Brava’s platform tests security tooling by generating attacker-like telemetry without launching real attacks, identifying gaps in telemetry, detection logic, and log collection.

Using multiple AI agents, Brava predicts the telemetry evidence of attack techniques, then compares these predictions with existing monitoring capabilities and suggests adjustments to SIEM systems to close gaps.

The system can identify missing logs, telemetry gaps, and ineffective detection rules, and it can modify detection rules and data feeds within SIEM platforms to address identified gaps.

Brava’s funding round included angel investors with ties to Anthropic, Microsoft, and Check Point, and the company plans a North American expansion targeting financial services and government sectors.

The expansion plan focuses on North America, especially financial services and government, while pivotal questions remain about whether security leaders will validate AI-driven approaches before ceding decisions to AI agents.

The company intends to grow in North America, pursue customers in financial services and government, and invest in further AI and threat-detection capabilities.

On adoption, Cushman & Wakefield’s CISO Erik Hart notes Brava centers AI on enhancing human effectiveness by investigating alongside teams and grounding decisions in factual evidence.

Brava already serves Fortune 100 customers in retail, energy, and hospitality, with initial insights available within 10 to 15 minutes after onboarding.

The product integrates with existing security stacks, supporting more than 70 sources and destinations such as Splunk, Google SecOps, and CrowdStrike, to avoid replacing current tools.

Brava’s platform supports 70+ sources/destinations (e.g., Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike NG-SIEM, Elastic Security, IBM QRadar) with initial insights 10–15 minutes after SIEM connection.

Aquarium, the investigation agent, accepts plain-English questions, plans and adjusts queries, and searches SIEM, archived logs, EDR, and cloud audit trails; its reports link findings to underlying raw events.

Reported daily metrics include 2.4 trillion events read and fingerprinted, 1,100 attack techniques replayed, 3,800 detections retested, and 140,000 fields mapped per day across customer environments.