Israeli Startup Claims General-Purpose LLMs Fall Short for Specialized SOC Applications
In a significant recent development within the cybersecurity landscape, an Israeli startup has successfully raised $34 million to enhance automation and efficiency in Security Operations Centers (SOCs). Founded by Raziel Oren, a former lead of a specialized team in the Israeli Military Intelligence, Mave seeks to tailor AI technologies specifically for cybersecurity tasks. This financial backing, led by Red Dot Capital Partners, aims to push the boundaries of AI model application in the security sector.
Mave’s initiative comes at a time when general-purpose large language models (LLMs) are being scrutinized for their limitations in specialized applications, particularly within SOCs. Oren has emphasized that conventional LLMs can be overly costly and inefficient for specific cybersecurity tasks. The funds acquired will enable Mave to invest in AI researchers, backend developers, and the necessary AI infrastructure to refine their processes.
The startup’s vision is to create a proprietary platform that aligns AI models with distinct cybersecurity requirements. Oren articulated the need for specialized models, stating, "Any cybersecurity task would need to use multiple models. The best way to solve an issue might not necessarily involve an LLM; it could be a small language model (SLM) or even a neural network." This perspective underscores the importance of matching AI capabilities to the mission at hand.
Founded in 2025, Mave has been efficient in scaling its operations. With a team of 20 employees, the company has already completed a previous Series A funding round of $28 million and a $6 million seed round. Under Oren’s guidance, who brings experience from both Trigo and Wing Security along with his extensive tenure at Israel’s elite Unit 8200, Mave is positioning itself as a formidable player in the cybersecurity market.
The Challenge with General-Purpose LLMs
Oren critiques the limitations inherent in general frontier LLMs when applied to cybersecurity tasks. He contends that these models are not only suboptimal but also slow and costly. Mave takes a targeted approach, evaluating and mapping specific tasks to tailored SLMs and neural networks to achieve greater efficiency, speed, and accuracy—while mitigating the risk of "hallucinations" that can arise from generalized AI models.
Oren noted that Mave’s security researchers conduct extensive lab simulations, capable of performing up to 10,000 automated tests daily across complex operational scenarios. He stressed, "It has to be fast—way faster than what you have today. It must also be cheap—way cheaper—and the most accurate." According to him, one of the strengths of Mave’s solutions is that they are tailored specifically for closed cybersecurity environments, leading to higher reliability compared to generic queries associated with models like ChatGPT.
For example, Oren argued that querying CrowdStrike’s Endpoint Detection and Response (EDR) platform through a dedicated SLM yields better results in terms of price, speed, and precision. This method eliminates unnecessary context loading and avoids costly inference processes inherent in frontier models. The efficiency of SLMs, specifically designed for certain APIs, helps eliminate the risks associated with "hallucination," effectively streamlining the cybersecurity process.
Developing Specialized Solutions
Rather than relying on generic off-the-shelf solutions, Mave has opted to develop a proprietary framework aimed at enhancing security operations. Oren pointed out that existing open-source models are often adapted for software research and development rather than the mission-critical nature of cybersecurity. Mave’s custom harness focuses on functionality such as memory retention, user transparency, and managing sub-agents, ensuring that operations are aligned with the workflows of SOC analysts.
"If we want to solve cybersecurity-related problems, it needs to be curated for those issues," Oren explained. This approach not only enhances accuracy but improves the overall experience for users tasked with interpreting complex data.
Future Aspirations and Market Implications
Currently, Mave’s technology is primarily employed for alert triage and resolution, with plans to expand into threat intelligence and threat hunting. They have already partnered with a major American Managed Security Service Provider (MSSP) to identify vulnerabilities and active exploits rapidly following disclosures like the PHP vulnerability. Oren envisions a future where Mave consolidates SOC workflows and the Security Information and Event Management (SIEM) layer itself, positioning the company to compete directly with established players in the industry.
Oren’s insight into the shifting landscape reveals a growing awareness among organizations of the need for AI-driven SOC capabilities. As the industry becomes more attuned to the challenges posed by escalating security workloads, Mave aims to serve organizations that recognize the limitations of simply hiring additional personnel. "You can’t hire your way out of this," is a mantra that resonates strongly with Oren, as the workloads are often overwhelming.
While Mave faces competition from various players—including Managed Detection and Response (MDR) providers, SIEM vendors, and other agentic AI security firms—the startup is focused on delivering specialized solutions that address the unique challenges within the domain of cybersecurity. As the demand for effective, AI-enhanced security operations grows, Mave could potentially reshape how organizations approach cybersecurity tasks in an increasingly complex digital environment.