Brava Raises $15 Million to Find the Attacks AI Threat Detection Would Miss

Brava Security, an Israeli startup, says its AI agents predict the evidence an attack would leave in a customer’s logs and test whether the customer’s monitoring would catch it, without launching the attack.

Brava argues that an AI agent in a security operations center can judge only the evidence it receives. Logs that were never collected, data pipelines that break unnoticed and detection rules that miss an attack leave the agent blind to it, the company says. If that holds, a buyer’s coverage question shifts from how fast AI investigates to whether the security data holds the evidence at all.

How does Brava find the gaps?

Brava’s agents compare the predicted evidence with what a customer’s monitoring captures and flag the attacks that would pass unseen. Brava then rewrites detection rules and data feeds inside the customer’s security information and event management (SIEM) system, the software that collects and correlates security logs. First findings arrive within 10 to 15 minutes of onboarding, and the platform connects to more than 70 security tools and data sources.

Who is behind it?

Pitango Venture Capital and F2 Venture Capital led the round. CEO Idan Basre spent ten years as a threat researcher in Unit 8200, the Israeli military’s signals intelligence and cyber unit, then led product management for Microsoft Defender. CTO Itay Gabbay spent seven years building AI systems for the same military.

Brava has about 20 employees, with research in Israel and a commercial team growing in the United States. The seed money goes to product work and to expansion across North America, including financial services and government.

Who uses it?

Brava lists Fortune 100 companies in retail, energy and hospitality among its customers, along with Cushman & Wakefield and the Canadian healthcare company WELL Health. Erik Hart, Cushman & Wakefield’s chief information security officer, said Brava investigates threats alongside his team and gathers the evidence behind their decisions.

Brava did not name its Fortune 100 customers or say how many companies pay for the platform. The number a buyer needs is how many detection gaps it typically finds, because that count sizes the blind spot, and Brava has not published it.

Could the security team name the attacks its SIEM would miss, and show the log behind each answer?