供资
Brava Security 融资 1 5M 种子在北美扩展AI SecOps
在 Google 上的首选来源中添加 Unite.AI
Brava Security 宣布于2026年11月4日以F2 Venture Capital和Pitango牵头的1500万美元的种子资金从偷盗中崛起，同时有一个多agent平台，旨在测试安全工具是否真的能探测攻击。
该回合包括天使投资者，他们是Anthropic,Microsoft和Check Point的主管。 首都被指定用于布拉瓦的技术和整个北美的增长，包括金融服务，政府和能源。 Brava 称已经与"财富"100家公司在零售，能源和招待领域合作。
发布解决了AI驱动的安全操作中的一个弱点：agent可以就它承认的威胁作出决定，同时仍然不知道其基础防御无法探测的攻击。 布拉瓦将缺失的日志采集，静静断裂的遥测管道和缺陷的检测逻辑确定为潜在原因。
在不发生攻击的情况下生成证据
Brava合作AI agents模式攻击者的行为，这一过程独立于现有的检测规则和预先界定的测试，确定在测试它们目前捕获的是什么之前，防御者应该识别什么。
该平台与客户现有的SIEM同时工作。 它的检测-工程功能检查攻击当前防御识别的步骤，识别保持缄默的规则，然后它重新播放证据来证实真的警报出现
预定的游戏日会在环境变化后重复验证。 证据支持的地图显示了验证的，部分的，盲的和缺失的遥测区域，而表面的失败包括破损的探测，计程漂移和枯木源。
Aquarium)，调查agent，接受纯英语问题，计划和调整查询，并搜索SIEM，存档日志，EDR和云审计线索。 其报告将每一项调查结果与根本事件联系起来。
数据管道函数向SIEM发送检测所需的事件，并将其他数据移动到可搜索，低成本的存储中而不是删除。 Brava报道说，这条线路将SIEM的成本在客户降低了65-85%.
报告的规模和早期部署
布拉瓦称平台支持超过70个源头和目的地，包括斯普伦克，Microsoft Sentinel,Google SecOps,CrowdStrike NG-SIEM，弹性安全以及IBM QRadar，一个SIEM连接后10–15分钟即可初步发现。
该公司报告客户环境中的下列四舍五入的每日测量结果：读取和指纹2.4万亿事件，重播1 100个攻击技术，重新测试3 800次检测，每天绘制140 000个实地图。
在Brava发表的一份证词中，称先生说，“持续的探测工程确保我们永远没有死规则，并不断增加新的探测。
平台背后的创建者
创始人传记认定伊丹·巴斯尔为纽约联合创始人兼CEO，伊泰·加布伊为联合创始人，特拉维夫为CTO. Basre，一名Talpiot校友，在Microsoft Defenders进入产品领导之前，花了十年时间在8200单元研究攻击者的行为。 Gabbay领导了美国-以色列DARPAAI联合研究，开发了自主AI系统，并领导了企业AI安全举措。
Brava的扩展基于AI辅助安全操作的具体前提：自动化取决于其下的遥测和检测逻辑的质量。 该平台使用一个证据层来验证辩护，支持调查，并决定哪些数据属于SIEM. 尚未解决的问题是，所报告的发现和成本效益能否随着客户环境的变化而持续。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Funding
Brava Security Raises $15M Seed to Expand AI SecOps in North America
Add Unite.AI to your preferred sources on Google
Brava Security announced on November 4, 2026 that it was emerging from stealth with $15 million in seed funding led by F2 Venture Capital and Pitango, alongside a multi-agent platform designed to test whether security tools would actually detect an attack.
The round includes angel investors who are executives at Anthropic, Microsoft and Check Point. The capital is designated for Brava’s technology and growth across North America, including financial services, government and energy. Brava says it already works with Fortune 100 companies in retail, energy and hospitality.
The launch addresses a weakness in AI-driven security operations: an agent can make decisions about threats it recognizes while remaining unaware of attacks that its underlying defenses fail to detect. Brava identifies missing log collection, silently broken telemetry pipelines and flawed detection logic as potential causes.
Generating Evidence Without Running Attacks
Brava’s cooperating AI agents model attacker behavior and synthesize the telemetry an attack would produce across a customer’s environment without executing it. The process operates independently of existing detection rules and predefined tests, establishing what defenses should recognize before testing what they currently catch.
The platform works alongside the customer’s existing SIEM. Its detection-engineering function checks which attack steps current defenses recognize, identifies rules that stay silent, and writes missing detections in the SIEM’s own query language using only fields present in the generated evidence. It then replays that evidence to confirm that a real alert appears.
Scheduled game days repeat the validation after environmental changes. Evidence-backed maps show validated, partial, blind and missing-telemetry areas, while surfaced failures include broken detections, schema drift and dead log sources.
Aquarium, the investigation agent, accepts plain-English questions, plans and adjusts queries, and searches the SIEM, archived logs, EDR and cloud audit trails. Its reports link each finding to the underlying raw events.
The data-pipeline function sends events needed by detections to the SIEM and moves other data to searchable, low-cost storage rather than deleting it. Brava reports that this routing has cut SIEM costs by 65–85% across customers.
Reported Scale and Early Deployments
Brava says the platform supports more than 70 sources and destinations, including Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike NG-SIEM, Elastic Security and IBM QRadar, with initial insights available 10–15 minutes after a SIEM is connected.
The company reports the following rounded daily measurements across customer environments: 2.4 trillion events read and fingerprinted, 1,100 attack techniques replayed, 3,800 detections retested and 140,000 fields mapped each day.
WELL Health CISO Iain Paterson said in a testimonial published by Brava that the platform helped his organization build and operationalize a new SIEM in weeks. “The continuous detection engineering makes sure that we never have dead rules and constantly have new detections being added,” he said.
Founders Behind the Platform
The founder biographies identify Idan Basre as co-founder and CEO in New York and Itay Gabbay as co-founder and CTO in Tel Aviv. Basre, a Talpiot alumnus, spent a decade researching attacker behavior in Unit 8200 before moving into product leadership at Microsoft Defender. Gabbay led joint US–Israeli DARPA AI research, developed autonomous AI systems and led enterprise AI security initiatives.
Brava’s expansion rests on a specific premise for AI-assisted security operations: automation depends on the quality of the telemetry and detection logic beneath it. The platform uses one evidence layer to validate defenses, support investigations and decide which data belongs in the SIEM. The open question is whether the reported detection and cost benefits can be sustained as customer environments change.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.