Scanner.dev

About Scanner.dev

Scanner is a San Francisco-based security data lake company that gives security operations teams and AI agents visibility into every log. Its guiding line is that no cyberattack should succeed because of an unseen log, and it builds an alternative to traditional SIEMs and conventional data lakes so that teams can retain all of their security data and search it in seconds rather than sampling or deleting logs to control cost.

The company frames the problem in two halves. Traditional SIEMs are too expensive to ingest every log, with high ingestion and indexing costs that force sampling, painful cluster tuning and shard management, and proprietary formats that lock data in. Traditional data lakes are too slow, with full-text searches that can take hours and cost a lot per run, heavy engineering to normalise each new log type and scheduled queries that cannot detect in real time. Scanner's answer is schemaless indexing across the whole environment, fast full-text search across petabytes with sub-ten-second queries, and continuous detection that avoids repeated rescans.

The product is organised around collecting and enriching logs from clouds, SaaS tools and lake and warehouse streams that sit in object storage, searching and investigating, detection and response, and MCP and API access so that AI agents can query the data. SOC analysts and agents use it to monitor logs, build detections and investigate threats, and the site offers documentation, guides, a changelog and customer case studies. Open formats and lower ingestion cost are positioned as ways to avoid vendor lock-in.

Scanner sells its platform as a commercial software subscription to enterprise security and detection and response teams through a demo-led sales motion with published pricing information, competing in the security analytics and SIEM replacement market on cost per retained log and speed of investigation.