Agentic SecOps Startup Mave Raises $34M to Automate Threat Investigation

Threat actors are increasingly leveraging automation and generative AI models to compress the attack timeline. Where traditional adversary behavior relied on manual discovery and deliberate lateral movement, modern AI-assisted pipelines allow attackers to scan, exploit, and pivot across enterprise environments in minutes. This acceleration has exposed a structural flaw in legacy Security Information and Event Management (SIEM) architectures and traditional Security Operations Centers (SOCs). Security analysts are consistently flooded with high volumes of telemetry and alert noise across disjointed tools, forcing them to manually correlate evidence across identity providers, endpoint detection platforms, and cloud environments while an active intrusion unfolds.

When analysts must manually query discrete security platforms, reconstruct timeline logs, and validate hypotheses step-by-step, the resulting operational delay creates significant window-of-exposure risk. Countering automated, machine-speed attacks requires defensive systems capable of assembling context, evaluating telemetry, and proposing triage paths at a pace that human analysts simply cannot match without algorithmic assistance.

Architecture and Funding Details

To address this operational imbalance, agentic SecOps startup Mave announced $34 million in total funding, highlighted by a new $28 million Series A round led by Red Dot Capital Partners. The investment round included participation from Lumir Growth Partners alongside Dell Technologies Capital and Emerge Ventures, both of which led Mave’s initial $6 million seed round when the company was founded in 2025 by Israeli Defense Forces Unit 8200 alumni Guy Eshel (CTO) and Raziel Oren (CEO).

Mave’s platform integrates directly into an enterprise’s pre-existing security stack to consolidate alert data and automate incident investigation workflows. Rather than requiring organizations to tear and replace their existing SIEM, EDR, or posture management infrastructure, the system deploys autonomous AI agents that pull live contextual data from underlying security tools. By pairing fine-tuned Small Language Models (SLMs) with frontier Large Language Models (LLMs), the platform performs context-based reasoning across disconnected datasets in near real time. This hybrid architecture uses smaller, domain-focused SLMs to handle rapid telemetry processing and structured data extraction, while larger frontier models synthesize complex attack narratives for security personnel.

The newly capital will be used to accelerate internal AI research, strengthen enterprise product offerings, and expand the company’s current staff of approximately 30 employees, focusing primarily on go-to-market and AI research engineering roles.

Balancing Agent Autonomy with Enterprise Control

A primary challenge in deploying agentic systems within enterprise security environments is managing the operational risk of unconstrained execution. While AI agents possess the technical capacity to execute programmatic remediations—such as isolating endpoints, revoking IAM tokens, or modifying firewall policies—unsupervised autonomous action carries substantial risk of self-inflicted downtime if triggered by false positives or poisoned contextual data.

Mave’s platform enforces a governed operational model rather than pushing for fully unguided autonomous remediation:

• Least-Privileged Integrations: Agents query underlying security tools using restricted API scope to harvest live telemetry without maintaining wide administrative write privileges across the network.
• Human-in-the-Loop Approval Gates: High-impact containment or isolation actions require explicit analyst sign-off before execution, ensuring humans retain decision authority over mission-critical systems.
• Auditable Reasoning Chains: The platform logs every query, contextual correlation, and logical deduction made during an investigation, providing security teams with a verifiable decision trail.

By requiring agents to “show their work” through structured audit logs and contextual summaries, defenders can validate AI-generated recommendations without losing critical time to manual log aggregation across multiple dashboards.

The Changing Economics of the Security Operations Center

The broader push toward agentic AI platforms reflects a structural shift in how enterprise security operations are staffed and executed. As adversary automation lowers the marginal cost of conducting rapid, multi-stage attacks, enterprise defense strategies are prioritizing technologies that maximize analyst efficiency over pure headcount expansion.

Automating tier-1 alert triage and evidence gathering addresses the chronic operational burnout that plagues modern SOCs. However, the adoption of agentic SecOps systems also accelerates an ongoing shift in the cybersecurity labor market. As software agents take over routine log correlation, query generation, and initial threat triage, enterprise hiring priorities will increasingly favor detection engineers, automation architects, and senior analysts tasked with governing automated systems over large frontline triage teams.