The round. Mave, a Tel Aviv startup founded in 2025, raised a $28 million Series A led by Red Dot Capital Partners. Lumir Growth Partners joined, and seed investors Dell Technologies Capital and Emerge Ventures came back in. With its $6 million seed, Mave has raised $34 million. Valuation: Undisclosed. Revenue: Undisclosed. It has a little over 30 employees and plans to more than double.
What it does. Mave sells AI agents for the security operations center, or SOC, the team that sorts through security alerts. The agents take an alert, query each security tool in that tool’s own language, pull live context like who owns a machine and what’s running on it, throw out false positives, and carry out response actions the team has pre-approved, such as isolating a laptop or disabling an account. Every query and decision is logged so a human can check the work.
The bet that matters. Most SOCs are built around a SIEM: a central database where logs get shipped, stored and searched. You pay to move the data and you pay to keep it. Mave’s pitch is the opposite. Leave the data where it is and ask the tools directly. Red Dot partner Atad Peled put the problem bluntly: today, “coverage is a budget decision, not a security one.” In plain words, teams skip collecting some logs because storing them is expensive, then miss the attack that lived there.
Why the timing is right. Attackers just got faster. CrowdStrike told CyberScoop last week that AI-driven intrusions it tracked exceeded 1,500 commands an hour, against up to 40 for a human. A SOC that investigates one tool at a time, by hand, can’t keep that pace. Something has to do the first hour of an investigation in minutes. That’s the job Mave, and a crowd of rivals, are selling.
Why the old model’s price tag matters. Cisco paid about $28 billion in equity value for Splunk in 2024. Microsoft, Google and the big endpoint vendors all sell their own SIEMs. Those franchises are built on owning the data. If investigation moves to an agent layer that sits across every tool, the SIEM becomes one more source to query, not the brain. That’s why this category keeps drawing money even though it’s crowded. The prize isn’t alert triage. It’s deciding where the SOC’s center of gravity sits.
Where I’m skeptical. “Query in place” has real limits. An agent can only see what each tool keeps and exposes. If a tool holds seven days of logs, the investigation is blind on day eight. Rate limits, API outages and vendors that throttle third-party access all become the customer’s problem, and the incumbents control those APIs. A platform vendor that already sees the same telemetry can bundle similar automation at a lower price. Mave’s numbers need checking, too. It says ARR grew more than 400%. Its press release says over the last year. Calcalist quoted it as over the past six months. Neither gives a base number. Fortune 50 customers and seven-figure deals are strong signals, but none are named.
Where I land. The thesis is right. The SOC of the next few years won’t route every investigation through one giant database. But the winner won’t be whoever summarizes alerts best. It’ll be whoever earns permission to act. That’s why Mave’s audit trail matters more than its model mix. For a $28 million Series A in year one, investors are paying for the chance to prove that. The real test is the first renewal: do customers leave the auto-response switches on after a full year?
For buyers. In a pilot, measure three things. The share of alerts closed without a human. The false-close rate on a red-team test you run yourself. And what happens when one connected tool goes offline. Then ask what it does to your SIEM bill, not just your headcount.