Brava leaves stealth with $15m to prove whether SIEM detections work

Brava leaves stealth with $15m to prove whether SIEM detections work

4 November 2026: Brava says it has come out of stealth with $15 million in seed funding led by F2 Venture Capital and Pitango, for a platform that tests whether a security team's detection rules would actually fire. It generates the telemetry an attack would leave behind without running the attack, and works alongside an existing SIEM.

Not yet independently verified. The event volumes, customer base and SIEM cost savings are Brava's own figures and have not been independently checked. No valuation is stated. We will update this when it can be confirmed, and remove this note.

Detection taken on faith

Chief executive Idan Basre's argument is about AI agents in the security operations centre. Those agents depend on logs and detection logic that most enterprises cannot prove work, he writes: critical logs may never be collected, pipelines break silently, and rules miss the attacks they were written to catch. "You can't automate a decision based on evidence no one ever proved," he told SecurityWeek.

Brava models attacker behaviour and produces the exact log events an attack would generate in a given environment. That output feeds three functions. Its detection engineering tool tests each rule against the attack it was written for, rewrites silent rules in the SIEM's own query language, and confirms they fire. Aquarium, an investigation agent, takes questions in plain English, searches SIEM data, archived logs, EDR and cloud audit trails, and cites the raw events behind each finding. A pipeline function sends the SIEM only the events detections need and moves the rest to cheaper storage that remains searchable.

The figures Brava gives

Brava says it processes 2.4 trillion events a day across customer environments, and that the pipeline function has cut SIEM cost by 65 to 85% across customers. SecurityWeek reports that the company claims first insights within 10 to 15 minutes of onboarding, integrations with more than 70 sources and destinations, and no changes needed to existing security infrastructure.

That saving depends on how a SIEM is priced: a licence based on ingest volume responds to log reduction, and one based on users or assets may not.

The founders and where the money goes

Basre and chief technology officer Itay Gabbay founded the Tel Aviv company in 2024. Basre led product management at Microsoft Defender after a career as a threat researcher. Several angel investors joined the two lead funds.

The new capital goes into the technology and into growth across North America, naming financial services, government and energy as sectors. SecurityWeek says the company has a research and development team in Israel and a commercial operation it is expanding.

Where it sits in our catalogue

Our SIEM software category lists 15 products. Brava is not yet listed with us.

Sources

• Brava: Announcing Brava, Ground Truth for SecOps, 4 November 2026
• SecurityWeek: Brava Security emerges from stealth with $15 million in funding, 8 November 2026