Announcing Brava: Ground Truth for SecOps

Ask a SOC leader whether they would catch a specific attack tomorrow, and you will usually get a "we are not certain".

"There is a rule for it. The dashboard is green." But nobody has seen that rule fire on that attack, in that environment, against today's log sources. The honest answer is: we hope so.

Today, Brava is coming out of stealth with $15 million in seed funding led by F2 Venture Capital and Pitango, with participation from angel investors including executives from Anthropic, Microsoft and Check Point. We already work with Fortune 100 companies across retail, energy and hospitality, and our momentum in the market keeps growing.

Brava is a Security Operations Platform that injects certainty into the entire threat detection lifecycle. Our multi-agent system synthesizes the evidence real attacks would leave, so you know what your defenses would catch, and what they wouldn’t. Every day, Brava processes 2.4 trillion events across customer environments, with thousands of detections proven daily.

Detection taken on faith

The industry is racing to hand more SOC decisions to AI agents. Those agents depend on security logs and detection logic that most enterprises have no way of proving work. Critical logs may never be collected, telemetry pipelines break silently, and detection logic miss the very attacks they were written to catch.

An AI agent can make thousands of intelligent decisions about the threats it recognizes - while remaining completely unaware of attacks its underlying defenses fail to detect.

Today, most security teams take their detection on faith. We built Brava to replace that hope with proof.

Knowing what an attack looks like before it happens

The hardest problem is knowing what an attack will actually leave behind in your environment, in every log source it touches, before it ever happens. It sits underneath every detection, every investigation and every AI agent in the SOC.

That is what our models were built for. Brava models attacker behavior and generates the exact telemetry an attack would produce in your environment, without executing the attack. That ground truth powers one platform with three jobs, working alongside the SIEM you already run:

• Detection Engineering. Brava tests each rule against the attack it was written for and shows which ones stay silent. It rewrites them in your SIEM's own query language, using only fields the evidence shows are there, then confirms they fire. Broken detections, schema drift and dead log sources surface the day they happen.
• Investigation. Ask Aquarium, our investigation agent, a question in plain English. It plans the queries, searches the SIEM, archived logs, EDR and cloud audit trails in one pass, and writes a report in which every finding cites the raw events behind it.
• Data pipelines. Brava sends your SIEM the events your detections actually need and moves the rest to low-cost storage, where it stays searchable. Across our customers, that has cut SIEM cost by 65–85%.

Why Us

Itay and I have spent our careers on this problem. I'm a Talpiot alumnus and spent ten years in Unit 8200 as a threat researcher before leading product management at Microsoft Defender, where I saw even the strongest security teams lose investigations because the evidence was never collected. Itay spent seven years building core AI systems for the IDF, including leading a joint DARPA-Israeli AI research program. Brava brings both together: a deep understanding of how attacks behave, and the AI to turn it into ground truth for any environment.

The ground truth the SOC runs on

We are building Brava to become the ground truth the SOC runs on: the layer every security tool, and every AI agent, reads from when it needs to know what is real.

Validation, investigation and pipelines are the first three things that ground truth makes possible. Once you know exactly what an attack leaves in your telemetry, you can decide how to collect, what to keep, what to alert on, and what an AI agent should trust.

This funding goes into that technology and into growing across North America, including sectors like financial services, government, and energy.

If you want to see what your SIEM is missing, book a demo. And if you want to help build the ground truth for the AI SOC, we're hiring: see our open roles.