Mave raises $34M to build specialized AI models for cybersecurity

The shift toward specialized AI

Israeli startup Mave recently closed a $34 million Series A funding round to develop artificial intelligence specifically for cybersecurity tasks. The company was founded in 2025 by Raziel Oren, who previously led a team in Israel's Unit 8200 military intelligence unit. This new capital will be used to hire researchers, develop backend infrastructure, and collect data to train specialized models.

The core philosophy of Mave is that general-purpose large language models (LLMs) are often too slow, expensive, and inaccurate for high-stakes security work. Oren argues that while general models are useful for broad questions, cybersecurity requires a different approach. The startup aims to match specific AI models to specific missions, choosing the best tool for the job rather than relying on a single massive system.

By focusing on specialized models, Mave intends to solve the problem of hallucinations, which occur when AI generates false information. Because cybersecurity is a closed environment with specific rules, the company believes it is easier to test for accuracy than in a general-purpose space. Mave's goal is to provide a system that is significantly faster and cheaper than the current industry standards.

Small models vs. frontier LLMs

A key technical distinction Mave makes is the use of small language models (SLMs) and neural networks over frontier models like Claude. For example, Mave found that using an SLM specifically built for a certain API outperforms larger models in terms of price and speed. This is because the smaller model does not waste resources loading unnecessary context or references that are irrelevant to the specific task at hand.

The company highlights that using standard API querying can sometimes inflate token usage by 85% while reducing speed by 60%. By building models that know exactly how to query a single tool, such as CrowdStrike's endpoint detection and response (EDR), Mave eliminates these inefficiencies. This approach allows the AI to function almost as fast as a direct API call while maintaining high levels of precision.

To manage these various models, Mave developed a proprietary harness rather than using off-the-shelf software. This custom architecture handles sub-agents, memory retention, and workspace creation for the user. It is designed to ensure that security operations remain explainable and aligned with the actual workflows used by security operations center (SOC) analysts.

Solving the security workload

Currently, Mave is primarily used by organizations for alert triage and resolution, though it is expanding into threat hunting and intelligence. One large American managed security service provider (MSSP) used the platform to identify active exploits across its customer base within minutes of a vulnerability disclosure. This demonstrates the platform's ability to process behavioral signals and entity data in real time.

The company addresses a major pain point for Chief Information Security Officers (CISOs): the inability to hire enough people to handle the endless volume of security data. Oren noted that even with a massive budget, a company could not hire enough staff to keep up with modern threats. Mave positions its AI as a way for organizations to internalize these capabilities instead of relying solely on outsourced managed services.

The platform also focuses on data normalization across different identity providers and endpoint tools. Many existing tools fail because they create cached organizational layers that can lead to reasoning based on outdated data. Mave's infrastructure aims to provide a more dynamic connection between signals to ensure that investigations are based on the most current information available.

The path to consolidation

Looking ahead, Mave intends to move beyond simple alert triage to consolidate entire security operations workflows. The company plans to compete directly with established security information and event management (SIEM) vendors like Splunk, CrowdStrike, and Microsoft Sentinel. The goal is to create a single platform where most security data and workflows are handled in one place to simplify the context for human operators.

The startup is positioning itself against both managed detection and response (MDR) providers and existing agentic AI security firms. By offering a consolidated platform, Mave hopes to make it easier for companies to manage their security posture without jumping between multiple disconnected tools. They believe the market is already educated on the need for AI in the SOC due to the overwhelming volume of work.

As the company grows, it will continue to focus on the