Brava Security Raises $15M Seed for Detection Validation

Brava Security gives the attacker a useful move in its public ransomware demonstration: switch off audit logging. The illustration follows the response through restored logs, an added detection and another run that produces an alert, putting a fairly practical obligation in front of anyone selling an AI security investigator.

The security-operations company announced $15M in seed funding on November 4, 2026, co-led by F2 Venture Capital and Pitango. Co-founders Idan Basre, CEO, and Itay Gabbay, CTO, are building software that generates the evidence an attack should leave, then checks whether a customer's existing defenses recognize it.

Brava says the capital will support its technology and North American expansion, including financial services, government and energy. Its proposition reaches an important purchasing decision for enterprise security teams: how to connect the data they collect, the detections they maintain and the investigations they increasingly want AI to perform.

What Brava's $15M Seed finances

F2 Venture Capital and Pitango co-led the round, with participation from unnamed angel investors who include executives from Anthropic, Microsoft and Check Point. The announcement identifies those individuals through their employers; it does not describe corporate investments by the 3 technology companies. Brava reports the amount as $15M without specifying the dollar denomination, and it does not disclose a valuation or a separate lifetime funding total.

For Brava, expansion will involve carrying a technically specific proposition into more enterprise buying conversations. The company says it already works with Fortune 100 businesses in retail, energy and hospitality. That is a company-reported customer description, with no revenue figure or contract value attached to it in the announcement.

The founders have divided experience that fits the assignment. Brava's leadership biographies describe Basre's decade of threat research in Unit 8200 and subsequent Microsoft Defender product leadership, alongside Gabbay's work in autonomous AI systems and joint US-Israeli DARPA research. Its careers page describes a team in New York and Tel Aviv, giving the North American commercial effort an existing geographic connection rather than a newly invented headquarters story.

How attack evidence becomes a detection test

Brava describes a sequence that begins with a threat in the customer's environment. Its agents model how the attack could unfold, synthesize the telemetry it would leave and test whether the existing security information and event management system, or SIEM, raises the expected alert. When a gap appears, the platform helps repair the detection and replays the evidence to check the result.

The distinction matters operationally because the public demonstration is an illustration of generated attack evidence, rather than an account of ransomware executed against a customer. Brava is asking a buyer to examine the relationship between a modeled threat and the system's observable response. That gives the detection engineer an artifact to inspect and the investigator a clearer account of what the environment can see.

MITRE ATT&CK supplies a widely used vocabulary for describing adversary tactics and techniques, and Brava displays an ATT&CK-oriented view on its site. A technique label gives teams a common reference point; the work inside a particular customer still depends on that environment's records and detections. A matrix entry by itself cannot tell an investigator which field arrived in yesterday's logs, or whether the rule depending on it remained useful after a configuration change.

The buyer inherits a continuing relationship

The investment case becomes more interesting when validation is treated as recurring work. A security team can review a detection, approve it and still need to revisit its assumptions as the surrounding environment changes. Brava's product description makes that changing relationship central to the service: generate evidence, test the response, repair the gap and repeat the exercise.

For an operator evaluating the product, the useful questions are correspondingly concrete. How closely does generated telemetry represent the environment? Can an engineer inspect the path from the modeled technique to the evidence and resulting alert? How are proposed changes reviewed and retested? These are evaluation questions arising from the mechanism Brava describes, rather than assertions that its software has passed an independent benchmark.

There is also an organizational consequence. Detection engineering owns rules, investigation consumes their output, and someone pays for the data feeding both. A validation result can connect those responsibilities in a way that a product demonstration focused solely on an investigator's answer would leave unexplained. Brava's commercial opportunity sits in making that connection useful enough for a customer to keep returning to it.

North American growth brings the work closer to the customer

Brava's current hiring page includes sales engineering, software engineering, product, GTM engineering and AI research roles. The sales-engineering description runs from an initial demonstration through a proof of value, an especially relevant assignment for a company whose product invites the customer to examine evidence. The advertised roles describe hiring intentions, rather than completed additions to the team.

The funding arrives alongside a broader effort to make enterprise AI accountable to the systems where it operates. DevCuration's coverage of CrowdStrike's proposed Fiddler AI acquisition follows a neighboring question about observing agent behavior. Brava's emphasis begins earlier, with the evidence available to a security decision, giving this seed round a distinct place in that discussion.

As Brava takes its platform into more North American accounts, the proof-of-value conversation will have to travel with it. A customer's logging configuration will change, its detection engineers will revise rules, and its investigators will inherit the results. The expanding team is selling a way to keep those people working from evidence they can examine together.