Mave
AI security operations platform that automates threat detection, investigation, and response across existing security tools.
Website: https://www.mave.com/
Cover Block
Publicly reported
| Field | Detail |
|---|---|
| Name | Mave |
| Tagline | AI security operations platform that automates threat detection, investigation, and response across existing security tools. [Mave, retrieved 2026] |
| Headquarters | Toronto, Ontario, Canada [GraphIQ, retrieved 2026] |
| Founded | 2025 [Business Insider, October 2026] |
| Stage | Series A [SiliconANGLE, October 2026] |
| Business model | SaaS |
| Industry | Security |
| Technology | AI / Machine Learning |
| Geography | Middle East / North Africa |
| Growth profile | Venture Scale |
| Founding team | Co-Founders (2), Raziel Oren and Guy Eshel [Mave, retrieved 2026] [Pulse2, retrieved 2026] |
| Funding label | $10M+ |
| Total disclosed funding | Approximately $34,000,000 [SiliconANGLE, October 2026] [Calcalist Tech, October 2026] |
Links
Publicly reported
- Website: https://www.mave.com/
Summary and Signal
PUBLIC Mave is an AI security operations startup that aims to automate threat detection, investigation, and response across a customer’s existing security stack, and it merits investor attention now because it emerged from stealth in October 2026 with $34 million in disclosed funding and a product pitch tied closely to one of the larger pain points in enterprise security, the cost and friction of operating fragmented tools [SiliconANGLE, October 2026] [Calcalist Tech, October 2026] [Mave, retrieved 2026]. Founded in 2025, the company is still early by operating history, but the launch came with a seed round of $6 million and a Series A of $28 million disclosed together, which suggests investors were willing to underwrite both technical ambition and early commercial signals before a long public track record was available [SiliconANGLE, October 2026] [The Top Voices, October 2026].
The product case is straightforward on paper: Mave says it connects existing security tools into one agentic system that handles incidents from first alert through response, and it emphasizes operation without centralized data ingestion, a positioning that could matter for buyers facing SIEM cost pressure or regulated deployment requirements [SiliconANGLE, October 2026] [Mave, retrieved 2026] [Seekr, 2026]. The differentiation, to the extent public evidence supports it today, rests less on replacing incumbent tooling outright and more on orchestrating investigations across the stack enterprises already own, with reported use in regulated financial and healthcare environments and with MSSPs serving hundreds of downstream customers, though named customers have not been disclosed in public coverage [Unite.AI, October 2026] [SiliconANGLE, October 2026].
The founding team reads as sector-native. Chief executive Raziel Oren is described as a Unit 8200 veteran who previously led go-to-market activities at Wing Security, while chief technology officer Guy Eshel is described as a former Unit 8200 major and former Alterya executive, with Ynet reporting that Alterya was later acquired by Chainalysis [The Top Voices, October 2026] [Ynet News, October 2026] [Pulse2]. That combination, commercial leadership on one side and applied security research and engineering on the other, is credible for an enterprise security company selling into sophisticated buyers, even if the public record is still thin on repeatable revenue metrics [Business Insider, October 2026] [Calcalist Tech, October 2026].
From a financing and business model standpoint, Mave appears to be a venture-scale SaaS company backed by Dell Technologies Capital, Emerge Ventures, Red Dot Capital Partners, and Lumir Growth Partners [SiliconANGLE, October 2026] [Calcalist Tech, October 2026]. The main items to watch over the next 12 to 18 months are whether the company can convert broad product claims into verifiable enterprise references, whether reported deployment breadth inside large SOCs translates into durable paid adoption, and whether headcount expansion from roughly 20 to about 30 employees can support both frontier-AI research and a disciplined go-to-market motion without diluting product focus [Business Insider, October 2026] [SiliconANGLE, October 2026] [LinkedIn, retrieved 2026].
One source, partially checked -- Core funding, product positioning, and founder backgrounds are corroborated by multiple named publishers, but several traction signals remain company-linked or single-source.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Series A |
| Business Model | SaaS |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Geography | Middle East / North Africa |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding | $10M+ total disclosed, approximately $34,000,000 [SiliconANGLE, October 2026] [Calcalist Tech, October 2026] |
Company Overview
PUBLIC
Mave entered the public record in 2026 with a simple pitch and a narrow factual footprint. On its website, the company describes itself as an AI security operations platform that automates threat detection, investigation, and response across existing security tools [Mave]. The same source identifies Mave as founded in 2025 and presents the business as built around reducing the operational burden of fragmented security tooling, including the cost of moving data between systems [Mave].
The company lists Toronto, Ontario as its headquarters in the structured source set, and its website identifies co-founders Raziel Oren and Guy Eshel as the principals behind the business [Mave]. Publicly confirmed milestones remain early and concentrated: founding in 2025, operation in stealth prior to its launch materials, and a public financing announcement in October 2026 that brought total disclosed funding to $34 million across seed and Series A rounds [Mave]. There was no legal entity name established in the cited company source used for this section.
No independent source found -- This section relies primarily on the company website, with partial support from the structured source set for headquarters.
The Product and the Stack
MIXED
Mave is selling a fairly specific promise: keep the customer’s existing security stack in place, then use an agentic layer to investigate alerts, hunt threats, and coordinate response across those tools rather than forcing centralized data movement into a new system [Mave, retrieved 2026] [SiliconANGLE, October 2026]. In plain English, the product is positioned as a security operations platform for teams that already have multiple point products and want automation across them, with the company arguing that this avoids the "data tax" of shifting telemetry between systems [Mave, retrieved 2026]. That framing is consistent across the company site and launch coverage, which reduces ambiguity around what Mave says it does, even if the underlying efficacy claims remain largely company-directed [Mave, retrieved 2026] [Calcalist Tech, October 2026].
The deployment story matters because it speaks to where the product may have early fit. Public materials say the platform is already used in regulated financial and healthcare environments, and third-party coverage says Mave targets large enterprises, Fortune 50 companies, and global managed security service providers, including MSSP deployments that reportedly protect hundreds of downstream customers [Unite.AI, October 2026] [SiliconANGLE, October 2026] [Calcalist Tech, October 2026]. The company site also presents the product across a wide set of SecOps use cases, including MDR reduction, SIEM cost reduction, threat hunting, detection engineering, multi-SIEM environments, and multi-tenant operations for MSSPs [Mave, retrieved 2026]. Separate industry coverage indicates that on-premise and air-gapped options can matter in defense, financial services, and healthcare settings, which aligns with Mave's positioning around regulated environments, though that should be read as category context rather than direct proof of Mave's technical implementation details [Seekr, 2026].
One source, partially checked -- Product scope is corroborated by the company website and launch coverage, but several capability and deployment claims remain company-led or singly sourced.
The Market They Are Entering
PUBLIC
This market matters now because security teams are being asked to investigate more alerts, across more tools, with little tolerance for added data movement, staffing lag, or response delay, a combination that creates real demand for automation in security operations [Business Insider, October 2026] [SiliconANGLE, October 2026].
The public record does not provide a named third-party TAM, SAM, or SOM estimate for Mave’s specific segment, so the cleaner approach is to frame the company against adjacent public markets rather than force precision the sources do not support. On the evidence available, Mave sits at the intersection of security operations platforms, SIEM-adjacent tooling, MDR substitution, and AI workflow software for enterprise security teams [Mave, retrieved 2026] [SiliconANGLE, October 2026]. That positioning matters because the company is not asking buyers to adopt a net-new security stack from scratch. Its stated pitch is to connect existing tools into one operating layer, which places it closer to orchestration and investigation automation than to a pure point-detection vendor [SiliconANGLE, October 2026] [Ynet News, October 2026].
Demand drivers in the cited coverage are fairly consistent. Mave and the surrounding press describe a buyer need to automate alert investigation and response across fragmented environments, while avoiding the "data tax" tied to moving security telemetry between systems [Mave, retrieved 2026] [SiliconANGLE, October 2026]. The same sources point to large enterprises and global MSSPs as the primary buyers, which is credible in context: those organizations tend to run multi-tool environments, manage broad customer or business-unit coverage, and face the highest penalty for slow investigation cycles [Calcalist Tech, October 2026] [SiliconANGLE, October 2026].
A second tailwind is regulatory and deployment complexity in sensitive environments. Public reporting says Mave is already deployed in regulated financial and healthcare settings, and third-party commentary on enterprise AI platforms for regulated industries highlights the relevance of on-premise and air-gapped deployment options in defense, financial services, and healthcare [Unite.AI, October 2026] [Seekr, 2026]. That does not establish category-wide buying behavior on its own, but it does support the basic market logic: security products that can operate without centralized ingestion and that can support controlled deployment models may have an easier path into organizations where data residency, auditability, and architecture constraints shape tool choice [Mave, retrieved 2026] [Seekr, 2026].
The adjacent and substitute markets are also clear enough from the product framing. Mave is implicitly competing for budget that might otherwise go to SIEM expansion, SOAR and investigation tooling, managed detection and response services, or internal headcount growth inside the SOC [Mave, retrieved 2026] [SiliconANGLE, October 2026]. Its claim that customers can reduce reliance on MDR and unify multi-SIEM or post-M&A environments suggests a budget path that comes less from adding another standalone security product and more from consolidating operating layers around existing tools [Mave, retrieved 2026]. For investors, that is the more interesting market signal, because consolidation-oriented products can map to larger incumbent budgets if they prove measurable workflow gains.
| Market lens | Public evidence | Why it matters |
|---|---|---|
| Primary buyer set | Large enterprises, Fortune 50 companies, and global MSSPs are identified as target customers or early users [Calcalist Tech, October 2026] [SiliconANGLE, October 2026] | Suggests the company is aiming at high-complexity environments where investigation automation has clearer ROI. |
| Core pain point | Automating threat detection, investigation, and response across existing tools without centralized ingestion [Mave, retrieved 2026] [SiliconANGLE, October 2026] | Places Mave in an operations-efficiency market, not just a detection market. |
| Adjacent budget pools | SIEM cost reduction, MDR replacement or reduction, threat hunting, detection engineering, and multi-SIEM unification are listed solution areas [Mave, retrieved 2026] | Indicates multiple routes into existing security budgets, though these are company-defined categories. |
| Regulated-industry relevance | Deployments are reported in financial and healthcare environments; on-premise and air-gapped options are highlighted as important in regulated sectors [Unite.AI, October 2026] [Seekr, 2026] | Supports the case for demand in sectors where architecture and compliance constraints can limit tool adoption. |
The picture that emerges is less about a neatly bounded TAM and more about a budget realignment inside the SOC. If the cited deployment pattern is representative, Mave is pursuing buyers that already spend heavily on security operations and may be willing to reallocate spend toward automation that works across incumbent systems rather than replacing them outright.
One source, partially checked -- Market framing relies on company materials and named media coverage, with no independent third-party market sizing report specific to Mave’s segment.
The Competitive Field
MIXED Mave is positioning itself less as a replacement SIEM and more as an orchestration layer for security operations teams that want automation across the tools they already run, a stance that places it between incumbent security platforms and newer AI-native SecOps vendors [Mave, retrieved 2026] [SiliconANGLE, October 2026].
The competitive map is clearer by category than by named vendor set, because the source set does not identify direct rivals by company name. On one side sit incumbent platforms and managed services, the products and providers Mave itself says it is designed to displace in part, including fragmented security tooling, managed-security providers, and the costs associated with moving telemetry between systems [Mave, retrieved 2026]. On another sit AI-first SecOps challengers that are also trying to automate alert handling and investigation, although the available public reporting here does not name them directly [SiliconANGLE, October 2026] [Ynet News, October 2026]. A third bucket is adjacent substitute infrastructure, especially on-premise and air-gapped enterprise AI systems for regulated industries, where deployment model can matter as much as product feature depth [Seekr, 2026].
Mave's edge, on the public record, appears to be architectural positioning and founder-market fit rather than demonstrated market share. The company says its platform investigates alerts and coordinates response across existing tools without centralized ingestion, which, if it works as advertised, addresses a real buyer objection around data movement cost and operational disruption [Mave, retrieved 2026] [SiliconANGLE, October 2026]. The founder profile also fits the category: Raziel Oren is described as a former Unit 8200 operator who previously led go-to-market at Wing Security, while Guy Eshel is described as a former Unit 8200 major and a former Alterya R&D leader [The Top Voices, October 2026] [Ynet News, October 2026]. That edge is potentially durable on talent and product design, but still perishable on execution because the evidence for adoption remains mostly company-linked or single-source reporting, not a broad set of named customer references [Calcalist Tech, October 2026] [Unite.AI, October 2026].
The exposure is equally visible. Incumbent platforms have the advantage of installed base, procurement familiarity, and existing telemetry ownership, while managed security providers control service relationships that can be hard for a software vendor to dislodge even when automation economics are attractive [Mave, retrieved 2026] [SiliconANGLE, October 2026]. Mave also does not appear, from the reviewed sources, to own a proprietary distribution channel, a named systems integrator network, or a list of disclosed lighthouse customers that would make competitive claims easier to validate publicly [Calcalist Tech, October 2026] [Unite.AI, October 2026]. The company says MSSP deployments protect hundreds of downstream customers and that the product is running in more than 200 large SOCs, but both points rest on limited corroboration and need cautious treatment until repeated by independent sources [SiliconANGLE, October 2026] [LinkedIn, retrieved 2026].
The most plausible 18-month scenario is a market split rather than a single-category winner. Mave is well placed if enterprise buyers continue to prefer automation layered onto existing security stacks, especially in regulated environments where on-premise and air-gapped options matter and rip-and-replace projects remain unattractive [SiliconANGLE, October 2026] [Seekr, 2026]. In that case, Mave is a winner if integration-first SecOps buying persists. The likely loser if that assumption breaks is the broader managed detection and response substitution thesis embedded in Mave's own positioning, because buyers may keep human-heavy providers in place longer than software vendors expect [Mave, retrieved 2026]. The reverse scenario is also credible: incumbent platforms win if customers consolidate further around existing control points and demand fewer standalone automation layers, a risk that remains live until Mave's public proof points extend beyond funding, founder pedigree, and high-level deployment claims [Business Insider, October 2026] [SiliconANGLE, October 2026].
One source, partially checked -- Competitive framing is grounded in Mave's stated positioning and named-publisher coverage, but the source set does not identify direct competitors by name and several adoption claims rely on single-source or company-linked evidence.
Opportunity
PUBLIC
The prize here is unusually large if Mave executes, because security operations is a budget line that already exists at major enterprises and MSSPs, and the company is trying to sit above that spend rather than replace it tool by tool [SiliconANGLE, October 2026] [Calcalist Tech, October 2026].
The headline opportunity is to become a control layer for enterprise security operations, the system that investigates alerts and coordinates response across the tools a customer already runs [SiliconANGLE, October 2026] [Mave, retrieved 2026]. That outcome is reachable, not merely aspirational, because the public record shows three things in combination: Mave emerged with $34 million in disclosed funding, which is meaningful early balance-sheet support for a security infrastructure company [SiliconANGLE, October 2026] [Calcalist Tech, October 2026]; the founders bring directly relevant backgrounds in Unit 8200, Wing Security, and Alterya, which maps to both security credibility and product-building context [The Top Voices, October 2026] [Ynet News, October 2026]; and the company says its platform is already running in large SOC environments and regulated industries, where workflow displacement is typically slow and hard won [LinkedIn, retrieved 2026] [Unite.AI, October 2026]. The core strategic idea is straightforward: if Mave can automate investigation and response across existing stacks without centralized ingestion, it can attach to entrenched budgets while arguing for lower operational friction and lower data-movement costs [SiliconANGLE, October 2026] [Mave, retrieved 2026].
There are a few plausible paths to massive scale, and each depends on a different catalyst rather than a single all-or-nothing adoption curve.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| SOC control plane | Mave becomes the operational layer used by large enterprises to triage, investigate, and coordinate response across existing security tools | A visible concentration of deployments in large SOCs and proof that teams can use the product daily inside existing workflows | Public materials describe Mave as handling threats from first alert through response, and one team member's LinkedIn profile says the product is running in more than 200 large SOCs [SiliconANGLE, October 2026] [LinkedIn, retrieved 2026] |
| MSSP multiplier | A smaller number of MSSP wins turns into broad indirect coverage across many downstream tenants | Multi-tenant product maturity and referenceable MSSP deployments | Coverage says global MSSPs use Mave and that MSSP deployments reportedly protect hundreds of downstream customers, which suggests distribution can compound faster than direct enterprise sales alone [SiliconANGLE, October 2026] [Calcalist Tech, October 2026] |
| Regulated-industry standard | Mave becomes a preferred SecOps layer for financial services, healthcare, and other environments that need tighter deployment control | Demand for on-premise or air-gapped AI operations in regulated settings | Public sources place the product in regulated financial and healthcare environments, and broader commentary on AI platforms for regulated industries points to the relevance of on-premise and air-gapped options [Unite.AI, October 2026] [Seekr, 2026] |
What compounding looks like is less about a classic consumer network effect and more about workflow entrenchment. If Mave is used multiple times per day by analysts and incident responders, the product has a chance to become the place where investigation starts and where action is coordinated, which raises switching costs over time [LinkedIn, retrieved 2026]. The company has also described a posture that avoids centralized ingestion and instead connects existing tools into one agentic system, which matters because customers can adopt an orchestration layer faster than they can rip out a SIEM, MDR arrangement, or detection stack [SiliconANGLE, October 2026] [Mave, retrieved 2026]. In the MSSP case, one deployment can expand into many end customers, while in regulated verticals a successful reference tends to travel well because adjacent buyers share similar compliance and architecture constraints [SiliconANGLE, October 2026] [Unite.AI, October 2026].
The size of the win cannot be pinned to a public TAM figure from the source set, so the cleanest way to frame upside is strategic position rather than spreadsheet precision. If Mave becomes a default SecOps control layer across large enterprises and MSSPs, it would resemble the kind of security platform asset that can command outsized strategic value because it sits in the daily operational path of detection and response (scenario, not a forecast) [SiliconANGLE, October 2026] [Calcalist Tech, October 2026]. That is the difference between a useful point product and an infrastructure company: the former sells features, the latter becomes embedded in how security teams work. The public evidence is still early and partially company-shaped, but it is enough to support a serious upside case.
Thinly sourced -- This section relies on a mix of independent reporting and company claims, with several material usage and deployment signals supported only by single-source or LinkedIn-based evidence.
Sources
Publicly reported
[Mave, retrieved 2026] AI Security Operations Platform | Mave | https://www.mave.com/
[GraphIQ, retrieved 2026] Mave Headquarters & Office Locations | GraphIQ | https://graphiq.ai/dossier/mave
[Business Insider, October 2026] This startup raised $34 million to help security teams keep up with AI threats. Read the pitch deck. | https://www.businessinsider.com/mave-startup-cybersecurity-funding-ai-agents-pitch-deck-2026-10
[SiliconANGLE, October 2026] Mave raises $34M to pull existing security tools into one agentic system | https://siliconangle.com/2026/10/22/mave-raises-34m-to-pull-existing-security-tools-into-one-agentic-system/
[Pulse2, retrieved 2026] Mave: $34 Million Raised For Agentic AI Security Operations Platform | https://pulse2.com/mave-34-million-raised-for-agentic-ai-security-operations-platform/
[Calcalist Tech, October 2026] Cyber startup Mave raises $28 million Series A to automate threat investigations | Ctech | https://www.calcalistech.com/ctechnews/article/h1sq8ip2mx
[The Top Voices, October 2026] Mave Launches With $34M in Funding | https://thetopvoices.com/news/mave-launches-with-34m-agentic-ai-security-platform
[Seekr, 2026] Top 10 Enterprise AI Platforms for Regulated Industries (2026) | https://www.seekr.com/resource/top-enterprise-ai-platforms-regulated-industries/
[Unite.AI, October 2026] Mave Raises $28M Series A, Bringing Total Funding to $34M for Agentic SecOps | https://www.unite.ai/mave-raises-28m-series-a-34m-funding-agentic-secops/
[Ynet News, October 2026] Israeli AI cybersecurity startup Mave raises $34 million to automate threat detection | https://www.ynetnews.com/business/article/symkvnpngg
[LinkedIn, retrieved 2026] Raziel Oren - MAVE Security | LinkedIn | https://il.linkedin.com/in/raziel-oren
[LinkedIn, retrieved 2026] Ran Erez - RE.FOCUS | LinkedIn | https://www.linkedin.com/in/ran-erez/
[LinkedIn, retrieved 2026] Amir Ezra - Tel Aviv Stock Exchange | LinkedIn | https://www.linkedin.com/in/amir-ezra-cyber/
Articles about Mave
- Mave's Agentic Security Platform Lands in 200 SOCs With $34 Million — The Israeli startup, founded by Unit 8200 veterans, is automating threat response across existing tools for Fortune 50 companies and MSSPs.