Brava has emerged from stealth with $15m in seed funding as enterprises hand growing numbers of security decisions to AI agents built on detection logic that has never been proven.
F2 Venture Capital and Pitango co-led the round. Angel investors also took part, among them executives from Anthropic, Microsoft and Check Point. Brava says it already counts Fortune 100 companies in retail, energy and hospitality among its customers, and that demand continues to build.
The startup is targeting a gap that sits beneath most security operations centres. Teams often assume a rule will catch a given attack because the rule exists and dashboards report healthy status, yet few have ever watched that rule trigger against that attack in their own environment with current log sources.
Brava argues the risk grows as AI agents take on more of the SOC workload, because those agents rely on logs and detection logic that most organisations cannot verify.
Essential logs may go uncollected, telemetry pipelines can fail without warning, and rules can miss the very threats they were designed to flag. An agent may handle familiar threats well while remaining blind to attacks its underlying defences never detect.
Brava’s multi-agent system models attacker behaviour and produces the precise telemetry an attack would generate in a customer’s environment, without running the attack itself. The platform processes 2.4 trillion events daily across customer environments and validates thousands of detections each day.
That evidence supports three functions that operate alongside a customer’s existing SIEM. For detection engineering, Brava tests each rule against its intended attack, identifies rules that fail to trigger, rewrites them in the SIEM’s native query language using only fields confirmed to exist, and checks that they then fire. Broken detections, schema drift and inactive log sources are flagged on the day they occur.
For investigation, its agent Aquarium accepts plain-English questions, plans and runs queries across the SIEM, archived logs, EDR and cloud audit trails in a single pass, and produces a report linking every finding to the underlying raw events. For data pipelines, Brava routes only the events detections need into the SIEM and shifts remaining data to cheaper, still-searchable storage, a move the company says has reduced SIEM costs by 65 to 85% across its customer base.
The founders bring backgrounds in threat research and AI. One co-founder is a Talpiot graduate who spent a decade as a threat researcher in Unit 8200 before heading product management at Microsoft Defender. Co-founder Itay spent seven years developing core AI systems for the IDF, including leading a joint DARPA-Israeli AI research programme.
Brava aims to become the foundational layer that every security tool and AI agent consults to establish what is real. The new capital will fund further development of its technology and expansion across North America, with financial services, government and energy among the target sectors.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
