Pomegra
Brava Security emerged from stealth with a $15M seed round led by F2 Venture Capital and Pitango, aiming to prove whether SOC detections work against real attacks.
Key Takeaways
- Brava Security raised a $15M seed round, co-led by F2 Venture Capital and Pitango VC.
- Valuation was not disclosed; angels include executives from Anthropic, Microsoft and Check Point.
- The platform simulates attacker telemetry rather than running live attacks; Fortune 100 customers are already using it.
Lead
Brava Security came out of stealth in November 2026 with $15M in seed funding, co-led by F2 Venture Capital and Pitango VC. The company builds an AI platform that tests whether a security operations center would catch a given attack, without launching one. It plans to spend the money on product development and on expanding in North America, where its commercial team is based. The R&D team sits in Israel.
What Does Brava Security Actually Do?
Brava models how an attack would appear in a customer's logs, then checks whether existing detection rules would fire. It does not execute simulated attacks against corporate systems, which is how traditional breach-and-attack simulation tools work. Instead, it generates the machine data an intrusion would be expected to produce in that specific environment.
The company says the platform integrates with more than 70 sources and destinations, including Splunk, Google SecOps and CrowdStrike, and needs no changes to existing infrastructure. It reports first insights within 10 to 15 minutes of onboarding. The product also includes detection engineering, an investigation agent called Aquarium, and data pipeline optimization.
Brava claims it processes 2.4 trillion events daily and has cut SIEM costs by 65% to 85% across customers. Those figures come from the company and have not been independently verified.
Who Is Behind the Company and Who Is Paying?
Idan Basre is CEO. He is a graduate of the IDF's Talpiot program, spent a decade as a threat researcher in Unit 8200, and previously led product management for Microsoft Defender. CTO Itay Gabbay spent seven years building AI systems for the IDF and worked on a joint DARPA-Israeli research program. The company was founded in 2024 and employs roughly 20 people, mostly AI researchers and security specialists.
Beyond the two lead funds, the round includes angel investors who are executives at Anthropic, Microsoft and Check Point. The valuation was not disclosed. A seed round of this size, with no priced figure attached, tells little about how investors see the company's worth. It does suggest the funds are paying for the founders' résumés as much as for revenue.
Why Does Detection Validation Matter Now?
Security teams have spent years writing detection rules without a reliable way to confirm they work. Rules break when log schemas change, and log sources quietly go dark. Gabbay framed the problem as knowing exactly what an attack will look like in a specific environment, not writing the detection itself.
That gap grows as vendors push AI agents into the SOC to triage alerts and respond automatically. Basre argued that an automated decision is only as good as the evidence behind it, and that no one has proved much of that evidence. Pitango's Cassuto pointed to the agentic capabilities Brava brings, while F2's Fridman said the company replaces faith with proof.
How Crowded Is the Field?
Crowded, and Brava is entering from a skeptical position. SafeBreach, Pentera, Picus and others have sold attack simulation and validation for years, and large SIEM and XDR vendors are adding their own detection-testing features. Brava's pitch is that telemetry modeling avoids the risk and operational friction of running simulated attacks in production.
Customers named so far include Cushman & Wakefield and Canadian healthcare company WELL Health, plus several Fortune 100 firms in retail, energy and hospitality. Revenue and contract sizes were not disclosed. A claim of Fortune 100 adoption at seed stage is worth testing against renewal rates, which the company has not shared.
What Comes Next?
The immediate test is whether the North American push turns pilots into recurring contracts. Large buyers already own validation tools and may resist adding another vendor to the SOC stack. If Brava can show its SIEM cost savings hold up outside its own case studies, the pitch gets easier. A Series A would likely be the first moment a valuation becomes public.
Outlook
Brava Security enters the market with $15M, a pedigreed founding team and a narrow claim: prove that detections work before an attacker tests them. The funding is modest and the competition is established. Its performance claims remain self-reported, and the next year of customer data will decide whether the product earns a place in the SOC.
