Mave Raises $28M Series A, Bringing Total Funding to $34M for Agentic SecOps

A suspicious login can leave clues in an identity platform, an endpoint tool, and a cloud account without any one system showing the whole incident. Mave is building AI agents to connect those clues where they already live. The Tel Aviv startup has announced $34 million in funding, including a $28 million Series A, to expand an agentic security operations platform that works across an enterprise’s existing tools.

Red Dot Capital Partners led the Series A, with participation from Lumir Growth Partners. The total also includes a $6 million seed round led by Dell Technologies Capital and Emerge Ventures. Mave will use the capital to advance its AI research, strengthen its enterprise products, and expand internationally.

The company’s pitch addresses a familiar security bottleneck: buying specialized tools does not automatically connect their findings. Mave aims to take on the investigation between those systems, then carry out responses within boundaries set by the security team.

Investigating Across the Stack Without Another Data Migration

Traditional security information and event management systems, or SIEMs, bring logs together so analysts can search for suspicious activity. But understanding an incident can require information beyond the collected logs: whether an account still has privileged access, who owns an asset, or how a system is configured at that moment.

Mave’s approach is to query connected tools in their native languages, retrieve context as an investigation develops, and reconcile the results. The company says customers do not have to move all their telemetry into another centralized database before using the platform.

Consider an investigation into a potentially compromised account. Checking the login alone may not reveal whether the user accessed a sensitive workload or whether a related endpoint showed unusual activity. A useful investigation has to connect identity, device, and application evidence. That example illustrates the work Mave is targeting: following the incident across systems rather than waiting for a person to assemble each connection manually.

This architecture could reduce the migration work associated with adopting another security platform. It still depends on the quality and accessibility of the connected evidence. Missing telemetry, restricted permissions, or unavailable APIs can limit what an investigator—human or automated—can establish.

A Combination of Small Models, Large Models, and Workflows

According to the release, Mave combines purpose-built workflows, fine-tuned small language models, and frontier large language models. The system uses that combination for high-volume tasks and more complex reasoning, while recording its queries, decisions, and actions.

The distinction matters because a security investigation is a sequence of operations, not simply a generated explanation. The system must decide which evidence to request, interpret the response, identify what remains unresolved, and determine whether another query or a response action is justified. Linking those steps to an inspectable record gives an analyst something more useful than a verdict alone.

Mave says it investigates all alerts within minutes, filters false positives, identifies relevant attack campaigns, and executes approved responses. These are the company’s stated capabilities; the announcement does not supply independent benchmark results or enough methodology to establish those performance levels across different customer environments.

“Security teams still investigate threats one tool at a time, manually piecing together evidence before they can reach a verdict. Attackers do not wait,” said Raziel Oren, Mave’s co-founder and CEO, in the announcement.

From Alert Investigation to Governed Response

Mave’s platform description adds detail beyond the funding release. Integrations connect through APIs and begin with read-only access. Its natural-language interface lets teams search across connected systems, while the underlying operations are described as deterministic, repeatable steps that users can inspect.

The website also lists federated search, threat hunting, and detection engineering. Detection work includes identifying noisy or broken rules and proposing or applying adjustments. This expands the proposition beyond clearing an alert queue: findings from investigations can inform searches for related activity and improvements to future detection.

On its website, Mave says destructive actions require approval by default, permissions are scoped by platform, and teams decide what runs automatically. It also supports adding organizational context such as policies, ownership information, and exceptions. Those controls help distinguish retrieving evidence from having authority to change a production system.

That distinction is increasingly consequential as AI tools gain access to enterprise workflows. As Unite.AI’s coverage of AI agents becoming targets for phishing explains, the content an agent encounters and the actions its permissions allow are separate security concerns. For defensive agents, the same boundary makes approval rules and an audit trail central to deployment.

Commercial Traction and the Next Stage of Growth

Founded in 2025 by Oren and CTO Guy Eshel, Mave has grown to 20 employees. Oren previously led go-to-market at Wing Security, while Eshel was Alterya’s first employee and later its vice president of research and development before the company’s acquisition by Chainalysis. Both founders previously served in Israel’s Unit 8200.

Mave says its customers include large enterprises and managed security service providers, with deployments in regulated financial and healthcare environments. Its public launch announcement says the platform is running in more than 200 security operations centers. The release also reports seven-figure deals and annual recurring revenue growth of more than 400% over the past year, without disclosing an absolute ARR figure.

The platform is generally available, and the company plans to more than double its workforce, focusing hiring on AI research and go-to-market roles. The new financing gives Mave room to develop both the reasoning behind investigations and the enterprise controls around their execution.

For customers, the opportunity is to get more value from security systems they already operate. Mave’s next test is turning that promise into repeatable investigations and appropriately controlled responses across varied environments, where faster decisions need to remain grounded in evidence.