Mave Raises $34M for AI Models Built for Cybersecurity | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Advanced SOC Operations / CSOC
,
Agentic AI
,
Artificial Intelligence & Machine Learning

Israeli Startup Says General-Purpose LLMs Are Too Costly for Specialized SOC Tasks

Michael Novinson (MichaelNovinson) •
October 27, 2026    

Raziel Oren, co-founder and CEO, Mave (Image: Mave)

An agentic SOC startup founded by an ex-Israeli Military Intelligence team lead raised $34 million to invest in AI researchers, backend developers and AI infrastructure.See Also: There’s No Guidance for AI in Banking… Yet
The Red Dot Capital Partners-led Series A will help Tel Aviv, Israel-based Mave match AI models to specific cybersecurity tasks, build a proprietary harness, and consolidate the security operations market through an agentic AI platform, said co-founder and CEO Raziel Oren. He said the money will be used for AI model specialization, harness development, and data collection and normalization.
“You’ve got to match the model to the task, to the mission, and that’s by design,” Oren told ISMG. “Any cybersecurity task would need to use multiple models, or sometimes the best way to solve an issue is not necessarily an LLM. It might be an SLM, or it might be even a neural network.”
Mave, founded in 2025, employs 20 people and has completed a $28 million Series A round as well as a $6 million seed round led by Dell Technologies Capital and Emerge Ventures. The company has been led since its inception by Oren, who spent 15 months doing AI infrastructure with Trigo, 16 months as a tech lead at Wing Security, and more than seven years as a team lead with Israel’s Unit 8200.
Why General Frontier LLMs Struggle With Cybersecurity Tasks
The company evaluates and maps specific tasks to tailored SLMs, LLMs or neural networks to optimize cost, speed and accuracy while preventing hallucinations since general frontier LLMs are suboptimal, slow and expensive for specialized cybersecurity tasks, Oren said. Mave has security researchers run extensive lab simulations targeting up to 10,000 automated tests daily across complex agentic junctions.
“It has to be fast or faster than what you have today – way faster,” Oren said. “It has to be cheap or cheaper, way cheaper than what you have today, and the most accurate. Accuracy is easy to test in cyber because it’s a closed space. It’s not a generic space, like answering every question that you ask ChatGPT.”
For example, Oren said querying CrowdStrike’s EDR via a small language model purpose-built for that API outperforms using Claude on price, speed and accuracy since there’s no wasted context on loading API references and no frontier model inference. Oren said SLMs also are significantly faster than frontier models for targeted tasks, and that SLMs built for a specific API eliminate hallucination risks.
“You get a very fast model, almost as fast as an API,” Oren said. “You get a very accurate model because it knows exactly how to query only CrowdStrike, and also very cheap because you are not leveraging different platforms.”
Off-the-shelf and open-source harnesses are largely designed for software R&D rather than mission-critical cybersecurity operations. Oren said Mave built a proprietary harness to manage sub-agents, memory retention, workspace creation, and user transparency. This dedicated architecture ensures security operations remain accurate, explainable and seamlessly aligned with SOC analyst workflows.
“If we wanted to solve cybersecurity-related problems, it has to be curated for these problems,” Oren said. “That’s why we need to develop it in house. Even just customer experience, you need your own harness to be able to communicate the correct things to the user that are cybersecurity-related.”
From Alert Triage to Consolidating SOC Workflows
Standard API and MCP querying can inflate token usage by 85%, reduce speed by 60%, and increase hallucinations. Oren said Mave implements an organizational context and normalization layer across endpoint detection and response tools and identity providers. He said Mave’s infrastructure dynamically connects entity and behavioral signals in real time while maintaining cost efficiency and API throughput.
“Where most security tools fail is that they create an organizational layer that is cached somehow, even if it’s five minutes, even if it’s 10 minutes, and then you are basing your investigations or reasoning on false data,” Oren said.
Mave today is used primarily for alert triage and resolution and has gotten into threat intelligence and threat hunting, with a large American MSSP using Mave to identify exposures and active exploits across its customer base within minutes of the PHP vulnerability disclosure. In the future, he said Mave wants to consolidate SOC workflows as well as the SIEM layer itself, competing directly with incumbent SIEMs.
“The market is pretty much educated around AI SOC, and they understand they need it because there is too much to do,” Oren said. “Now they’re looking for consolidation. It just makes sense that most of the security operations workflows and data will be handled by one platform, and then context is made simple.”
Mave works with organizations that understand they can’t hire their way out of the security workload problem and are ready to internalize AI-driven SOC capabilities in place of managed services, Oren said. The company competes against MDR providers such as BlueVoyant and Expel, SIEM vendors including Splunk, CrowdStrike and Microsoft Sentinel, and agentic AI security operations firms including Prophet and Simbian.
“One of our taglines that we go with in our marketing material is: ‘You can’t hire your way out of this,'” Oren said. “Because even if the CISO had the chance, or had the budget to hire 10,000 people, it’s still not enough, because the workloads are endless.”

——————————————————-
Click Here For The Original Source.

Previous Article

Related