Cybersecurity companies are increasingly turning to artificial intelligence to accelerate security operations. AI agents can investigate alerts, analyze suspicious activity, and help security teams make decisions faster. But there is a problem that more automation cannot solve on its own: security systems must first collect the evidence needed to identify an attack.
The goal is to establish whether an enterprise's existing security infrastructure can recognize specific attack techniques, identify where detection capabilities fall short, and help fix those weaknesses. Rather than requiring companies to replace their existing tools, Brava works with the infrastructure security teams already have in place.
“Everyone is racing to put AI in charge of the SOC. You can't automate a decision based on evidence no one ever proved,” said Idan Basre, co-founder and CEO of Brava Security, who encountered the problem firsthand while leading product management for Microsoft Defender. “We're solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it's supposed to detect.”
Why Security Visibility Is Becoming More Important
Modern enterprise environments are becoming increasingly complex. Companies are deploying more cloud services, AI applications, and AI-assisted development tools, creating additional sources of security telemetry that need to be collected, processed, and monitored.
However, having more data does not necessarily mean having better security visibility. Critical logs may never be collected, telemetry pipelines can silently break, and detection rules may fail to identify the attacks they were designed to catch. The
These weaknesses create a significant challenge for security operations centers (SOCs). An AI agent might be capable of investigating an alert in seconds, but its capabilities are limited when the underlying security infrastructure never generates an alert in the first place.
Brava is built around this distinction. Instead of focusing exclusively on analyzing the alerts that security systems produce, its technology examines whether those systems would recognize an attack at all.
Establishing Ground Truth for Security Operations
Brava's platform focuses on modeling attacker behavior and understanding how different attack techniques would appear across an organization's specific environment and log sources.
Its Security Operations platform determines what an attack should look like, evaluates whether existing defenses would detect it, and identifies the telemetry and detection gaps that could leave an organization exposed. It can then rewrite SIEM detections and address data feeds that are blind to the tested activity, while also investigating alongside security teams.
The approach centers on understanding the relationship between attacker behavior and the evidence available to security tools.
“The hard part of security was never writing detections. It’s knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That’s the problem our models were built to solve,” said Itay Gabbay, co-founder and CTO of Brava Security.
By testing attack techniques and evaluating the resulting telemetry, Brava aims to give security teams a way to evaluate their detection capabilities without relying solely on assumptions about how their infrastructure performs.
Fortune 100 Customers and Enterprise Integrations
According to Brava, the company has already signed Fortune 100 companies across the retail, energy, and hospitality sectors. Its customer base also includes Cushman & Wakefield and WELL Health, one of Canada's largest healthcare companies.
The company says its platform delivers its first insights within 10–15 minutes of onboarding, allowing security teams to begin evaluating findings without going through a lengthy deployment process.
Integration with existing security infrastructure is another part of its approach. Brava supports Splunk, Google SecOps, CrowdStrike, and more than 70 other sources and destinations.
For Cushman & Wakefield, the platform is designed to help security personnel bring evidence together and make decisions without spending unnecessary time searching across systems.
“Our SecOps journey is about applying AI where it makes our people more effective, and Brava sits at the center of that. It investigates alongside our team, bringing evidence together so decisions rest on facts rather than on searching,” said Erik Hart, CISO at Cushman & Wakefield.
Funding and the Road Ahead
The $15 million seed round was led by Pitango and F2 Venture Capital, with participation from angel investors, including executives from Anthropic, Microsoft, and Check Point, according to Brava.
According to the company's account of its founders' backgrounds, Basre brings ten years of experience in Unit 8200, where he worked as a threat researcher, followed by product management leadership at Microsoft Defender. Gabbay spent seven years in the IDF building core AI systems, including work on a joint DARPA-Israeli research program. Their
Brava says it has approximately 20 employees, combining AI researchers and security researchers. Its R&D operations are based in Israel, while its commercial team is expanding across the United States.
According to the company, the funding will support further technology development and commercial expansion across North America, with financial services and government among the additional markets it is preparing to pursue.
As enterprises continue exploring AI-driven security operations, Brava is making the case that automation needs a dependable foundation. Its approach puts the ability to prove what security systems can actually detect at the center of that effort.
This article was published as a press release by the author under HackerNoon's
