Brava Security Raises $15 Million to Test What AI Cyber Defenses Can Actually Detect

Brava Security has emerged from stealth with $15 million in seed funding to address a basic weakness in AI-assisted cyber defense: an automated analyst cannot investigate an attack if the underlying security systems never detect it.

The round was led by F2 Venture Capital and Pitango, with angel participation from executives at Anthropic, Microsoft, and Check Point. Brava plans to use the funding for product development and commercial expansion across North America, including opportunities in financial services and government.

The company’s approach is to generate the telemetry an attack would produce in a particular environment without carrying out the attack itself. It then checks whether existing defenses recognize that evidence and helps repair the gaps. That makes detection validation, rather than simply faster alert investigation, the center of its pitch.

Testing the Evidence Before an Incident

Security operations centers rely on telemetry: records of activity across endpoints, cloud environments, identities, and applications. A security information and event management system, or SIEM, collects and analyzes those records, using detection rules to identify suspicious behavior.

That process has several dependencies. The relevant system must produce a useful record, the pipeline must deliver it, and the detection must interpret the fields correctly. More logs do not automatically mean better coverage if the evidence needed for a particular attack is missing or unusable.

Brava says its multi-agent technology models attacker behavior and identifies how specific techniques should appear across a customer’s log sources. Its platform then tests whether those traces would trigger the intended defenses, rewrites missing SIEM detections and addresses data-feed gaps.

“You can’t automate a decision based on evidence no one ever proved,” said Idan Basre, Brava’s co-founder and CEO, who previously led product management for Microsoft Defender.

The distinction between generating evidence and executing an attack matters. Brava is testing the detection path through synthesized telemetry. That can help expose a silent rule or missing field, but a successful test is not proof that every variation of a real intrusion will be caught or that an attacker could not reach the system.

Closing the Loop Between a Rule and an Alert

Brava’s product workflow describes four stages: model the threat, synthesize its telemetry, verify and repair detection gaps, and replay the evidence to confirm an alert appears in the SIEM. It also describes retesting as environments change.

This is a useful distinction from treating an installed rule as verified coverage. A field rename, parser update, or disconnected source can leave a previously useful detection unable to match the activity it was written for. Repeating a test after a change helps determine whether the detection still works with the data it actually receives.

The platform is designed to work with existing security infrastructure. Brava lists Splunk, Google SecOps, CrowdStrike, and more than 70 sources and destinations, reducing the need to replace the tools a security team already operates.

For a detection engineer, the practical value is a more specific answer than a generic coverage score: which evidence should exist, which part of the detection path missed it, and whether the repair produced an alert. Those questions connect an engineering change to an observable result.

Investigation and Data Pipelines Share the Same Foundation

The company’s website adds two related capabilities. Aquarium, its investigation interface, plans searches across sources and links findings to underlying events. Its data-pipeline tooling parses and normalizes records, routes relevant events to the SIEM, and keeps other data in searchable lower-cost storage.

These functions address different parts of the same operational problem. An analyst needs evidence to reconstruct what happened, while a detection rule needs the right fields to fire. Reducing ingestion volume is useful only if the information necessary for detection and investigation remains available.

Brava’s release says the platform delivers initial insights within 10–15 minutes of onboarding. That is a company-reported time to first findings, rather than a guarantee that a complete enterprise deployment or every detection repair finishes within that window.

Enterprise Customers and a Team Built Around AI and Security

Brava reports Fortune 100 customers in retail, energy, and hospitality, alongside Cushman & Wakefield and Canadian healthcare company WELL Health. Cushman & Wakefield CISO Erik Hart said the platform investigates alongside his team and brings evidence together to support decisions.

The company was founded by Basre and CTO Itay Gabbay. Basre spent ten years in Unit 8200 as a threat researcher before his Microsoft role. Gabbay spent seven years building AI systems in the IDF, including work on a joint DARPA-Israeli research program.

Brava has approximately 20 employees, with research and development in Israel and a commercial team expanding in the United States. The funding backs a product that combines AI research with a demanding security-engineering task: modeling how attacks appear in the specific systems an enterprise uses.

The company’s premise is that autonomous security decisions need validated evidence beneath them. The strongest test of that premise will be sustained detection quality as customer environments change: fewer silent rules, fewer missing signals, and repairs that security teams can demonstrate actually work.