Pomegra
Brava Security exits stealth with a $15M seed from F2 Venture Capital and Pitango to test whether SIEM tools would catch real attacks before AI acts on them.
Key Takeaways
- Brava Security raised a $15M seed round co-led by F2 Venture Capital and Pitango on November 4, 2026.
- Its multi-agent AI generates the logs an attack would leave, then checks whether a customer's SIEM detects them.
- The company has about 20 employees and says Fortune 100 firms in retail, energy and hospitality already use it.
Lead
Brava Security, an Israeli startup with a growing U.S. commercial team, came out of stealth on November 4, 2026 with a $15 million seed round. F2 Venture Capital and Pitango led the round. Angel investors include executives from Anthropic, Microsoft and Check Point. Valuation was not disclosed.
The company sells a platform that tests whether a security operations center would detect an attack, without running one. The money will go to product development and expansion in North America, with financial services, government and energy as target sectors.
What Does Brava Security Actually Do?
Brava builds a multi-agent AI system that synthesizes the telemetry a real attack would produce, then runs it against a customer's existing detection stack. The output shows which attacks the stack would flag and which it would miss. Where a SIEM rule fails, the platform rewrites it.
The product connects to more than 70 sources and destinations, including Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike NG-SIEM, Elastic Security and IBM QRadar. Brava says first insights appear 10 to 15 minutes after a SIEM is connected. Customers keep their current tools; the platform audits them rather than replacing them.
That positioning puts Brava against breach-and-attack simulation vendors such as Pentera and detection-engineering firms such as CardinalOps. It also sits near the AI SOC group that includes Torq, Exaforce, Qevlar AI and Fig Security. Those companies mostly automate alert triage. Brava targets what happens before an alert exists.
Why Does Detection Evidence Matter for AI SOCs?
AI agents that investigate alerts can only work on alerts that fire. If a SIEM never collects the relevant logs or never matches a rule, the agent has nothing to examine, and the gap stays invisible.
CEO Idan Basre framed the issue this way: "Everyone is racing to put AI in charge of the SOC. You can't automate a decision based on evidence no one ever proved." The pitch is that automation sits on top of unverified assumptions about coverage, and that someone should check those assumptions first.
The argument is reasonable but unproven at scale. Detection coverage is a long-standing problem, and the market has sold coverage-mapping and simulation tools for years. Brava's claim is that synthesizing logs, rather than executing attacks, is safer and faster to deploy. Customers will test whether that holds in production environments with messy, inconsistent logging.
Who Is Behind the Company?
Basre co-founded Brava with CTO Itay Gabbay. Basre is a Talpiot program alumnus who spent 10 years as a threat researcher in Unit 8200 and later led product management for Microsoft Defender. Gabbay spent seven years in the IDF building AI systems and worked on a joint DARPA-Israeli research program. The company was founded in 2024 and employs roughly 20 people, split between AI researchers and security researchers. R&D is in Israel.
Named customers include Cushman & Wakefield and WELL Health, a Canadian healthcare company. Cushman & Wakefield's CISO, Erik Hart, said AI in his team's security operations should make people more effective and that Brava sits at the center of that work.
What Does a $15M Seed Imply?
A $15 million seed is large for a company with 20 staff, and it points to investor appetite for security tooling that verifies AI rather than adds another agent. Two Israeli-linked funds co-leading, plus angels from a frontier AI lab and two large security vendors, suggests the thesis was vetted by people who sell into the same buyers.
The round does not show revenue. Brava has not published customer counts beyond Fortune 100 references, contract sizes or retention. Investors are paying for a founding team with unit 8200 and Defender credentials and for early design partners, which is typical at seed but leaves the commercial case open.
Outlook
Brava now has funding to hire in the U.S. and pursue regulated buyers in financial services, government and energy, where proof of detection coverage carries audit weight. The next test is whether large enterprises treat detection validation as a budget line separate from their SIEM and AI SOC spending. If SOC vendors add their own coverage testing, Brava's independence from the tools it audits becomes the main selling point, and also the main thing competitors will try to copy.
