Brava Raises $15M as It Builds an Evidence Layer for the Modern SOC

New York, United States, November 4th, 2026, FinanceWire

The growing adoption of artificial intelligence in cybersecurity has created new expectations for security operations centers. AI agents are increasingly being positioned to investigate alerts, analyze activity, and support decisions that once required extensive manual work.

However, there is a foundational issue beneath this shift. AI-driven security operations are only as useful as the information available to them.

An attack that goes unnoticed by an organization's security infrastructure may never generate an alert. A broken telemetry pipeline or an ineffective detection rule can prevent critical evidence from reaching the systems responsible for investigating threats.

Brava Security is building its business around this problem. The company has emerged from stealth with $15 million in funding led by F2 Venture Capital and Pitango VC, introducing a multi-agent AI technology designed to generate the telemetry an attack would produce without actually executing it. Axios first reported the news.

The platform helps enterprises determine which attacks their defenses would miss, identify the gaps responsible, and improve detection capabilities without requiring them to replace their existing security infrastructure.

Why More Security Data Does Not Guarantee Better Detection

Enterprise security environments are becoming increasingly complicated. Cloud services, AI applications, and AI-assisted development tools are adding new layers of activity that security teams must monitor.

At the same time, organizations need to ensure that the information generated across these environments is properly collected and made available to their security tools.

Brava's thesis is that many organizations lack a reliable way to verify whether their detection infrastructure is performing as expected. Security teams may have extensive logging capabilities and numerous detection rules, but that does not necessarily establish that they can recognize the attacks those systems are supposed to catch.

This becomes particularly relevant as companies attempt to automate more security workflows.

“Everyone is racing to put AI in charge of the SOC. You can't automate a decision based on evidence no one ever proved,” said Idan Basre, co-founder and CEO of Brava Security, who encountered the problem firsthand while leading product management for Microsoft Defender. “We're solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it's supposed to detect.”

For Brava, the objective is to address the quality and completeness of security evidence before organizations place greater responsibility on AI agents.

Modeling Attacks Through Their Telemetry

Brava approaches the challenge by modeling attacker behavior and examining how specific techniques would appear within an organization's environment.

Its Security Operations platform is designed to understand the telemetry associated with an attack across different log sources. It can then evaluate whether existing defenses would detect the modeled activity, identify missing data feeds or ineffective SIEM detections, and rewrite the components that are blind to the threat.

The technology's defining feature is its ability to generate the telemetry an attack would produce without executing the attack itself.

This gives security teams a way to evaluate detection coverage without having to rely exclusively on assumptions about their infrastructure.

According to co-founder and CTO Itay Gabbay, the challenge extends beyond the technical process of writing detection rules.

“The hard part of security was never writing detections. It’s knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That’s the problem our models were built to solve,” said Gabbay.

The platform also investigates alongside security teams, bringing evidence together to support their work. Rather than operating as a replacement for the tools already deployed, Brava is designed to work across existing security environments.

Early Enterprise Adoption

Brava's initial commercial traction includes Fortune 100 companies operating across retail, energy, and hospitality. The company has also named Cushman & Wakefield and WELL Health, one of Canada's largest healthcare companies, among its customers.

Deployment speed is another part of the company's offering. Brava says its platform delivers initial insights within 10–15 minutes of onboarding, giving security teams an opportunity to begin evaluating findings without a lengthy implementation process.

Its integrations include Splunk, Google SecOps, CrowdStrike, and more than 70 additional sources and destinations.

At Cushman & Wakefield, CISO Erik Hart highlighted the platform's role in helping the security team consolidate information and make decisions based on evidence.

“Our SecOps journey is about applying AI where it makes our people more effective, and Brava sits at the center of that. It investigates alongside our team, bringing evidence together so decisions rest on facts rather than on searching,” said Hart.

The customer example reflects the company's focus on making security teams more effective while working with their existing operational environments.

The People Behind the Technology

Brava's founding team combines experience in cybersecurity research, enterprise security products, and AI systems.

Basre spent ten years in Unit 8200 as a threat researcher after graduating from the Talpiot program. He subsequently led product management for Microsoft Defender, where he saw how limited access to security data could constrain incident investigations.

Gabbay spent seven years in the IDF developing core AI systems, including work on a joint DARPA-Israeli research program.

The company has grown to approximately 20 employees, with a team combining AI researchers and security researchers. Its research and development operations are based in Israel, while its commercial organization is expanding across the United States.

Capital for North American Expansion

Brava's $15 million seed round was led by Pitango and F2 Venture Capital. Angel investors, including executives from Anthropic, Microsoft, and Check Point, also participated.

The company intends to use the funding to accelerate technology development and commercial expansion across North America. It is also preparing to pursue opportunities in financial services and government.

Brava's market entry comes as enterprises explore how much of their security operations can be delegated to AI. Its proposition is that the transition requires more than capable agents: it requires confidence that the security infrastructure supplying them with information is actually detecting what matters.

By focusing on the evidence behind security decisions, Brava is targeting a problem that sits at the foundation of the AI-powered SOC.

Contact