布拉瓦安全融资 1500万美元测试AI网络防御系统实际能检测到的东西

供资

布拉瓦安全融资 1500万美元测试AI网络防御系统实际能检测到的东西

在 Google 上的首选来源中添加 Unite.AI

Brava Security从隐蔽处出现，1500万美元的种子资金用于解决AI辅助网络防御的基本弱点：如果基础安全系统从未发现攻击，自动化分析师就无法调查攻击。

该回合由F2 Venture Capital和Pitango领衔主演，天使在Anthropic,Microsoft，和Check Point的主管参与。 布拉瓦计划将资金用于产品开发和整个北美的商业扩张，包括金融服务和政府的机会。

公司的做法是在不进行攻击的情况下，在某一特定环境中进行遥测。 然后检查现有辩护人是否承认这些证据并帮助弥补差距。 这使得侦测验证，而不是简单的更快的警戒调查，成为其投球的中心。

在事件发生前测试证据

安全业务中心依靠遥测：记录各端点的活动、云层环境、身份和应用。 安全信息和事件管理系统，即SIEM，收集和分析这些记录，利用检测规则查明可疑行为。

这一进程有几个依赖性。 相关系统必须形成有用的记录，管道必须交付，检测必须正确解释字段。 如果缺少或无法使用特定攻击所需的证据，更多的日志并不自动意味着覆盖范围更好。

Brava 称其多agent技术模型攻击者行为，并识别特定技术应如何出现在客户的日志来源中。 其平台然后测试这些痕迹是否会触发预定的防御，重写缺失的SIEM检测，并解决数据输入漏洞。

称 Idan Basre是布拉瓦联合创始人兼首席执行官，曾领导Microsoft Defender的产品管理。

提出证据和执行攻击之间的区别很重要。 布拉瓦正在通过合成遥测测试检测路径。 这可能帮助暴露一个沉默的规则或缺失的字段，但成功的测试并不能证明真正的入侵的每一个变体都会被抓住，或者攻击者无法到达系统。

关闭规则和警告之间的循环

Brava的产品工作流程描述了四个阶段：模拟威胁，合成其遥测，验证和修复检测漏洞，以及重播证据以证实警报出现在SIEM中。 它还描述了随着环境变化的重新测试。

这与将已安装的规则视为可核实的覆盖范围有着有益的区别。 字段重命名，解析器更新，或断开的源头会留下一个以前有用的检测，无法匹配它被写入的活动。 更改后重复测试有助于确定检测是否仍与其实际接收的数据有效。

该平台旨在与现有安全基础设施合作。 Brava列出斯普伦克，Google SecOps,CrowdStrike，以及超过70个来源和目的地，从而减少了更换一个安全小组已经运行的工具的需要。

对于检测工程师来说，实用价值是一个比通用覆盖分值更具体的答案：哪些证据应该存在，检测路径的哪一部分错过了，修复是否产生了警报。 这些问题将工程变化与可观察到的结果联系起来。

调查和数据管道共享同一基金会

公司网站新增两个相关能力。 水族馆，其调查界面，计划跨来源搜索，并将调查结果与基本事件联系起来。 其数据管道工具解析并规范记录，将相关事件引导到SIEM，并将其他数据保存在可搜索的低成本存储中。

这些职能处理同一业务问题的不同部分。 一个分析师需要证据来重建所发生的事情，而检测规则则需要合适的场地开火。 只有在掌握了侦查和调查所必需的信息的情况下，减少摄入量才有用。

Brava 发布称平台在登机后10-15分钟内提供初步见解。 这是公司报告的时间来得出初步结论，而不是保证企业的完全部署或每一次探测修复都在该窗口内完成。

客户企业和围绕AI和保安的团队

Brava报导Fortune 100 客户零售、能源和招待业，Cushman & Wakefield CISO Erik Hart 称平台与其团队和带来证据一起调查，以支持决定。

公司由Basre和CTO Itay Gabbay创立。 巴斯尔在Microsoft角色之前在8200单元里作为威胁研究员度过了十年。 Gabbay花了七年时间在以色列国防军建造AI系统，包括DARPA-以色列联合研究方案。

布拉瓦约有20名员工，在以色列研发，美国商业团队不断扩大。 资金支持将AI研究与要求很高的安全工程任务相结合的产品：模拟攻击在企业使用的特定系统中的出现。

公司的前提是，自主的安全决定需要验证证据。 随着客户环境的变化，对该前提的最强检验将是持续的检测质量：沉默规则减少，缺失信号减少，以及安全小组能够展示实际工作的修复。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Funding

Brava Security Raises $15 Million to Test What AI Cyber Defenses Can Actually Detect

Add Unite.AI to your preferred sources on Google

Brava Security has emerged from stealth with $15 million in seed funding to address a basic weakness in AI-assisted cyber defense: an automated analyst cannot investigate an attack if the underlying security systems never detect it.

The round was led by F2 Venture Capital and Pitango, with angel participation from executives at Anthropic, Microsoft, and Check Point. Brava plans to use the funding for product development and commercial expansion across North America, including opportunities in financial services and government.

The company’s approach is to generate the telemetry an attack would produce in a particular environment without carrying out the attack itself. It then checks whether existing defenses recognize that evidence and helps repair the gaps. That makes detection validation, rather than simply faster alert investigation, the center of its pitch.

Testing the Evidence Before an Incident

Security operations centers rely on telemetry: records of activity across endpoints, cloud environments, identities, and applications. A security information and event management system, or SIEM, collects and analyzes those records, using detection rules to identify suspicious behavior.

That process has several dependencies. The relevant system must produce a useful record, the pipeline must deliver it, and the detection must interpret the fields correctly. More logs do not automatically mean better coverage if the evidence needed for a particular attack is missing or unusable.

Brava says its multi-agent technology models attacker behavior and identifies how specific techniques should appear across a customer’s log sources. Its platform then tests whether those traces would trigger the intended defenses, rewrites missing SIEM detections and addresses data-feed gaps.

“You can’t automate a decision based on evidence no one ever proved,” said Idan Basre, Brava’s co-founder and CEO, who previously led product management for Microsoft Defender.

The distinction between generating evidence and executing an attack matters. Brava is testing the detection path through synthesized telemetry. That can help expose a silent rule or missing field, but a successful test is not proof that every variation of a real intrusion will be caught or that an attacker could not reach the system.

Closing the Loop Between a Rule and an Alert

Brava’s product workflow describes four stages: model the threat, synthesize its telemetry, verify and repair detection gaps, and replay the evidence to confirm an alert appears in the SIEM. It also describes retesting as environments change.

This is a useful distinction from treating an installed rule as verified coverage. A field rename, parser update, or disconnected source can leave a previously useful detection unable to match the activity it was written for. Repeating a test after a change helps determine whether the detection still works with the data it actually receives.

The platform is designed to work with existing security infrastructure. Brava lists Splunk, Google SecOps, CrowdStrike, and more than 70 sources and destinations, reducing the need to replace the tools a security team already operates.

For a detection engineer, the practical value is a more specific answer than a generic coverage score: which evidence should exist, which part of the detection path missed it, and whether the repair produced an alert. Those questions connect an engineering change to an observable result.

Investigation and Data Pipelines Share the Same Foundation

The company’s website adds two related capabilities. Aquarium, its investigation interface, plans searches across sources and links findings to underlying events. Its data-pipeline tooling parses and normalizes records, routes relevant events to the SIEM, and keeps other data in searchable lower-cost storage.

These functions address different parts of the same operational problem. An analyst needs evidence to reconstruct what happened, while a detection rule needs the right fields to fire. Reducing ingestion volume is useful only if the information necessary for detection and investigation remains available.

Brava’s release says the platform delivers initial insights within 10–15 minutes of onboarding. That is a company-reported time to first findings, rather than a guarantee that a complete enterprise deployment or every detection repair finishes within that window.

Enterprise Customers and a Team Built Around AI and Security

Brava reports Fortune 100 customers in retail, energy, and hospitality, alongside Cushman & Wakefield and Canadian healthcare company WELL Health. Cushman & Wakefield CISO Erik Hart said the platform investigates alongside his team and brings evidence together to support decisions.

The company was founded by Basre and CTO Itay Gabbay. Basre spent ten years in Unit 8200 as a threat researcher before his Microsoft role. Gabbay spent seven years building AI systems in the IDF, including work on a joint DARPA-Israeli research program.

Brava has approximately 20 employees, with research and development in Israel and a commercial team expanding in the United States. The funding backs a product that combines AI research with a demanding security-engineering task: modeling how attacks appear in the specific systems an enterprise uses.

The company’s premise is that autonomous security decisions need validated evidence beneath them. The strongest test of that premise will be sustained detection quality as customer environments change: fewer silent rules, fewer missing signals, and repairs that security teams can demonstrate actually work.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.