Brava's $15M bet on pre-attack modeling

Security teams spend enormous effort writing detections, but the harder question is whether those detections would actually catch a real attacker in their specific environment. Brava Security, a Tel Aviv-based startup, has emerged from stealth with $15 million in seed funding to answer that question by modeling attacker behavior before an attack happens.

The round was led by F2 Venture Capital and Pitango VC, with participation from several angel investors. Brava was founded in 2024 by Israeli intelligence alumni Idan Basre, who serves as CEO, and Itay Gabbay, the company's CTO.

Simulating attacks to find blind spots

Brava's platform is built around a simple premise: rather than waiting for an attack to occur and then checking whether logs captured it, the system simulates attacks and analyzes the telemetry they generate to identify security gaps. The company says its models use business context to show how an attack would manifest in a customer's environment, reveal what defenses might miss, and rewrite SIEM detections so security teams can investigate further.

That approach is meant to close a gap the company says exists in modern security defenses, particularly as AI agents take on more investigation work. According to Brava, AI agents typically cannot investigate attacks that their systems never detected in the first place.

The detection gap AI can't fix

Gabbay framed the problem in terms of visibility rather than detection logic. "The hard part of security was never writing detections. It's knowing exactly what an attack will look like in a specific environment, across all of its log sources, before it ever happens. That's the problem our models were built to solve," he said.

"You can't automate a decision based on evidence no one ever proved. We're solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it's supposed to detect," Basre said.

— Idan Basre, CEO of Brava Security

Fast onboarding, few infrastructure changes

Brava says its platform can provide initial insights within 10-15 minutes of onboarding. The solution integrates with more than 70 sources and destinations and does not require changes to existing security infrastructure, according to the company.

The startup currently maintains an R&D team in Israel and a commercial team in the US. It plans to use the fresh funding to accelerate product development and market expansion.

The money behind the mission

The $15 million seed round is led by F2 Venture Capital and Pitango VC, with support from several angel investors. Brava was founded in 2024 by Idan Basre and Itay Gabbay, both alumni of Israeli intelligence.

• $15 million in seed funding
• Founded in 2024
• Initial insights within 10-15 minutes of onboarding
• Integrates with more than 70 sources and destinations

Why pre-attack modeling matters

The core idea behind Brava's platform is to prove that a detection would work before an attacker ever shows up. By simulating attacks and analyzing the resulting telemetry, the system aims to show security teams exactly what an attack would look like across their log sources and where their defenses would fail.

That kind of validation could be particularly relevant as organizations lean on AI agents to automate investigation and response. If an agent can only investigate what has been detected, then ensuring detections are accurate and complete becomes a prerequisite for automation, not an afterthought.

Brava's claim that its platform requires no changes to existing infrastructure and can deliver initial insights in minutes suggests it is designed to slot into current security stacks rather than replace them. The company's focus on rewriting SIEM detections also points to a practical concern: many organizations already have SIEMs in place, but may not know whether their rules would catch a specific attack in their environment.

What the funding signals

The seed round comes as investors continue to back security startups that promise to improve detection and response. While the funding amount is modest compared to some recent rounds in the sector, it reflects continued interest in technologies that help security teams validate their defenses rather than simply add more tools.

Brava's leadership team brings intelligence background to the problem, which may inform its approach to modeling attacker behavior. The company's dual presence in Israel and the US positions it to develop its technology while pursuing commercial opportunities in the American market.

The road ahead for Brava

With the new funding, Brava plans to accelerate product development and market expansion. The company will need to demonstrate that its simulated attacks translate into real-world improvements in detection coverage and that its platform can deliver value quickly enough to justify adoption.

For now, Brava is positioning its platform as a way to ensure security infrastructure sees the threats it is supposed to detect, a problem the company argues must be solved before AI can make reliable decisions. Whether enterprises agree will depend on how well the simulations match actual attacker behavior in their environments.

Why it matters

For security teams, the emergence of tools like Brava's suggests a shift toward validating existing defenses rather than piling on more alerts. If the company's claims hold up, organizations could gain a clearer picture of what their SIEMs would actually catch, potentially reducing blind spots that attackers exploit. That could be particularly consequential as more security operations adopt AI agents, since the value of automation depends on the quality of the evidence it receives. For the industry, the funding is another sign that investors see promise in pre-attack simulation and detection engineering, though the real test will be whether customers find the insights actionable in production environments.