Source: Unite.AI
Brava Security announced on November 4, 2026 that it was emerging from stealth with $15 million in seed funding led by F2 Venture Capital and Pitango, alongside a multi-agent platform designed to test whether security tools would actually detect an attack.
The round includes angel investors who are executives at Anthropic, Microsoft and Check Point. The capital is designated for Brava’s technology and growth across North America, including financial services, government and energy. Brava says it already works with Fortune 100 companies in retail, energy and hospitality.
The launch addresses a weakness in AI-driven security operations: an agent can make decisions about threats it recognizes while remaining unaware of attacks that its underlying defenses fail to detect. Brava identifies missing log collection, silently broken telemetry pipelines and flawed detection logic as potential causes.
Generating Evidence Without Running Attacks
Brava’s cooperating AI agents model attacker behavior and synthesize the telemetry an attack would produce across a customer’s environment without executing it. The process operates independently of existing detection rules and predefined tests, establishing what defenses should recognize before testing what they currently catch.
The platform works alongside the customer’s existing SIEM. Its detection-engineering function checks which attack steps current defenses recognize, identifies rules that stay silent, and writes missing detections in the SIEM’s own query language using only fields present in the generated evidence. It then replays that evidence to confirm that a real alert appears.
Scheduled game days repeat the validation after environmental changes. Evidence-backed maps show validated, partial, blind and missing-telemetry areas, while surfaced failures include broken detections, schema drift and dead log sources.
Aquarium, the investigation agent, accepts plain-English questions, plans and adjusts queries, and searches the SIEM, archived logs, EDR and cloud audit trails. Its reports link each finding to the underlying raw events.
The data-pipeline function sends events needed by detections to the SIEM and moves other data to searchable, low-cost storage rather than deleting it. Brava reports that this routing has cut SIEM costs by 65–85% across customers.
Reported Scale and Early Deployments
Brava says the platform supports more than 70 sources and destinations, including Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike NG-SIEM, Elastic Security and IBM QRadar, with initial insights available 10–15 minutes after a SIEM is connected.
The company reports the following rounded daily measurements across customer environments: 2.4 trillion events read and fingerprinted, 1,100 attack techniques replayed, 3,800 detections retested and 140,000 fields mapped each day.
WELL Health CISO Iain Paterson said in a testimonial published by Brava that the platform helped his organization build and operationalize a new SIEM in weeks. “The continuous detection engineering makes sure that we never have dead rules and constantly have new detections being added,” he said.
Founders Behind the Platform
The founder biographies identify Idan Basre as co-founder and CEO in New York and Itay Gabbay as co-founder and CTO in Tel Aviv. Basre, a Talpiot alumnus, spent a decade researching attacker behavior in Unit 8200 before moving into product leadership at Microsoft Defender. Gabbay led joint US–Israeli DARPA AI research, developed autonomous AI systems and led enterprise AI security initiatives.
Brava’s expansion rests on a specific premise for AI-assisted security operations: automation depends on the quality of the telemetry and detection logic beneath it. The platform uses one evidence layer to validate defenses, support investigations and decide which data belongs in the SIEM. The open question is whether the reported detection and cost benefits can be sustained as customer environments change.
