Brava Security raises $15M to test if logs show attacks

Brava Security, a startup founded in 2024, came out of stealth with a $15 million seed round, which is a first investment. Its AI agents make simulated attack logs, with no attack done, and test if the security tools of a company find the attack. Brava says that a company must not replace its tools. Its chief executive led the product work for Microsoft Defender.

How it works

Brava makes a model of how an attack looks in the logs of a customer. It tests which attacks the defenses find. Then it changes the detection rules and data feeds that did not find the simulated attack. The rules go into the SIEM, the software that collects logs and finds data in them.

The numbers

Brava says that it gives first results in 10 to 15 minutes after a customer connects it. It connects to more than 70 sources and tools. It says that its clients are Fortune 100 companies, with Cushman & Wakefield. It gave no test results on how many attacks it finds.

What is not known

Pitango and F2 Venture Capital led the investment. It is not known if security leaders use this check before they let AI agents make decisions. Until this time, most investment went to agents that do work on alerts. Torq got $140 million.

Insight: Proof that logs show attacks can become a gate for security agents

Until this time, most investment went to agents that do work on alerts. CrowdStrike launched such agents on 4 November 2026 and gave no test results. Brava gives the check that comes before. This reads as a move: with more agents, proof that logs show attacks becomes a gate for each agent purchase. Gartner forecasts 150,000 agents in one large company by 2028.