Brava Security

Cover Block

Public sources

Field	Value
Name	Brava Security
Tagline	AI-native security operations platform that simulates attacks to improve detections and reduce ingest volume. [Calcalistech, November 2026]
Headquarters	Newark, 37256 Acorn Place [CB Insights, retrieved 2026]
Founded	2024 [Calcalistech, November 2026]
Stage	Seed [Calcalistech, November 2026]
Business Model	SaaS
Industry	Security
Technology	AI / Machine Learning
Geography	Middle East / North Africa
Growth Profile	Venture Scale
Founding Team	Co-Founders (2), Idan Basre and Itay Gabbay [Calcalistech, November 2026]
Funding Label	Seed
Total Disclosed Funding	~$15,000,000 [Calcalistech, November 2026]

Links

Public sources

• Website: https://www.brava.security/
• AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-can63wixijaze

Executive Summary

PUBLIC Brava Security is building an AI-native security operations platform that simulates attacker behavior by generating the telemetry an attack would leave behind, a framing that is getting investor attention because the company emerged from stealth with a $15 million seed round on November 4, 2026 [Calcalistech, November 2026] [Axios Pro, November 2026]. Founded in 2024 by Idan Basre and Itay Gabbay, the company is positioning itself around a narrow but relevant problem in enterprise security: whether existing controls actually detect the evidence of real attacker behavior, rather than merely collecting more alerts or more log volume [Calcalistech, November 2026] [HackerNoon, November 2026].

The product claim is specific enough to matter. Brava says its multi-agent system models attacker behavior, synthesizes the telemetry that behavior would create in a given environment without executing the attack, and then tests whether the customer’s current security stack detects it; public reporting also says the platform integrates with Splunk, Google SecOps, CrowdStrike, and more than 70 other sources and destinations, with initial findings available within 10 to 15 minutes of onboarding [Brava Security] [Calcalistech, November 2026]. If that workflow performs as described, the differentiation rests less on replacing incumbent SOC tooling and more on acting as an evidence layer that helps enterprises validate detections and reduce SIEM strain [HackerNoon, November 2026] [AWS Marketplace].

The founding story is credible on paper, though still early in public-market proof. Brava describes Basre as a Talpiot alumnus who spent roughly a decade researching attacker behavior in Unit 8200 before moving into product leadership at Microsoft Defender, while Calcalistech identifies Gabbay as the technical co-founder and CTO [Brava Security] [Calcalistech, November 2026]. That mix, assuming execution follows, is relevant to a category where technical trust and integration depth tend to matter at least as much as model novelty.

On capitalization, the company has disclosed a $15 million seed round led by F2 Venture Capital and Pitango VC, with participation from executives affiliated with Anthropic, Microsoft, and Check Point; the business model is SaaS, aimed at enterprise security teams and SOCs [Calcalistech, November 2026]. Public customer references cited in launch coverage include Cushman & Wakefield, WELL Health, and unnamed Fortune 100 companies in retail, energy, and hospitality, but those claims still sit close to launch-period reporting and merit follow-through on deployment depth and renewal behavior [Calcalistech, November 2026] [HackerNoon, November 2026].

Over the next 12 to 18 months, the central question is whether Brava can convert an interesting detection-validation wedge into durable enterprise adoption without leaning too heavily on company-reported performance claims such as lower SIEM cost [Brava Security]. The near-term watchpoints are customer expansion beyond named references, evidence that integrations translate into production workflow usage, and cleaner public visibility on team scale, where available sources currently conflict between roughly 20 and 61 employees [Finanzwire, November 2026] [LeadIQ, October 2026].

Company-stated, unverified -- This section relies on a mix of independent launch coverage and material product and founder-background claims that remain company-sourced.

Taxonomy Snapshot

Axis	Value
Stage	Seed
Business Model	SaaS
Industry / Vertical	Security
Technology Type	AI / Machine Learning
Geography	Middle East / North Africa
Growth Profile	Venture Scale
Founding Team	Co-Founders (2)
Funding	Seed, total disclosed approximately $15,000,000

How the Company Got Here

PUBLIC

Brava Security presents as a very new security company, and the public record is still thin enough that chronology matters more than narrative flourish. The company says it was founded in 2024, with Idan Basre and Itay Gabbay as co-founders, and its website frames the business around security operations teams that need to test whether their existing controls would actually surface meaningful attack evidence in their own environments [Brava Security].

The disclosed milestones are narrow but clear. Brava remained in stealth until November 4, 2026, when it announced a $15 million seed round led by F2 Venture Capital and Pitango VC; that financing effectively doubles as the company’s first broad public introduction [Brava Security]. The same public materials identify Basre as chief executive and Gabbay as chief technology officer, but they do not establish a public legal-entity name or a verifiable headquarters record from the permitted source set used for this section [Brava Security].

Company-stated, unverified -- This section relies primarily on company website disclosures, with no Crunchbase or state-filing corroboration used here.

Product and Technology

MIXED

The product story is straightforward on the surface, and more interesting once the mechanism is unpacked. Brava Security says it sells an AI-native security operations platform for enterprise security teams and SOCs, with a workflow built around modeling attacker behavior and generating the telemetry that behavior would create inside a customer environment, without running the attack itself [Calcalistech, November 2026] [Brava Security]. In public descriptions, the company frames that output as an "evidence layer" for the modern SOC, meant to test whether existing controls and detections would actually surface the traces a real attacker should leave behind [HackerNoon, November 2026] [Business Insider Markets, November 2026].

The practical claim is that Brava helps teams validate detections before an incident exposes the gap. According to the company website, the platform starts from attacker behavior, synthesizes the digital evidence that behavior would generate, and checks whether the customer's current stack detects it [Brava Security]. Press coverage is somewhat more conservative but directionally aligned, describing a system that can identify detection gaps without requiring customers to replace their SIEM, endpoint, or cloud-security tooling [Calcalistech, November 2026] [HackerNoon, November 2026].

A second piece of the pitch is operational fit inside existing security infrastructure. Calcalistech reported that Brava integrates with Splunk, Google SecOps, CrowdStrike, and more than 70 other data sources and destinations, and that initial findings can be produced within 10 to 15 minutes of onboarding [Calcalistech, November 2026]. The AWS Marketplace listing uses similar language around bringing cloud context into the SecOps stack and reducing data strain, while the company website adds claims spanning detection engineering, investigation support, SIEM hygiene, and 65 to 85 percent lower SIEM cost across customers [AWS Marketplace] [Brava Security]. That last cost-reduction figure should be treated as a company claim rather than an independently verified benchmark.

The main analytical point is that Brava appears to be positioning itself less as a replacement control and more as a validation and context layer that sits on top of incumbent systems. That can be a useful wedge in security, because buyers often prefer products that improve existing workflows rather than force a full-platform rip-and-replace, but the current public record is still light on verified implementation detail beyond integrations, onboarding speed, and a handful of named customer references in launch coverage [Calcalistech, November 2026] [The Next Web, November 2026].

Company-stated, unverified -- This section relies materially on company website and marketplace claims, with partial corroboration from Calcalistech, HackerNoon, Business Insider Markets, and The Next Web.

Where the Demand Sits

PUBLIC

Security operations remains an active budget line because enterprises are adding more telemetry, more cloud services, and more AI-assisted tooling at the same time, which raises the cost of deciding what evidence matters and what can be ignored [AWS Marketplace] [Calcalistech, November 2026].

The record here is thinner on formal market sizing than on product demand, so the market view has to stay close to what public sources actually support. No named third-party TAM, SAM, or SOM report was captured for Brava or for its exact category, which appears to sit at the intersection of security operations, detection engineering, validation, and SIEM cost control [Calcalistech, November 2026] [AWS Marketplace]. Public materials instead point to the operating problem: Brava positions itself for enterprise security teams and SOCs that already run tools such as Splunk, Google SecOps, and CrowdStrike, and want to test whether their existing controls would surface the evidence of likely attacker behavior [Calcalistech, November 2026] [Brava Security]. That framing suggests the immediate spend pool is less a greenfield security category than a budget reallocation inside mature SOC environments.

Demand drivers are clearer than market size. Brava's public pitch rests on two pressures that are familiar to large security teams: gaps in detection coverage and the rising strain of telemetry ingest [HackerNoon, November 2026] [AWS Marketplace]. The company says its platform can integrate with more than 70 data sources and destinations and surface initial findings within 10 to 15 minutes of onboarding, which, if borne out in production, aligns with buyers looking for faster validation without replacing incumbent infrastructure [Calcalistech, November 2026]. The same sources also frame the product as a way to reduce SIEM data burden and improve "SIEM hygiene," which connects Brava to budget conversations that often sit with security engineering and platform owners rather than only with incident response teams [Brava Security] [AWS Marketplace].

The adjacent markets matter because Brava is unlikely to be bought in isolation. Its wedge overlaps with attack simulation, exposure validation, detection engineering, cloud log enrichment, and broader SecOps workflow layers, even though the sources do not name direct competitors [Brava Security] [HackerNoon, November 2026]. Cloudots, described in LinkedIn posts as an open knowledge base for cloud security logs, also hints at a potential ecosystem play around log semantics and evidence normalization, though that remains a company-adjacent signal rather than a validated distribution channel [LinkedIn] [LinkedIn]. In practice, that means Brava may be evaluated against internal engineering effort, existing SIEM content work, and adjacent security validation tools, not only against purpose-built startups.

Regulatory and macro forces are present indirectly rather than explicitly. Public sources tie Brava's value proposition to enterprise sectors including retail, energy, hospitality, and healthcare through named or described customers, all of which operate under persistent pressure to document control effectiveness and investigate incidents with defensible evidence trails [Calcalistech, November 2026] [HackerNoon, November 2026]. The broader macro backdrop is that security teams are being asked to adopt AI while also proving that automation is improving outcomes instead of widening blind spots; Brava's "evidence layer" positioning is tailored to that tension [Business Insider Markets, November 2026] [HackerNoon, November 2026]. The commercial question is whether that framing translates into a durable software category or remains a feature priority inside larger SecOps platforms.

Cited market signal	What the source supports	Relevance to Brava
Enterprise SOC integrations	Brava says it integrates with Splunk, Google SecOps, CrowdStrike, and 70+ other sources and destinations [Calcalistech, November 2026]	Indicates the target environment is the existing enterprise SOC stack, not a net-new control plane
Time-to-value claim	Brava says initial findings can be produced within 10 to 15 minutes of onboarding [Calcalistech, November 2026]	Suggests buyers may prioritize quick validation over long implementation cycles
SIEM cost reduction claim	Brava says customers see 65 to 85% lower SIEM cost [Brava Security]	Points to budget pull from ingest optimization and log-efficiency conversations, though this remains company-only
Cloud log knowledge base	LinkedIn posts describe Cloudots as an open, free knowledge base for cloud security logs [LinkedIn] [LinkedIn]	Suggests adjacency to cloud telemetry normalization and detection content workflows

The evidence supports a real pain point around detection coverage and telemetry overload, but not yet a well-bounded standalone market definition. For now, the public case is strongest when Brava is viewed as infrastructure for improving existing SOC economics and detection confidence inside large enterprises, rather than as a neatly measured category with third-party sizing behind it.

Company-stated, unverified -- Core market interpretation relies on a mix of one independent news source, company materials, and LinkedIn posts, with no captured third-party market sizing report for the category.

Competitive Landscape

MIXED Brava is positioning itself less as a replacement for the security stack than as a new control point that sits between attack simulation, detection engineering, and SIEM cost management, which puts it in competition with several categories at once rather than one clean peer set [Calcalistech, November 2026] [HackerNoon, November 2026] [AWS Marketplace].

The competitive map is therefore easiest to read by segment. Among incumbents, Brava integrates with platforms such as Splunk, Google SecOps, and CrowdStrike, which suggests those vendors are current ecosystem dependencies first and possible product-overlap risks second [Calcalistech, November 2026]. If Brava's value is to generate organization-specific attack evidence and test whether existing controls would catch it, then the nearest substitute is not necessarily another early-stage startup, but the combination of native SIEM detections, internal detection engineering teams, and the validation tooling already bundled into large security platforms [Brava Security] [Calcalistech, November 2026]. In adjacent categories, cloud log knowledge bases and workflow tooling can also absorb pieces of the problem, particularly if buyers decide they want narrower utilities rather than a new operating layer [AWS Marketplace] [LinkedIn].

What looks differentiated today is the product framing, not yet a demonstrated go-to-market moat. Brava says its multi-agent system starts from attacker behavior, synthesizes the telemetry an attack would create without executing that attack, and then checks whether the customer's controls detect the evidence [Brava Security] [Calcalistech, November 2026]. That is a more specific wedge than a broad AI-for-SOC claim, and it may resonate with enterprise teams that want to improve coverage without replacing existing infrastructure [HackerNoon, November 2026]. The durability of that edge is still unsettled. Product concepts around simulated evidence, detection validation, and SIEM hygiene can matter if they become deeply embedded in analyst workflows, but they are also the sort of features larger platform vendors could absorb if customer demand proves real [Brava Security] [AWS Marketplace].

The company's clearest exposure is distribution. Splunk, Google SecOps, and CrowdStrike already control budgets, data flows, and analyst attention inside many SOCs, while Brava, by public record, is only just emerging from stealth with a seed round and an unverified employee base that ranges from about 20 to about 61 depending on source coverage [Calcalistech, November 2026] [Finanzwire, November 2026] [LeadIQ, October 2026]. That matters because the pitch depends on integrations, trust, and fast onboarding. Brava says it can produce initial findings within 10 to 15 minutes and connect to more than 70 data sources and destinations, which helps lower deployment friction, but those same integration claims also underline how much of the operating environment is owned by others [Calcalistech, November 2026]. If major platform vendors choose to push further into validation and evidence generation, Brava would be competing from a weaker channel position.

Over the next 18 months, the most plausible competitive scenario is that the category gets defined by whether buyers treat detection validation as a stand-alone budget item or as a feature inside broader SOC platforms. Splunk would be a likely winner if large enterprises consolidate on existing vendors and prefer incremental tooling attached to current SIEM workflows, because it already sits at the center of log analysis and detection operations in many environments [Calcalistech, November 2026]. Brava could still win if the market rewards vendor-neutral validation and measurable ingest reduction, especially given its public claim of 65 to 85 percent lower SIEM cost across customers, though that figure remains company-reported and uncorroborated [Brava Security]. The most likely loser if platform bundling accelerates is any independent layer whose value is legible only after integration work, and Brava fits that risk profile more than the incumbents do [AWS Marketplace] [Calcalistech, November 2026].

Company-stated, unverified -- This section relies on named public integrations and funding coverage from Calcalistech plus company-reported product claims from Brava's website and marketplace listing; no independently verified named startup competitors were present in the source set.

Opportunity

PUBLIC The prize here is not another point tool inside the SOC, but a credible shot at becoming the control layer enterprises use to prove whether their existing detection stack actually works, a position that could matter across every large security program already spending heavily on SIEM, endpoint, and cloud telemetry [Calcalistech, November 2026] [HackerNoon, November 2026] [AWS Marketplace].

The headline opportunity is straightforward. If Brava can become the default system for evidence-driven detection validation, it sits upstream of renewal and budget decisions for the rest of the stack. That is reachable, rather than merely aspirational, because the company is not asking buyers to rip out incumbent tools. Public reporting says the platform integrates with Splunk, Google SecOps, CrowdStrike, and more than 70 other sources and destinations, and can produce initial findings within 10 to 15 minutes of onboarding [Calcalistech, November 2026]. For an enterprise security team, that lowers adoption friction materially.

The second reason the outcome is plausible is that Brava is emerging at a moment when enterprises are adding more AI-assisted security tooling, not less, while still struggling to verify what those systems miss. Brava's pitch, according to coverage at launch, is to model attacker behavior and synthesize the telemetry an attack would generate without executing the attack, then test whether existing controls detect that evidence [Calcalistech, November 2026] [Business Insider Markets, November 2026]. If that workflow becomes a regular operating motion inside the SOC, Brava could evolve from a validation product into a budgeting and workflow anchor.

Scenario	What happens	Catalyst	Why it's plausible
Land-and-expand in large enterprises	Brava starts with detection validation, then broadens into a standard layer for detection engineering, investigation support, and SIEM hygiene across large SOCs	A referenceable base of Fortune 100 deployments and named customers such as Cushman & Wakefield and WELL Health converting into broader estate rollouts [Calcalistech, November 2026] [HackerNoon, November 2026]	The product is positioned to improve coverage without replacing existing infrastructure, which usually makes enterprise expansion easier than platform displacement [HackerNoon, November 2026]
Become the evidence layer across major security stacks	Brava becomes a common control point sitting on top of incumbent platforms such as Splunk, Google SecOps, and CrowdStrike	Deepening integrations across the more than 70 cited data sources and destinations, making deployment and expansion operationally simple [Calcalistech, November 2026]	Integration breadth is already central to the launch narrative, and the company explicitly frames the product as an "evidence layer" rather than a standalone replacement system [HackerNoon, November 2026]
Win on cost and signal quality	Brava turns from a coverage product into a budget line item by showing that better evidence generation can also reduce ingest volume and SIEM spend	Customer proof that its claimed SIEM cost reduction translates into procurement use at renewal time [Brava Security] [AWS Marketplace]	The company publicly ties its value proposition to reduced data strain and, on its website, to lower SIEM cost, which aligns with a live enterprise pain point even if the magnitude remains company-reported [AWS Marketplace] [Brava Security]

These scenarios point to the same compounding mechanism. Each successful deployment can make the next one easier if Brava accumulates reusable knowledge about what attack behavior should look like across common enterprise environments and how major controls respond to that evidence. The company is already presenting itself as a system that brings cloud context into the SecOps stack and helps with detection engineering and investigation, which suggests a product surface broader than a one-time assessment [AWS Marketplace] [Brava Security].

Compounding would show up in three places. First, integration depth can create distribution lock-in because a product that already plugs into Splunk, Google SecOps, CrowdStrike, and dozens of other destinations becomes easier to standardize across a security team than a greenfield tool [Calcalistech, November 2026]. Second, evidence libraries and cloud-log knowledge assets such as the reported Cloudots initiative could improve customer onboarding and detection coverage over time, though that remains company-adjacent and lightly verified [LinkedIn]. Third, if Brava can validate detections while also reducing unnecessary ingest, the economic argument broadens from security efficacy into infrastructure efficiency, which can widen budgets and strengthen renewals [Brava Security] [AWS Marketplace].

The size of the win is easiest to frame through category position rather than present revenue, which is not publicly disclosed. In the upside case, Brava becomes a strategic control plane for detection assurance inside large enterprises, sitting close enough to SIEM, EDR, and cloud telemetry to influence budget allocation and operating workflow. The company raised a $15 million seed led by F2 Venture Capital and Pitango VC as it emerged from stealth in November 2026, with participation from executives associated with Anthropic, Microsoft, and Check Point, which is a meaningful signal of early ecosystem credibility for a 2024-founded company [Calcalistech, November 2026] [Axios Pro, November 2026].

A conservative public takeaway is that the company could become valuable well before it needs to replace any incumbent. If scenario one or two plays out, Brava could plausibly mature into a strategic acquisition target for a larger security platform vendor seeking a native detection-validation and telemetry-efficiency layer, or into a standalone platform of meaningful scale inside enterprise security operations (scenario, not a forecast) [Calcalistech, November 2026] [Business Insider Markets, November 2026]. Public sources do not provide the market-sizing or comparable-company data needed to support a tighter valuation range, so the upside case rests on strategic position and workflow centrality rather than a quantified TAM claim.

Lightly corroborated -- Core funding, product positioning, integration claims, and named customers are supported by launch coverage from Calcalistech, Axios Pro, HackerNoon, Business Insider Markets, and AWS Marketplace. Several compounding elements, including founder background details and Cloudots, rely on company or LinkedIn sources only.

Sources

Public sources

1. [Calcalistech, November 2026] Unit 8200 and Microsoft veterans raise $15 million Seed for cybersecurity startup Brava | https://www.calcalistech.com/ctechnews/article/syl22sopze

2. [CB Insights, retrieved 2026] Brava - Products, Competitors, Financials, Employees, Headquarters Locations | https://www.cbinsights.com/company/brava

3. [Axios Pro, November 2026] Exclusive: Brava Security launches with $15M | https://www.axios.com/pro/enterprise-software-deals/2026/11/04/brava-security-seed-pitango

4. [HackerNoon, November 2026] Brava Raises $15M to Address the Blind Spots in AI-Powered Cybersecurity | https://hackernoon.com/brava-raises-$15m-to-address-the-blind-spots-in-ai-powered-cybersecurity

5. [Brava Security] Brava Security | Ground Truth for SecOps | https://www.brava.security/

6. [AWS Marketplace] Brava Security - AWS Marketplace | https://aws.amazon.com/marketplace/pp/prodview-can63wixijaze

7. [LeadIQ, October 2026] Bravura Security Employee Directory, Headcount & Staff | https://leadiq.com/c/bravura-security/5a1d7c7c2400002400563c85/employee-directory?page=1

8. [Finanzwire, November 2026] Brava Raises $15M to Close the Visibility Gap in Enterprise Cyber Defense | https://www.finanzwire.com/press-release/brava-raises-15m-to-close-the-visibility-gap-in-enterprise-cyber-defense-n3apNUplm9Y

9. [Business Insider Markets, November 2026] Brava Raises $15M to Close the Visibility Gap in Enterprise Cyber Defense | https://markets.businessinsider.com/news/currencies/brava-raises-15m-to-close-the-visibility-gap-in-enterprise-cyber-defense-1036714766

10. [The Next Web, November 2026] Brava secures $15M to help security teams find threats their systems miss | https://thenextweb.com/news/brava-security-15m-seed-f2-pitango-ai-soc-telemetry

11. [LinkedIn] Amir Basre - Velocity | LinkedIn | https://www.linkedin.com/in/amir-basre/

12. [LinkedIn] Gideon Knocke - Visage Imaging | LinkedIn | https://www.linkedin.com/in/gideonknocke/