The Canadian government’s chief information officer says there’s no sign a massive global website coding vulnerability has led to federal information being compromised.
The Canadian government’s chief information officer says there’s no sign a massive global website coding vulnerability has led to federal information being compromised.
Mave has raised $34 million to bring AI agents to companies' security operations.
CEO Raziel Oren said old systems can't keep up with how quickly AI is transforming cyberattacks.
Business Insider got an exclusive look at the pitch deck Mave used to raise its Series A round.
Mave, a cybersecurity startup that uses agents to counter the rise in AI-powered cyberattacks, has raised $34 million in funding.
The Israel-based startup says its AI agents pull together information from a company's existing security systems, investigate alerts, filter out false alarms, and take actions approved by human teams.
"Security operations is the last gate in any organization," cofounder and CEO Raziel Oren said, comparing it to the physical security guards who monitor a building's live camera footage. "This thing is really broken from the inside. The roots of the solutions there are just not keeping the relevant pace with the emerging threats."
Mave says its own agents help human security teams keep up. "You can't hire your way out of this," Oren told Business Insider. "There must be a change in how you do [security operations] in order to protect your organizations."
Oren cofounded Mave with Guy Eshel in 2025 after years of friendship. The two met when Oren was Eshel's mentor in unit 8200 of the Israel Defense Forces, which sits under the intelligence corps and gave them firsthand experience with cybersecurity issues.
AI agents have come under the spotlight after a string of high-profile security breaches. Corporate leaders have grown increasingly worried about the cybersecurity risks AI poses, and some of Wall Street's executives spent third-quarter earnings calls explaining how they're defending against rogue AI agents.
The technology has also been used by researchers to uncover security flaws: this week, OpenAI said one of its AI models had helped identify a vulnerability that puts 70% of the world's websites at risk.
Oren said it takes some customers time to become comfortable handing over security operations to agents, but that the product's transparency is key to building trust. Mave says its agents track each step of their thousands of workflows, giving human employees insight into the agents' reasoning and actions.
Mave charges its customers a flat rate, depending on the company's size and needs. Other startups have also jumped at the opportunity Mave sees, including agentic cybersecurity companies Dropzone and Prophet Security.
Mave's $34 million funding consists of $28 million from a recent Series A round, led by Red Dot Capital Partners and with participation from Lumir Growth Partners, and an earlier $6 million seed round.
The startup currently has 30 employees and plans to use some of the fresh capital to continue expanding the team, mainly for go-to-market roles and AI research.
Read the pitch deck Mave used to raise its Series A round:
The co-founders met in the army.
Mave
Cyberattacks are happening much faster.
Mave
Mave consolidates security operations.
Mave
In one instance, Mave says it stopped ShinyHunters, a cybercriminal group.
Mave
Customers include Fortune 200 and Fortune 500 companies.
Companies and governments around the world raced on Thursday to patch critical vulnerabilities in the widely used PHP programming language, as millions of hacking attempts were reported and authorities across Asia activated emergency cybersecurity measures.
The rush came after government websites in Europe and elsewhere went offline on Wednesday, with the disclosure of the flaws sending website operators scrambling to protect their systems.
PHP developers released urgent security fixes on Wednesday after vulnerabilities that had remained in the software for years were uncovered using artificial intelligence. The developers urged all users to update immediately.
Cloudflare Chief Executive Matthew Prince said attempts to exploit the vulnerabilities had surged dramatically following their public disclosure.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Prince said in a post on social media platform X late on Wednesday.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
The vulnerabilities could allow attackers to execute malicious commands without authentication, steal sensitive information or take websites offline, according to South Korea’s science ministry.
Asian governments activate emergency measures
South Korea raised its private-sector cybersecurity alert level on Thursday and activated emergency response measures, citing the increased risk of hacking attacks.
The presidential National Security Office convened an emergency meeting involving intelligence, defence and science ministry officials to coordinate responses across the public, private and military sectors.
The science ministry said it had issued security guidance to approximately 28,000 companies with registered chief information security officers and 5,900 members of a government information-sharing network.
Operators of critical infrastructure, web-hosting companies and data centres were also alerted.
Authorities urged organisations to install the latest PHP security updates and introduce temporary safeguards where immediate patching was not possible.
China’s industry ministry similarly called on organisations and users to inspect their systems immediately and upgrade to the latest secure version of PHP.
It also recommended strengthening cybersecurity monitoring and promptly changing accounts, passwords and security keys.
Japanese banks and government services affected
In Japan, Mitsubishi UFJ Financial Group said on Thursday it was temporarily suspending some internet services as part of emergency security measures.
Japan’s Finance Ministry also suspended some website content and online services while implementing protective measures.
Prime Minister Sanae Takaichi urged website operators on Wednesday to check whether their systems used PHP and prepare to install the security fixes.
The disruptions and emergency measures highlight the potential impact of vulnerabilities in PHP, a programming language widely used to power websites and online services.
The disclosure of the flaws, followed by the rapid escalation in attempted exploitation, has prompted governments and businesses to accelerate security updates to protect their systems from possible attacks.
The European Union has taken a significant step towards revising its digital regulatory framework after member states agreed proposals to amend the General Data Protection Regulation (GDPR), simplify cookie consent requirements and overhaul cybersecurity reporting obligations.
The measures form part of the European Commission’s Digital Omnibus package, introduced in November 2025, and represent one of Brussels’ most substantial attempts to simplify the regulatory obligations imposed on businesses operating across the single market.
Changes to GDPR and personal data rules
The proposed reforms would modify several provisions of the GDPR, which has governed the processing of personal data across the EU since May 2018.
Rather than replacing the legislation, the Council wants to clarify existing obligations, particularly those concerning pseudonymised information, requests for access to personal data and the use of information in scientific research.
The agreed position retains the existing definition of personal data while introducing provisions intended to clarify when pseudonymised information can be linked to an identifiable individual.
Companies would also benefit from simplified procedures for handling manifestly unfounded or excessive data requests and from reduced information requirements in certain low-risk circumstances.
Another proposed change would extend the deadline for notifying authorities of personal data breaches, while establishing more consistent reporting templates across the EU.
For multinational companies, which currently navigate different interpretations of data protection obligations by national authorities, these provisions could reduce compliance costs and administrative duplication.
However, the changes have raised concerns among European privacy regulators.
In a joint opinion published in February, the European Data Protection Board and European Data Protection Supervisor warned that parts of the Commission’s original proposal could create legal uncertainty and undermine existing protections.
They were particularly concerned about proposals affecting the definition of personal data and the Commission’s potential role in determining when pseudonymised information falls outside GDPR requirements.
The Council’s decision to retain the existing definition addresses part of that debate, although the final legislative text remains subject to negotiations.
Fewer cookie banners for internet users
One of the most visible changes would affect the consent notices encountered by Europeans when visiting websites.
Under the Council’s proposal, additional categories of cookies and similar tracking technologies could be used without obtaining explicit consent, provided the relevant legal conditions are satisfied.
The proposed exemptions include technologies necessary to deliver a service, maintain device security or conduct audience measurement.
For website operators, publishers and online businesses, the changes could reduce the number of consent requests displayed to visitors and simplify technical compliance.
The current system has generated extensive legal disputes over whether consent is genuinely voluntary and whether tracking technologies collect information beyond what users have authorised.
The latest proposal would not abolish consent requirements for commercial tracking or behavioural advertising. Technologies falling outside the permitted exemptions would remain subject to the applicable privacy rules.
Cybersecurity reporting and artificial intelligence
The package also addresses the growing number of reporting obligations imposed on European businesses under overlapping cybersecurity legislation.
The Commission originally proposed a single European reporting mechanism for certain data and cybersecurity incidents.
Member states have instead agreed to establish national entry points, supported by an EU-level information system and provisions for coordinating cross-border notifications.
The Council’s position would also clarify the legal grounds for certain uses of personal data in artificial intelligence systems and introduce safeguards for processing sensitive information in specified circumstances.
These provisions follow increasingly complicated disputes over the application of European privacy legislation to AI development and automated decision-making.
The Commission estimates that its wider digital simplification initiative could save European businesses up to €5 billion in administrative costs by 2029.
The initiative reflects pressure from European governments and business organisations to reduce the regulatory fragmentation that makes operating across multiple EU jurisdictions more expensive.
The Digital Omnibus is part of a broader legislative programme influenced by the competitiveness reports produced by former Italian prime ministers Enrico Letta and Mario Draghi.
Under the Council’s negotiating mandate, several existing data-related rules would also be consolidated, while provisions governing the protection of trade secrets would be strengthened.
The European Parliament must now determine its negotiating position before formal discussions between the institutions can begin. Until the legislation is agreed and adopted, existing GDPR, cookie consent and cybersecurity requirements remain in force.
Login
