The round. Brava Security came out of stealth on Nov. 5 with a $15 million seed round led by Pitango and F2 Venture Capital. Angel investors include executives from Anthropic, Microsoft and Check Point. The company says it already has Fortune 100 customers in retail, energy and hospitality. It plans to use the money to grow in North America and to chase financial services and government buyers.
The problem, in plain words. A security operations center, or SOC, is the team that watches alerts. It only sees what its logs record and what its detection rules look for. If an attack technique leaves no trace in the logs you collect, or no rule matches it, you will never get an alert. Most teams don’t know where those blind spots are. They find out after a breach.
How it’s usually tested. Today the standard answer is breach and attack simulation. You run safe, fake attacks in your environment and check whether alerts fire. It works, but it’s slow. It needs agents installed, approvals from IT, and someone nervous about running attack code in production. So most companies test a small slice of techniques, a few times a year.
Brava’s shortcut. Brava doesn’t run the attack. Its AI agents predict what evidence a given technique would leave in your specific logs. Then they compare that against what you actually collect and what your rules actually catch. The output is a list of attacks you would likely miss. No attack code. No change window. That is the unique part, and it’s why a seed round this size makes sense.
The skeptic’s questions. A prediction is not proof. If Brava says you’d catch something and you wouldn’t, that is worse than not knowing. So the first thing to ask is how often its predictions match a real test. The second question is what happens after the report. Detection engineering, the work of writing and tuning rules, is already the bottleneck in most SOCs. A longer list of gaps does not help a team that can’t close the ones it has. The tool that wins will be the one that writes the fix, not just the finding.
Why the timing works. Attackers are using AI to move faster and try more techniques. Defenders are buying AI SOC tools to handle alerts. Both trends make the same question urgent: are the alerts even there to handle? An AI analyst triaging a perfect queue still misses the attack that never made it into the queue. Brava is selling the map of what never shows up.
Company or feature? This is the real question for investors. SIEM vendors and the big platforms already know which logs you send them and which rules you run. Any of them could add “here is what you can’t see” as a feature. Startups in this spot usually survive in one of two ways. They work across every SIEM and data lake, so no single platform can match their view. Or they get bought by a platform that wants the feature first. Seed-stage, with Fortune 100 logos, Brava has a credible shot at either.
For practitioners. Whatever tool you use, do the exercise. Pick your top ten attack techniques. For each, write down which log would show it and which rule would fire. Where you can’t answer, that’s your gap. Brava’s pitch is doing that for every technique, continuously. It’s worth paying for only if it’s faster than your team doing it by hand.
Would you trust a predicted detection gap enough to act on it without running the attack first?