Tel Aviv just put a price on your unread tickets. Former Unit 8200 officers raised $34 million for Mave, a 2025 startup that sends AI agents to investigate alerts across the security stack you already bought. The pitch lands because the queue never dies, last week still dumped a critical PHP patch window and an exploited GlobalProtect VPN onto the same tired shift, and nobody is hiring a dozen seniors before Friday. Someone sold cybersecurity teams an intern that never sleeps. Cute. If your detections are junk, that intern will be very fast at being confidently wrong.

They raised 34 million to finish your homework

Mave’s story is almost too on-the-nose. Unit 8200 alumni. Tel Aviv. Agents that sit on your existing tools and investigate. Investors hear an elite intelligence unit plus automation and open the checkbook. You should hear a quieter confession: the industry still cannot operate the pile of products it already licensed.

Look at the week that funded this fantasy. Help Net Security’s roundup was the usual buffet. Critical interpreter patches. An edge VPN already under exploitation. The people who would use an investigation agent were in after-hours change windows, hoping the emergency build actually installed. The shortage is finished work, sitting under dashboards you already paid for.

Agentic SecOps sells a flattering diagnosis. Your analysts are overloaded, so buy software that thinks like an analyst. Most of the load is self-inflicted. Threat detection fires on every failed login because nobody set a baseline. Brute-force alerts page at 2 a.m. because the lockout policy is theater. Your SIEM still carries the vendor’s default rule pack from the install weekend. An agent reading that feed is autocomplete with a badge.

You’ll hear that the agent works across the stack, which means it needs read, and maybe write, to everything you consider sensitive. Tickets. EDR. Identity. Email. The firewall change API if someone gets ambitious. That is a privileged identity with a probabilistic brain. Treat it like a new hire with production keys on day one.

Defense in depth still applies. The agent is another layer. It does not replace security hardening or an owner on each detection, and it does not pardon the playbook that says “investigate further.” If that sentence is your whole runbook, you have a vibe, not a process.

Staffing is ugly, so this round will still work on buyers. You cannot conjure senior investigators. A $34 million story about agents is easier to present than deleting half your detections and making people own the rest. One of those actually reduces risk.

Your cybersecurity program is still a ticket queue

Call it cyber security, SecOps, or the platform. If the unit of work is a ticket that sits until a human feels guilty, you are running a queue. Queues do not get smarter when you attach a language model. They get faster, which helps only when the work was worth doing.

Incident response in a lot of shops is still a relay. Alert, enrich if you are lucky, guess, contain if the star analyst is on shift, document later if anyone remembers. Threat-protection licenses promised to shrink that relay. They added another console. The agent vendor now promises to sit across those consoles and finish the thought. On the slice of alerts that already have clean telemetry and a written decision tree, it might. The rest is where your mean time to nonsense lives.

This is a bad look for buyers who skip the boring audit. You are about to let a non-human investigator summarize evidence, recommend containment, and in the aggressive deployments, execute it. If you cannot explain how last month’s true positives were decided, you cannot supervise that. Audit logs of the agent’s reasoning become the new SIEM: voluminous, late, and unread.

Watch the identity problem that never makes the demo. An investigation agent that can query identity providers, pull mailbox content, and open a block on the firewall is a roaming admin. Steal the tokens. Prompt-inject the ticket the agent trusts. You get incident response working for the attacker. Your threat detection may even cheer, because the agent contained the host the attacker wanted quiet.

I like automation that closes duplicates and suppresses known-benign scanner ranges. That is hygiene. The jump from close the duplicate to go investigate across the estate is the jump from a macro to a junior analyst with prod. You would not give that analyst unsupervised write. Do not give it to a model because the round was $34 million and the founders have the right unit on their LinkedIn.

Ask what investigate means in your telemetry, not in the pitch. If the alert has no asset owner, no process tree, no identity context, and no prior tickets, the agent will write a fluent paragraph about missing data. Your executives will read the fluency as competence. That is how you launder uncertainty into a closed ticket.

Do this before you let an agent touch prod

Start with the pile, this week, using exports you can already pull.

Export 30 days of closed alerts and score them. True positive, false positive, duplicate, never-investigated. Split by source. You want the ugly percentage, not the vendor efficacy slide. Anything with a true-positive rate you cannot defend in a hallway conversation gets suppressed, tuned, or deleted before an agent ever sees it. If brute-force noise is half the queue, fix the lockout and the allowlist. Skip the narration.

Write five playbooks that match what actually repeats in your environment. Stolen session. Exposed service. Malware on a workstation. Privileged add. Vendor remote-access alert. Each one needs a decision, a containment owner, and a stop condition. Investigate is not a step. If you cannot put the stop condition in a sentence, the agent will wander until a human gets bored and clicks close.

Then treat the agent as an identity. Separate credentials. Least privilege. No blanket SIEM-admin role so it can be useful. Human approval for anything that changes access, containment, or firewall policy. An append-only log of prompts, tool calls, and actions that your incident response team can read without a vendor UI. If the vendor cannot export that log, you are renting a black box that will testify against you badly.

• This week: measure true-positive rate by detection family and kill the undefendable rules.
• This week: bind any agent to read-only plus a human gate on containment and identity changes.
• This month: give five recurring alert types a real stop condition and an owner.
• Ongoing: review agent actions like privileged-user activity, and tabletop a poisoned-ticket or prompt-injection case.
• Ongoing: keep security hardening and defense in depth on the controls the agent might disable in a hurry.

Keep detection on a product cadence. Every rule has an owner, a last-tuned date, and a retirement date. Track dwell and response by family, not as one blended MTTD. When you turn an agent loose, start it on the families you already close well. Expansion is earned. Emergency patches will keep arriving. Your job is to make the queue honest enough that extra labor has something true to work on.

If a vendor promises that threat protection plus agents equals a quieter SOC, ask for the last 90 days of false-positive rate against a customer stack that looks like yours. Buy labor multiplication after the homework.

Sources

• Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
• Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw