Cribl acquires CardinalOps to expand into security operations with AI-native threat detection

Cribl buys AI-native threat detection engineering startup CardinalOps

Cribl buys AI-native threat detection engineering startup CardinalOps Data observability and telemetry management company Cribl Inc. says it's extending its capabilities into security operations after acquiring the artificial intelligence-native security engineering startup CardinalOps Ltd. for an undisclosed price. Cribl said that buying CardinalOps will give it advanced "detection engineering capabilities" that will help its enterprise customers to detect more sophisticated cybersecurity threats. It will also give them an easy way to beef up their security information and event management, data lake and extended detection and response systems, the company said. CardinalOps has built an array of AI tools and systems designed to help enterprises identify, manage and reduce their threat exposure level. It does this by enhancing their ability to detect potential issues across all of their security tools, supporting continuous threat exposure management. Its technology works by mapping security controls against the real-world behavior of cyber adversaries, automating detection engineering tasks and helping teams to find and eliminate coverage gaps and broken or noisy rules that could be exploited by attackers. According to Cribl, this kind of thing is just what the doctor ordered for many organizations today. It said businesses are under increased pressure to process and scan more of their telemetry data to identify advanced threats, while also keeping a lid on the spiraling costs of these security environments. With CardinalOps' technologies, Cribl believes it will be the ideal partner to help organizations do this. While it handles telemetry management at scale, CardinalOps adds a detection layer that can help businesses to generate actionable insights from that raw data. Cribl thinks it will be able to help businesses in several ways. They'll be able to use their telemetry more intelligently, continuously validating and improving threat detection while still using their preferred security tools. "Security teams need a better way to turn telemetry into effective detections and outcomes," said Cribl co-founder and Chief Executive Clint Sharp. "CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they've outgrown." The addition of CardinalOps' capabilities underscores Cribl's novel platform-based approach to security, which enables companies to collect, merge, analyze and act on telemetry data from multiple computing environments. With CardinalOps, it's gaining advanced detection engineering capabilities that it will be able to layer into its telemetry foundation, ensuring customers have the flexibility to modernize their security environments as they see fit. "We built CardinalOps to bring automation and rigor to detection engineering," said CardinalOps co-founder and CEO Michael Mumcuoglu. "Joining Cribl gives us the opportunity to bring that capability into a broader telemetry platform and help customers correlate and improve detections across the SIEM, data lake and other security tools already in their environment." Those are all future plans, and nothing has changed yet. But Cribl said it's already going full speed ahead as it races to integrate CardinalOps' capabilities into its telemetry management platform, and so customers can expect to see a major update rolling out soon.

Cribl Acquires CardinalOps In Move To Expand Into Security Operations

The combination of Cribl's AI Platform for Telemetry and CardinalOps' agentic detection software provides an alternative for legacy SIEM architectures, helping clients improve threat coverage and strengthen SOCs, according to the companies. Telemetry data platform provider Cribl is acquiring CardinalOps, a developer of agentic detection engineering software, in a move Cribl said will expand its capabilities into security operations. Fast-growing Cribl said the acquisition adds detection engineering capabilities to its technology portfolio that will help customers improve security threat coverage, lower data costs and bolster their security operations centers (SOCs). With the addition of the CardinalOps technology, the Cribl platform will offer businesses and organizations "a flexible path forward" toward replacing legacy SIEM (security information and event management) systems. [Related: The Coolest Data Observability Companies Of The 2026 Big Data 100] "Security teams do not need more disconnected tools. They need a better way to turn telemetry into effective detections and outcomes," said Cribl co-founder and CEO Clint Sharp (pictured), in a news release. "CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on and serves as the foundation for a complete, open alternative to the SIEM stack they've outgrown," Sharp said. Terms of the acquisition were not disclosed. Cribl's platform manages, processes and routes IT and cybersecurity telemetry data -- including logs, metrics, traces and events -- in real time. The company's cloud-based product suite includes Cribl Stream, Cribl Edge, Cribl Search and Cribl Lake. Cribl, founded in 2018 and headquartered in San Francisco, reported in February that it surpassed $300 million in annual recurring revenue in 2025, up from the $200 million in ARR it reported in December 2024. The company is widely seen as positioning itself for an IPO at some point over the next few years. The CardinalOps Story CardinalOps, founded in 2020 and based in Tel Aviv, Israel, is led by Michael Mumcuoglu and Yair Manor, veterans of the Israeli Defense Force's Unit 8200. Previous startups founded by Mumcuoglu and Manor were acquired by Palo Alto Networks and Microsoft. "Too many security teams have good data, powerful tools and endless alerts, but no real confidence that they are actually protected," Mumcuoglu said in the news release. "We built CardinalOps so SOC teams could understand and improve coverage instead of just managing more noise. Joining Cribl lets us bring that directly into the telemetry layer and build what the market needs next: an open, AI-native alternative to the SIEM, where customers pay for better protection, not more data volume. That's what we're building next," he said. The CardinalOps platform uses AI to continuously assess and improve threat detection coverage by mapping security controls against real-world adversary behavior. It automates detection engineering tasks, helps security teams identify and eliminate coverage gaps, finds and fixes broken rules, and unlocks "the full value of their existing security stack," Cribl said. The combination of the two companies' products pairs Cribl's ability to manage telemetry data at scale with the CardinalOps detection layer, making it possible for clients to more quickly move from raw data to actionable insights, Cribl said. The integration of the CardinalOps technology with the Cribl platform will provide a complete alternative to legacy SIEM platforms, Cribl said, and create a stronger foundation for future security offerings built on the Cribl platform. Cribl also said that with the acquisition the company will establish a new office in Tel Aviv, allowing it to tap into Israel's "deep pool of cybersecurity talent" and accelerate its security development efforts.