Testing Defenses With Fake Attacks

The Evidence Gap

Idan Basre spent ten years in Unit 8200 and then led product management for Microsoft Defender. During that time, he watched security teams fail not because they lacked skill, but because they lacked the specific data needed to investigate incidents. This observation birthed Brava Security, a startup that just emerged from stealth with a $15 million seed round.

The funding was led by Pitango and F2, with participation from senior executives at Anthropic, Microsoft, and Check Point. This diverse group of investors shows that the industry recognizes a critical flaw in current security strategies. The problem is that AI agents are racing to take over Security Operations Centers, but they cannot process evidence that was never collected.

Basre argues that automating decisions based on missing data just gets you to the wrong answer faster. Brava exists to solve the prerequisite step: ensuring the infrastructure actually sees the threat before an AI tries to interpret it. This foundational issue is often overlooked in favor of flashy detection tools that rely on incomplete information.

Simulating the Invisible

Brava does not execute attacks. Instead, it uses multiple AI agents to generate the digital traces, or telemetry, that a specific attack would leave behind. This simulation happens within the customer's environment without any malicious code running. The platform then checks if existing defenses detect this synthetic evidence.

If the logs are silent, Brava identifies the gap and helps repair it. This approach is critical for organizations using Splunk, Google SecOps, or CrowdStrike. The company claims its platform delivers initial findings within 10 to 15 minutes of onboarding. It integrates with over 70 data sources, allowing teams to see exactly where their detection rules fail.

This is not about replacing tools, but about validating that the tools are actually working as intended. By simulating the invisible, Brava turns abstract security concepts into concrete, verifiable data points. This method allows security teams to trust their automated responses because they know the underlying data pipeline is robust and complete.

A High-Stakes Team

The leadership team reflects the high stakes of this mission. Basre, a Talpiot graduate, brings deep experience in cyber-threat research. His co-founder, CTO Itay Gabbay, spent seven years in the IDF developing AI systems. Gabbay also participated in a joint research initiative between Israel and DARPA. This combination of military intelligence and AI research positions Brava to tackle complex detection challenges.

The startup employs approximately 20 people, including AI and cybersecurity researchers. It operates an R&D center in Israel and is expanding its commercial team in the United States. The new funding will support product development and commercial expansion across North America. The company is also preparing to pursue opportunities in financial services and government sectors.

This focused team structure allows for rapid iteration and deep technical expertise. The blend of offensive security knowledge and defensive AI research creates a unique perspective on how threats evolve. It ensures that the simulated attacks are realistic and that the detection gaps identified are truly critical for enterprise security.

Market Context and Competition

Brava is entering a crowded market. Markets and Markets project the AI security operations market will be worth $47.07 billion by 2031. Other players are also pushing AI into security workflows. Atlantic Data Security partnered with LogSeam to power its Harbour AI SOC, focusing on automating routine investigations. Cycurion launched Habit, a predictive AI platform for SOC operations.

However, Brava differentiates itself by focusing on the visibility gap. While competitors automate response, Brava ensures the data needed for response is actually present. This is a fundamental shift in how organizations validate their security posture. It moves the focus from reactive triage to proactive validation of detection capabilities.

The market is shifting from simply reacting to threats to understanding the integrity of the data used to detect them. By addressing the blind spots, Brava offers a layer of assurance that pure automation tools cannot provide. This distinction is crucial for enterprises that require high confidence in their security outcomes.

The Broader Implication

As enterprises adopt more cloud services and AI tools, the risk of silent data pipeline failures grows. Critical logs may never be collected, and detection rules may miss attacks they were designed to catch. Brava’s technology addresses this by modeling attacker behavior and testing how each technique appears in logs. This creates a feedback loop that continuously improves the security stack.

The company’s customers include Fortune 100 companies in retail, energy, and hospitality, as well as Cushman & Wakefield and WELL Health. These organizations are realizing that AI cannot save them if the underlying data is flawed. Brava’s $15 million seed round signals that the market is ready for tools that validate the foundation of security operations.