designed around the security infrastructure enterprises already use. The platform connects with Splunk, Google SecOps, CrowdStrike, and more than 70 other sources and destinations.
Brava also says its first insights become available within 10–15 minutes of onboarding. That timeline is intended to help organizations begin evaluating findings without going through a lengthy deployment process.
Cushman & Wakefield CISO Erik Hart described the platform as part of the company’s effort to apply AI in ways that improve the effectiveness of its security personnel.
“Our SecOps journey is about applying AI where it makes our people more effective, and Brava sits at the center of that. It investigates alongside our team, bringing evidence together so decisions rest on facts rather than on searching” said Hart.
$15 Million to Scale the Technology and Commercial Operations
The $15 million seed round was led by Pitango and F2 Venture Capital, with participation from angel investors, including executives from Anthropic, Microsoft, and Check Point.
Brava was founded by Basre and Gabbay, bringing together backgrounds in security research and AI development. Basre spent ten years in Unit 8200 as a threat researcher before leading product management for Microsoft Defender. Gabbay spent seven years in the IDF building core AI systems, including work on a joint DARPA-Israeli research program.
The company has approximately 20 employees, combining AI researchers and security researchers. Its R&D operations are based in Israel, while its commercial team is expanding across the United States.
The new capital will support technology development and commercial expansion across North America, with financial services and government among the additional markets Brava is preparing to pursue.
As AI becomes more involved in security operations, Brava is betting that the next step in cybersecurity automation will depend on proving that the systems behind those decisions can actually see the threats.
