Brava Security Emerges from Stealth with $15 Million for AI Attack Simulation

Security operations startup Brava Security announced its public launch from stealth mode backed by $15 million in seed funding. The capital injection was co-led by venture capital firms F2 Venture Capital and Pitango VC, with additional participation from several angel investors.

As reported by SecurityWeek, the Tel Aviv-headquartered company was established in 2024 by Israeli intelligence alumni Idan Basre, who serves as chief executive officer, and Itay Gabbay, the startup’s chief technology officer. The company plans to use the new capital to accelerate product development and support broader market expansion.

Simulating Adversaries to Reveal Visibility Gaps

Modern enterprise security operations centers rely heavily on automated tools and SIEM platforms to surface indicators of compromise. However, automated detection workflows frequently falter when underlying telemetry fails to capture malicious activity in the first place. Brava Security developed an artificial intelligence platform designed to address this disconnect by modeling attacker techniques and generating simulated attacks within an organization’s digital footprint.

By incorporating specific business context, the platform simulates how threats would realistically manifest across an organization’s specific logging pipelines. It monitors the resulting telemetry to identify visibility gaps, shows where existing defenses would fail to flag the intrusion, and automatically rewrites SIEM detection rules to address uncovered blind spots.

“The hard part of security was never writing detections. It’s knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That’s the problem our models were built to solve,” said Gabbay.

According to the company, this proactive testing resolves a fundamental limitation in modern security automation. Because emerging AI agents cannot investigate alerts or anomalous activities that detection pipelines never register, ensuring that defensive systems ingest and parse the correct evidentiary data is a critical prerequisite.

“You can’t automate a decision based on evidence no one ever proved. We’re solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it’s supposed to detect,” Basre said.

Deployment and Market Footprint

Brava designed its software to minimize friction during enterprise rollouts. The platform does not require organizations to replace or redesign their existing defensive architecture. Instead, it connects natively to more than 70 data sources and operational destinations, enabling it to pull context and push detection improvements across varied security stacks.

The company claims its onboarding process delivers initial security insights within 10 to 15 minutes of deployment. Once integrated, the system provides continuous analysis while giving security personnel the ability to investigate findings deeper into their telemetry feeds.

To support its technology roadmap and international customer base, Brava maintains its research and development operations in Israel alongside a commercial division located in the United States.

What Security Teams Should Consider

While funding announcements reflect supplier growth rather than active security incidents, the systemic issues Brava targets affect enterprise defenders broadly. Security operations teams looking to assess their own detection baselines can take several practical steps:

• Audit logging coverage across core assets: Regularly verify that critical servers, cloud instances, identity providers, and endpoints are actively forwarding high-fidelity telemetry to central SIEM and data lake repositories.
• Validate detection logic against realistic adversary behavior: Test detection rules against simulated attacks or controlled breach scenarios to ensure alert pipelines trigger reliably when suspicious actions occur.
• Review SIEM parsing and correlation rules: Incompatible log formats and parsing errors can silently break detection rules. Periodically validate that ingested log sources match the fields expected by active correlation queries.
• Address ingestion blind spots before automating response: Ensure underlying visibility and data integrity are thoroughly established before routing unverified log pipelines into automated SOAR or agentic decision-making tools.