Cribl buys CardinalOps to build an open alternative to legacy SIEM
What's the deal? Cribl, which describes itself as an AI platform for telemetry, is acquiring CardinalOpsDealroom has a profile for this one. Try Dealroom →, an agentic detection engineering company. The deal adds detection capabilities aimed at helping customers improve threat coverage, cut security data costs, and modernise their security operations centres. Terms were not disclosed.
What each side brings: Cribl runs an open, vendor-agnostic platform to collect, move, store, and act on telemetry across environments. CardinalOps, founded in early 2020, uses AI to map security controls against real-world adversary behaviour, flagging coverage gaps and fixing broken or noisy rules.
What's the endgame? Cribl wants to offer a complete, open alternative to the traditional security information and event management (SIEM) stack. "CardinalOps strengthens our AI Platform for Telemetry by adding deep detection engineering capabilities to the open data infrastructure our customers already rely on," said Clint SharpDealroom has a profile for this one. Try Dealroom →, co-founder and chief executive officer of Cribl.
Why now? Security teams face pressure to process more telemetry, respond faster, and control rising costs. The pitch: pay for better protection rather than more data volume.
Market expansion: Alongside the deal, Cribl will open a new office in Tel Aviv, tapping Israel's cybersecurity talent pool. CardinalOps founders Michael MumcuogluDealroom has a profile for this one. Try Dealroom → and Yair ManorDealroom has a profile for this one. Try Dealroom → are veterans of the Israel Defense Forces' Unit 8200, with previous startups acquired by Palo Alto Networks and Microsoft.
What could go wrong? Replacing entrenched SIEM systems is a heavy lift, and Cribl is entering a crowded security operations market against established vendors. Integrating a detection layer into its telemetry infrastructure will test whether the combined product delivers on its promise.
The signal: The deal reflects a broader push to consolidate fragmented security tooling and rethink pricing tied to data volume. As telemetry costs climb, infrastructure players like Cribl are moving up the stack into detection, betting that open, AI-native platforms can displace legacy security architectures.
Read more: GlobeNewswire
