Brava Security emerges from stealth with $15 million in seed funding

Brava Security came out of stealth on November 5, 2026, with $15 million in seed funding from a round led by F2 Venture Capital and Pitango VC. Brava is based in Tel Aviv and was founded in 2024 by CEO Idan Basre and CTO Itay Gabbay. The company’s emergence from stealth and its $15 million in funding were first reported by Axios.

The company’s platform builds simulated attack telemetry with multiple AI agents instead of launching real attacks against live systems. It models how attackers behave to forecast the digital traces particular techniques would leave, then checks whether existing defenses detect that modeled activity and flags where the needed evidence is missing. It applies business context to show how an attack would appear in a specific customer environment. Brava says its agents model a customer’s environment without relying on existing rules or threat libraries, exposing weaknesses even against techniques never seen before.

The platform is organized around three areas: detection engineering, security investigations and data pipeline optimization. The workflow runs four stages: model the threat, build simulated telemetry, check and close detection gaps, then replay evidence to prove an alert fires. If a rule misses a simulated attack, Brava finds the gap, authors the missing detection in the query language of the security information and event management platform, and confirms that a real alert fires. Brava fingerprints every simulated attack event field by field; its website offers a sample scenario: ransomware in AWS.

That recognize, verify, fix, prove and repeat cycle runs continuously whenever the environment changes. The company’s site says detection logic must be revisited when environments shift, including relocated log sources, altered field names and revised parsers. When defenses miss modeled activity, Brava writes new detection rules and adjusts data feeds.

The platform includes Aquarium, an AI investigation agent that lets security analysts ask questions in natural language. It pulls together queries across endpoint tools, cloud audit records, archived logs and SIEM systems, plans searches across sources, and ties its findings to underlying security events. The agent chases down its findings and writes reports with the evidence attached, backed by pointers to the underlying security events.

The data-pipeline tooling parses and normalizes records, sends events needed for detection to the security information and event management system, and stores the rest in searchable lower-cost storage. Data moved there is not deleted and remains searchable, and teams can bring it back at any time.

Integrations cover Splunk, Google SecOps and CrowdStrike among more than 70 other sources and destinations, plus anything able to write to Pulse 2.0, Kafka, syslog or an HTTP endpoint, with no changes to current infrastructure required. Brava says customers have seen security information and event management costs decline, with the drop running from approximately 65 percent to 85 percent, and the company says it processes 2.4 trillion events each day across customer environments and validates thousands of detections daily.

Customers get initial insights within 10 to 15 minutes of starting, Brava says. The measure applies to onboarding across customer environments. Brava describes that 10-to-15-minute figure as its reported time to first findings rather than a full-deployment guarantee.

The company was founded to address blind spots created by missing logs, malfunctioning data pipelines and ineffective detection rules. Effective detection requires three things: a useful record must exist, the pipeline must carry it forward, and the detection must interpret the fields properly. When a detection rule is broken it raises no error, so nobody notices until an attack is missed.

Gathering more logs does not automatically mean better coverage when the evidence a particular attack requires is missing or unusable. Security teams increasingly rely on AI agents for incident investigations, yet those systems hinge on logs and detection rules that might fail.

Basre said AI agents typically cannot investigate attacks that their systems have not detected, which means decisions cannot be automated without proven evidence. “You can’t automate a decision based on evidence no one ever proved.” He also said most security teams take detection on faith, while Brava replaces that hope with proof.

Gabbay said the core problem lies in understanding how an attack shows up in a specific environment across all log sources before it happens. Basre spent 10 years as a threat researcher in Unit 8200 after the Talpiot program, then led product management for Microsoft Defender. The company says his Microsoft tenure exposed repeated problems with missing or unavailable critical data in corporate security operations.

He spent seven years with the IDF building core AI systems, including work on a joint research program with DARPA. About 20 people work for the company, including AI researchers and security researchers, split between research and development in Israel and a business team expanding in the United States. Among the angel investors in the round are executives from Anthropic, Check Point and Microsoft.

Pitango’s Yair Cassuto said AI fundamentally changes the threat landscape, so defending organizations requires a fundamental change. F2 Venture Capital’s Maor Fridman said security operations center teams often rely on unproven detection, while Brava replaces faith with proof. Cushman & Wakefield CISO Erik Hart said the platform works alongside his team and assembles evidence, so decisions rest on facts instead of searching.

Its customers include Fortune 100 companies across retail, energy and hospitality, along with Cushman & Wakefield, a commercial real estate services firm, and WELL Health, one of Canada’s largest healthcare companies. Brava plans to use the money to speed up product development and expand commercially across North America, including opportunities in financial services and government.